GVU - Trojaner sperrt PC / Ukash Zahlung verlangt / W7 64bit / Malwarebytes erledigt

d-aus-h · 01.09.2012, 06:03

Jetzt hat es auch meinen großen Rechner erwischt! Bildschirm wird gesperrt, sobald ich versuche, das Inetkabel einzustecken.
Installation von Malwarebyte und update hat bei einem Versuch noch geklappt, dann wieder Sperre.
Hier der log von Malwarebyte:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Stephan :: STEPHAN-HP [Administrator]

31.08.2012 22:26:53
mbam-log-2012-08-31 (22-26-53).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|H:\|I:\|J:\|L:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 576561
Laufzeit: 2 Stunde(n), 1 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\Stephan\AppData\Local\Temp\install_0_msi.exe (Trojan.Ransom) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 8
C:\PortableApps\PortableApps\CCleaner Portable\unicows.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\PortableApps\PortableApps\FDM Lite\dbghelp.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\PortableApps\PortableApps\FDM Lite\msvcp60.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\PortableApps\PortableApps\_Nirsoft\Passwords_Chrome\ChromePass.exe (PUP.ChromePasswordTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\PortableApps\PortableApps\_Nirsoft\Passwords_Firefox\PasswordFox.exe (PUP.PSW.PassFox) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\PortableApps\PortableApps\_Nirsoft\WirelessNetView\WirelessNetView.exe (PUP.WirelessNetworkTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Stephan\AppData\Local\Temp\install_0_msi.exe (Trojan.Ransom) -> Löschen bei Neustart.

(Ende)

cosinus · 01.09.2012, 14:08

Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
Dein Anti-Virus-Programm während des Scans deaktivieren.

Im als Administrator geöffneten Browser diesen Link aufrufen => ESET Online Scanner
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Haken bei Yes, i accept the Terms of Use.
Drücke den Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Scan archives".
Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.

Drücke bitte die

+ R Taste und kopiere folgenden Text in das Ausführen Fenster.

Code:

ATTFilter

"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"

Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:

ATTFilter

"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"

Poste nun den Inhalt der log.txt.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

d-aus-h · 01.09.2012, 14:48

Danke für die weitere Vorgehenswege.
Wie soll ich denn mit dem verseuchten Rechner online gehen? Wenn ich Windows normal starte und ins Inet gehe, befürchte ich, dass mein Bildschirm wieder gesperrt wird. Wenn ich im abgesicherten Modus starte, komme ich nicht ins Inet...

Hmmm, es scheint im "abgesicherter Modus mit Netzwerkunterstützung" zu klappen.
Malwarebyte hat ja zuvor einiges gefunden und gekillt.

Bis eset den online-scan durchhat, dauert es bestimmt noch zwei STunden. Wenn alles klappt, poste ich dann die log-Datei.

Hier nun der log von eset (ohne Löschung):

Code:

ATTFilter

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=a4b0f996329dd747a71aa6a291c3cc0a
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-01 08:03:56
# local_time=2012-09-01 10:03:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 26304199 26304199 0 0
# compatibility_mode=5893 16776573 100 94 0 98152983 0 0
# compatibility_mode=8192 67108863 100 0 262 262 0 0
# scanned=393692
# found=1
# cleaned=0
# scan_time=6704
C:\Users\Stephan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\6d7d629c-1587d6ae	Java/Exploit.CVE-2012-4681.K trojan (unable to clean)	00000000000000000000000000000000	I

cosinus · 02.09.2012, 20:51

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

d-aus-h · 02.09.2012, 20:56

Hier der log von adwcleaner:

Code:

ATTFilter

# AdwCleaner v2.000 - Datei am 09/02/2012 um 21:55:07 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzer : Stephan - STEPHAN-HP
# Normaler Modus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Stephan\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKU\S-1-5-21-4020697152-834944441-851474326-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v15.0 (de)

Profilname : default 
Datei : C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\yd8ecxu8.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1374 octets] - [02/09/2012 21:55:07]

########## EOF - C:\AdwCleaner[R1].txt - [1434 octets] ##########

Soll ich mit dem ESET-Fund
"C:\Users\Stephan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\6d7d629c-1587d6ae Java/Exploit.CVE-2012-4681.K trojan (unable to clean)"
noch irgendwas unternehmen?

Zusätzlich habe ich jetzt einmal DEFOGGER ausgeführt und anschließend OTL scannen lassen.

Hier der log von OTL:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 9/3/2012 12:42:35 PM - Run 4
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Stephan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6.00 Gb Total Physical Memory | 4.95 Gb Available Physical Memory | 82.59% Memory free
12.00 Gb Paging File | 11.13 Gb Available in Paging File | 92.74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 527.19 Gb Total Space | 430.40 Gb Free Space | 81.64% Space Free | Partition Type: NTFS
Drive D: | 13.60 Gb Total Space | 1.67 Gb Free Space | 12.31% Space Free | Partition Type: NTFS
Drive G: | 150.26 Gb Total Space | 143.87 Gb Free Space | 95.75% Space Free | Partition Type: NTFS
Drive H: | 292.97 Gb Total Space | 247.10 Gb Free Space | 84.34% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 95.95 Gb Free Space | 39.30% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 130.87 Gb Free Space | 53.60% Space Free | Partition Type: NTFS
Drive L: | 390.62 Gb Total Space | 310.45 Gb Free Space | 79.48% Space Free | Partition Type: NTFS
 
Computer Name: STEPHAN-HP | User Name: Stephan | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/09/01 07:07:02 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Stephan\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011/03/17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011/03/22 04:04:16 | 000,203,776 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/09/22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/03/05 03:25:36 | 000,209,000 | ---- | M] () [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV:64bit: - [2010/03/05 03:25:34 | 000,496,232 | ---- | M] () [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV:64bit: - [2009/07/28 16:10:48 | 000,088,888 | ---- | M] (AVM Berlin) [Auto | Stopped] -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012/08/30 14:15:07 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/08 18:24:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/08 18:24:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/01/18 16:11:40 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2012/01/18 16:11:32 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2012/01/18 13:27:20 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2012/01/10 20:30:16 | 000,201,344 | ---- | M] (Telefónica) [Auto | Stopped] -- C:\Programme_3\Mobile Partner\Mobile Connection Manager\ImpWiFiSvc.exe -- (TGCM_ImportWiFiSvc)
SRV - [2011/11/18 15:51:12 | 003,673,944 | ---- | M] () [Auto | Stopped] -- c:\Programme_2\SWR_Radio_Recorder\Server\rfx-server.exe -- (Radio.fx)
SRV - [2011/08/29 22:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2011/05/24 11:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2011/04/26 14:54:12 | 002,702,848 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2010/06/25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/10/21 16:50:00 | 000,548,864 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2007/05/31 18:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 18:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/03/06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/05/08 18:24:35 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/05/08 18:24:35 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012/05/08 15:09:33 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2012/03/14 18:23:00 | 000,147,248 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/01/18 16:11:56 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2012/01/18 16:11:08 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2012/01/18 16:10:38 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2012/01/18 13:06:00 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2012/01/18 13:06:00 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011/10/19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/08/29 22:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011/08/08 14:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011/05/31 11:11:36 | 000,415,744 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbwwan.sys -- (ewusbmbb)
DRV:64bit: - [2011/05/18 09:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2011/05/03 09:42:40 | 000,222,464 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011/03/22 06:32:58 | 009,319,424 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/03/22 03:27:08 | 000,303,616 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/01/30 12:19:34 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010/07/27 03:52:16 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2010/04/08 01:12:02 | 000,124,944 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010/03/12 19:21:52 | 000,097,280 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ser2pl64.sys -- (Ser2pl)
DRV:64bit: - [2010/03/04 13:26:58 | 000,349,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009/12/15 10:46:38 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2009/12/15 10:46:30 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/03 01:58:24 | 000,507,392 | ---- | M] (ITETech                  ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AF15BDA.sys -- (AF15BDA)
DRV:64bit: - [2009/05/08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2008/01/18 23:10:30 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wimfltr.sys -- (WimFltr)
DRV:64bit: - [2007/06/22 09:51:44 | 000,215,808 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emDevice64.sys -- (DCamUSBEMPIA)
DRV:64bit: - [2007/06/22 09:51:32 | 000,006,400 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emFilter64.sys -- (FiltUSBEMPIA)
DRV:64bit: - [2007/06/22 09:51:30 | 000,006,144 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emScan64.sys -- (ScanUSBEMPIA)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK/4
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {2F90B365-27B1-4275-9D3B-2799B7C481E6}
IE:64bit: - HKLM\..\SearchScopes\{023E0B70-A979-461A-B097-CFEEAFC083B4}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{2F90B365-27B1-4275-9D3B-2799B7C481E6}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{96EFE4B0-1757-4CF6-BE98-222D391DC7B3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK/4
IE - HKLM\..\SearchScopes,DefaultScope = {2F90B365-27B1-4275-9D3B-2799B7C481E6}
IE - HKLM\..\SearchScopes\{023E0B70-A979-461A-B097-CFEEAFC083B4}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKLM\..\SearchScopes\{2F90B365-27B1-4275-9D3B-2799B7C481E6}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{96EFE4B0-1757-4CF6-BE98-222D391DC7B3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.parkettschleicher.de/
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes,DefaultScope = {CCA7FF10-817F-4CC0-AE35-344E24DE72E6}
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{023E0B70-A979-461A-B097-CFEEAFC083B4}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{2F90B365-27B1-4275-9D3B-2799B7C481E6}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{96EFE4B0-1757-4CF6-BE98-222D391DC7B3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{CCA7FF10-817F-4CC0-AE35-344E24DE72E6}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Programme_3\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Programme_3\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2011/10/11 15:43:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/30 14:15:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/30 14:15:07 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011/08/26 16:07:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephan\AppData\Roaming\mozilla\Extensions
[2011/02/04 14:14:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephan\AppData\Roaming\mozilla\Extensions\{ee53ece0-255c-4cc6-8a7e-81a8b6e5ba2c}
[2012/04/09 17:29:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephan\AppData\Roaming\mozilla\Firefox\Profiles\yd8ecxu8.default\extensions
[2011/11/07 22:00:31 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Stephan\AppData\Roaming\mozilla\Firefox\Profiles\yd8ecxu8.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/04/09 17:29:07 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Stephan\AppData\Roaming\mozilla\Firefox\Profiles\yd8ecxu8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/11/07 21:01:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/08/30 14:15:07 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/11 10:08:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/08/30 14:15:06 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/11 10:08:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/03/11 10:08:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/03/11 10:08:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/03/11 10:08:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Do Not Track Plus) - {6E45F3E8-2683-4824-A6BE-08108022FB36} - C:\Program Files (x86)\DoNotTrackPlus\IE\DNTPAddon.dll (Abine)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme_3\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [eXPertPDF OLR] C:\PROGRA~2\BVRPSO~1\EXPERT~1\BVRPOlr.exe /eXPertPDF File not found
O4 - HKLM..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume File not found
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UVS11 Preload] C:\Programme_3\Ulead VideoStudio 11 SE DVD\uvPL.exe (InterVideo Digital Technology Corporation)
O4 - HKLM..\Run: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Player\hqtray.exe" File not found
O4 - HKLM..\Run: [vspdfprsrv.exe] C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfprsrv.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [EPSON BX305 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\Windows\TEMP\E_S9636.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [EPSON BX305 Series (Kopie 1)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\Windows\TEMP\E_S8E7A.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Google)
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] C:\Programme_3\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Stephan\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Stephan\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Do Not Track Plus (c) Abine - {6E45F3E8-2683-4824-A6BE-08108022FB36} - C:\Program Files (x86)\DoNotTrackPlus\IE\DNTPAddon.dll (Abine)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0CE0C407-89DD-4652-B1A5-AF523B859E17}: NameServer = 10.111.81.129 10.129.32.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3A6F60AB-53E3-4919-B908-9F0F1C60D98A}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57D3B3ED-876C-491D-907B-817BAF551868}: NameServer = 10.74.210.210 10.74.210.211
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{1d9a63b3-cc18-11e1-a002-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{1d9a63b3-cc18-11e1-a002-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{780c77a9-af9b-11e1-814e-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{780c77a9-af9b-11e1-814e-005056c00008}\Shell\AutoRun\command - "" = K:\Data\setup.exe
O33 - MountPoints2\{ca6f4753-fde6-11df-8f66-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ca6f4753-fde6-11df-8f66-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.bat
O33 - MountPoints2\{cbe1a509-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a509-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{cbe1a523-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a523-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{cbe1a54d-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a54d-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{cbe1a56f-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a56f-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/03 12:21:20 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Stephan\Desktop\OTL.exe
[2012/09/03 06:37:04 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Local\{8746F1E1-7423-4374-ACEA-BA8A9547A6AD}
[2012/09/03 06:37:04 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Local\{48F2EEC3-E298-440A-90C4-343609F9A2A0}
[2012/09/01 20:07:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012/08/31 21:58:58 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\Malwarebytes
[2012/08/31 21:58:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/31 21:58:39 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/08/31 21:58:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/08/31 21:58:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/26 14:02:01 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Debugmode
[2012/08/26 14:02:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugmode
[2012/08/26 12:12:12 | 000,000,000 | ---D | C] -- C:\Users\Stephan\.MakeMKV
[2012/08/26 12:12:05 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MakeMKV
[2012/08/26 11:58:54 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\vlc
[2012/08/26 11:58:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/08/26 11:13:38 | 000,000,000 | ---D | C] -- C:\ProgramData\DVD Shrink
[2012/08/26 10:18:41 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\dvdcss
[2012/08/24 08:22:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012/08/16 13:22:48 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/08/16 13:22:15 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012/08/16 13:22:15 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/08/16 13:22:14 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012/08/16 13:22:14 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/08/16 13:22:13 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012/08/16 13:22:13 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/08/16 13:22:13 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012/08/16 13:22:13 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/08/16 13:22:13 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012/08/16 13:22:13 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/08/16 13:22:12 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012/08/16 13:22:12 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/08/16 13:22:11 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012/08/16 13:18:42 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012/08/16 13:12:16 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012/08/16 13:12:16 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012/08/16 13:12:16 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012/08/16 13:12:10 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012/08/16 13:12:10 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012/08/16 13:12:10 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012/08/16 13:11:53 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/09/03 12:22:12 | 001,515,780 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/03 12:22:12 | 000,660,420 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/09/03 12:22:12 | 000,621,696 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/09/03 12:22:12 | 000,132,318 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/09/03 12:22:12 | 000,108,542 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/09/02 21:54:13 | 000,511,265 | ---- | M] () -- C:\Users\Stephan\Desktop\adwcleaner.exe
[2012/09/02 11:52:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/02 11:52:21 | 536,322,047 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/02 11:50:11 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/02 11:28:04 | 001,535,254 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/09/01 19:14:21 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/01 15:54:39 | 000,020,720 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/01 15:54:39 | 000,020,720 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/01 15:11:44 | 000,000,000 | ---- | M] () -- C:\Users\Stephan\defogger_reenable
[2012/09/01 07:07:02 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Stephan\Desktop\OTL.exe
[2012/09/01 07:06:16 | 000,050,477 | ---- | M] () -- C:\Users\Stephan\Desktop\Defogger.exe
[2012/08/31 22:11:30 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad
[2012/08/31 21:58:40 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/08/30 17:11:17 | 000,000,844 | ---- | M] () -- C:\Users\Stephan\.recently-used.xbel
[2012/08/28 18:46:42 | 000,054,173 | ---- | M] () -- C:\Users\Stephan\Documents\test1.PNG
[2012/08/26 14:11:17 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/08/26 14:11:17 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/08/26 14:10:41 | 000,170,690 | ---- | M] () -- C:\Users\Stephan\Documents\test.swf
[2012/08/26 14:10:41 | 000,000,712 | ---- | M] () -- C:\Users\Stephan\Documents\test.htm
[2012/08/26 14:10:41 | 000,000,118 | ---- | M] () -- C:\Users\Stephan\Documents\test.js
[2012/08/26 14:06:35 | 001,616,368 | ---- | M] () -- C:\Users\Stephan\Documents\test.wnk
[2012/08/26 11:58:49 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/08/23 15:43:36 | 000,419,345 | ---- | M] () -- C:\Users\Stephan\Documents\rg_pearl-LED.jpg
[2012/08/23 15:16:11 | 001,103,599 | ---- | M] () -- C:\Users\Stephan\Documents\PE5973_11_70365[1].pdf
[2012/08/21 10:46:49 | 000,641,144 | ---- | M] () -- C:\Users\Stephan\Documents\Teich_10.PNG
[2012/08/16 17:45:17 | 000,553,072 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/08/16 15:09:18 | 005,598,742 | ---- | M] () -- C:\Users\Stephan\Documents\Bedienungsanleitung_Cafissimo.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/09/02 21:54:43 | 000,511,265 | ---- | C] () -- C:\Users\Stephan\Desktop\adwcleaner.exe
[2012/09/01 15:11:44 | 000,000,000 | ---- | C] () -- C:\Users\Stephan\defogger_reenable
[2012/09/01 15:10:59 | 000,050,477 | ---- | C] () -- C:\Users\Stephan\Desktop\Defogger.exe
[2012/08/31 22:05:41 | 000,002,005 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
[2012/08/31 21:58:40 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/08/31 16:15:44 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad
[2012/08/30 17:11:17 | 000,000,844 | ---- | C] () -- C:\Users\Stephan\.recently-used.xbel
[2012/08/28 18:46:42 | 000,054,173 | ---- | C] () -- C:\Users\Stephan\Documents\test1.PNG
[2012/08/26 14:09:00 | 000,170,690 | ---- | C] () -- C:\Users\Stephan\Documents\test.swf
[2012/08/26 14:09:00 | 000,000,712 | ---- | C] () -- C:\Users\Stephan\Documents\test.htm
[2012/08/26 14:09:00 | 000,000,118 | ---- | C] () -- C:\Users\Stephan\Documents\test.js
[2012/08/26 14:06:35 | 001,616,368 | ---- | C] () -- C:\Users\Stephan\Documents\test.wnk
[2012/08/26 11:58:49 | 000,001,035 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/08/23 15:43:00 | 000,419,345 | ---- | C] () -- C:\Users\Stephan\Documents\rg_pearl-LED.jpg
[2012/08/23 15:35:44 | 001,103,599 | ---- | C] () -- C:\Users\Stephan\Documents\PE5973_11_70365[1].pdf
[2012/08/21 10:46:48 | 000,641,144 | ---- | C] () -- C:\Users\Stephan\Documents\Teich_10.PNG
[2012/08/16 15:16:10 | 005,598,742 | ---- | C] () -- C:\Users\Stephan\Documents\Bedienungsanleitung_Cafissimo.pdf
[2012/07/17 19:46:38 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012/04/27 13:39:20 | 000,000,000 | ---- | C] () -- C:\Users\Stephan\.gtk-bookmarks
[2012/02/22 10:36:17 | 000,000,542 | ---- | C] () -- C:\Windows\wiso.ini
[2011/12/28 17:49:13 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2011/12/28 17:49:13 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2011/11/11 17:43:23 | 000,000,087 | ---- | C] () -- C:\Users\Stephan\.iccbutton_history
[2011/11/03 12:58:10 | 000,007,680 | ---- | C] () -- C:\Users\Stephan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/21 07:34:32 | 000,001,854 | ---- | C] () -- C:\Users\Stephan\AppData\Roaming\GhostObjGAFix.xml
[2011/04/29 21:45:13 | 000,003,949 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/03/21 21:03:24 | 000,172,032 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2011/02/28 22:56:53 | 000,321,536 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2011/02/24 18:13:38 | 000,210,456 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll
[2011/02/24 18:13:38 | 000,206,360 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll
[2011/02/24 18:13:38 | 000,198,168 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll
[2011/02/24 18:13:38 | 000,198,168 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll
[2011/02/24 18:13:38 | 000,194,072 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll
[2011/02/24 18:13:38 | 000,026,136 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll
[2011/02/21 14:10:43 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011/02/14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Pianos and Keyboards
[2011/02/14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Piano Med
[2011/02/14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\Users\Stephan\AppData\Roaming\Phaser
[2011/02/14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\Users\Stephan\AppData\Roaming\Perl
[2011/02/14 12:06:13 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2011/02/14 12:06:13 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2011/02/14 12:06:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Piano Hard
[2011/02/14 12:06:12 | 000,000,268 | RH-- | C] () -- C:\Users\Stephan\AppData\Roaming\Percussion Kit
[2011/02/14 12:06:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2011/02/14 11:12:27 | 000,012,923 | ---- | C] () -- C:\Users\Stephan\AppData\Roaming\Microsoft Excel.CAL
[2011/02/14 11:11:37 | 000,038,936 | ---- | C] () -- C:\Users\Stephan\AppData\Roaming\Microsoft Excel.ADR
[2011/02/14 09:57:58 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011/02/07 11:31:13 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2011/02/07 11:29:35 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011/02/07 10:59:53 | 000,014,336 | ---- | C] () -- C:\Windows\SysWow64\vsmon1.dll
[2011/02/05 21:46:51 | 000,000,126 | ---- | C] () -- C:\Windows\SysWow64\AF15IRTBL.bin
[2011/02/04 14:14:39 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/02/01 18:54:45 | 001,535,254 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/01/31 10:46:24 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/12/02 06:31:12 | 000,009,988 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2010/12/02 05:59:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:5F64C164

< End of report >

--- --- ---

... und hier noch die EXTRA log-Datei:
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 9/3/2012 12:39:49 PM - Run 3
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Stephan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6.00 Gb Total Physical Memory | 4.97 Gb Available Physical Memory | 82.84% Memory free
12.00 Gb Paging File | 11.13 Gb Available in Paging File | 92.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 527.19 Gb Total Space | 430.40 Gb Free Space | 81.64% Space Free | Partition Type: NTFS
Drive D: | 13.60 Gb Total Space | 1.67 Gb Free Space | 12.31% Space Free | Partition Type: NTFS
Drive G: | 150.26 Gb Total Space | 143.87 Gb Free Space | 95.75% Space Free | Partition Type: NTFS
Drive H: | 292.97 Gb Total Space | 247.10 Gb Free Space | 84.34% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 95.95 Gb Free Space | 39.30% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 130.87 Gb Free Space | 53.60% Space Free | Partition Type: NTFS
Drive K: | 1.86 Gb Total Space | 1.15 Gb Free Space | 62.03% Space Free | Partition Type: FAT
Drive L: | 390.62 Gb Total Space | 310.45 Gb Free Space | 79.48% Space Free | Partition Type: NTFS
 
Computer Name: STEPHAN-HP | User Name: Stephan | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04B1A3E8-BA06-400F-A5B6-E1A9D20E8ADA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{08379F03-DC4C-4AD9-8045-004A01D48D4F}" = lport=139 | protocol=6 | dir=in | app=system | 
"{0C47876B-2570-4857-9151-03AA8CFBFE6C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{0D801624-BC08-4E7E-A036-1FD73ADB60C1}" = lport=2869 | protocol=6 | dir=in | name=microsoft upnp-port (tcp) | 
"{14C6029F-4E95-4BF4-84BD-F2BEC0C28F02}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{20BFDFB4-4DBB-4635-9274-BEC2476E1315}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{2BF46AB0-8D14-48DF-BA3F-EFC8E122647B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{3083A5F5-CA65-4D9D-8D56-2DD85DE093FB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{3579B65D-0851-4792-A773-5E599CAB1BE4}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{3DBE9F38-1903-4F5F-B570-243EF50BD33D}" = lport=445 | protocol=6 | dir=in | app=system | 
"{3E842BD0-8F52-48F9-A865-B07F4D07A3DC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{447317DD-16C0-4250-AE9E-5738D45B147B}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{45D32B80-6D40-4F06-AF45-0376F1DF7313}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{50EE813F-69BA-4247-8CB4-80871886561E}" = lport=1900 | protocol=17 | dir=in | name=microsoft upnp-port (udp) | 
"{51143185-9E5D-4E6C-A385-C20BCF843DA8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{6DB52705-0E46-451B-9DD3-B5BD5A71BD0F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{7874B478-757D-4B40-94E7-F5EF95C74BC8}" = lport=0 | protocol=6 | dir=in | name=magix upnp media server | 
"{78B1E1DE-0695-4A3C-BB4E-05A52D3EF64B}" = rport=138 | protocol=17 | dir=out | app=system | 
"{78CEE68C-DB31-420A-84A6-56D743087AAD}" = lport=137 | protocol=17 | dir=in | app=system | 
"{7AC01CB2-9B03-492D-BAE9-EC982A6E9839}" = lport=1900 | protocol=17 | dir=in | name=microsoft upnp-port (udp) | 
"{7D149933-B03C-4C14-A194-8A1E06EB331D}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
"{819FEA96-65EB-4CDB-8FE6-7F16726D2B94}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{999B01EF-6D80-4DF0-A9A1-2A3F8858C237}" = lport=2869 | protocol=6 | dir=in | name=microsoft upnp-port (tcp) | 
"{B730E473-46E2-4A6C-B1C9-A0C0B983C770}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{C3C0BB9C-50B5-4680-809C-7FF07B32DF65}" = lport=2869 | protocol=6 | dir=in | name=microsoft upnp-port (tcp) | 
"{CAA5D942-E0A9-4167-8D02-C0A2EB038C68}" = lport=1900 | protocol=17 | dir=in | name=microsoft upnp-port (udp) | 
"{D8C73520-2F1E-463C-881A-19FE829EF9C9}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{DDA35FF3-6E1E-467F-AA80-A22A1C1E3730}" = lport=0 | protocol=6 | dir=in | name=magix upnp media server | 
"{DE749E75-6475-422C-812A-44368D46C1CB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E112E5E7-F8A5-4ECE-B4AA-2EF90B08F260}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E9838B30-AA3D-4261-9A6A-796CE8416ED4}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{EBFC0749-D320-419B-BDE1-D5BB6AAF57C3}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{ED9EDB3A-22C7-4B43-9EE6-484772EF57BA}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{F305C93E-A60C-47D3-BC0F-CE2A75AC6C86}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{049B511D-BB4A-4167-A277-1A081DD82F3D}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{086F5F08-E1A5-4A34-9A76-2FFCD1576D31}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{0CD11A11-D8B1-4C23-9C1B-668DA3DF5649}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{0CDAE2FA-6E73-4E0B-A7C5-4A15603A9B67}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{118973E8-F60B-4376-BFFC-0B666AEF43D8}" = protocol=6 | dir=in | app=c:\users\stephan\appdata\local\microsoft\skydrive\skydrive.exe | 
"{1507DAA9-D26C-46B7-B7E2-97DC9B09DD50}" = protocol=6 | dir=in | app=c:\programme_3\opera_11\opera.exe | 
"{15CC1C54-A876-47D3-AEDF-E95D6CA86BE1}" = protocol=17 | dir=in | app=c:\programme_3\opera_11\opera.exe | 
"{16FC603A-BDAB-482A-96F9-BDD9ADEEACDA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2286F46A-73C5-4FB2-A6EF-47D07CB66866}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{236EA955-4F7C-4203-8AA3-4B6F807785B8}" = protocol=6 | dir=in | app=c:\programme_2\miro\miro_downloader.exe | 
"{2A2E898B-6B90-417F-B5BA-F3FD3939AB6C}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{2AFAC882-C1C7-448A-9661-CF9C663C82CA}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{2BEA7193-CEEC-48B1-A2D4-0EFA5291F09E}" = protocol=6 | dir=in | app=i:\makemkv\makemkvcon64.exe | 
"{2D08AF4D-47F0-4CCB-B0EB-D781D0FDD131}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{37840155-F935-4B88-B4A6-92968BA228F8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{399FE00A-D07C-4575-80D0-CBCE27F6266F}" = protocol=6 | dir=in | app=c:\programme_2\swr_radio_recorder\client\rfx-client.exe | 
"{3AABAF17-B3CB-4BD1-90EA-6B6F552397FA}" = protocol=6 | dir=in | app=c:\program files (x86)\easybits for kids\programs\my first browser\myfirstbrowser.exe | 
"{41248759-FA44-4D9D-A62F-C5DEC8E6BFBF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{41C53F8E-37D8-46DF-A994-E1DC605062BD}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{45BF0B01-1506-4ED3-AB9B-3EBB69144E5D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{46E4D52B-571F-4803-9B08-61E9CF0FD9E0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{48D157D2-18B5-4010-9E4A-7056310E6CB4}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4BD8AC0A-CF50-4B82-8DF8-05AA65D5FD6D}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{4CBB7644-E763-42AA-B2BA-9BC72C1F5E98}" = protocol=17 | dir=in | app=c:\program files (x86)\magix\mp3_maker_15_download-version\mp3maker.exe | 
"{4D2B2C0F-E176-4FE5-BBC8-CEB56579BC2F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{4E34F5C1-039A-4BEC-8704-FA1C48A0E667}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\magix shared\upnpservice\upnpservice.exe | 
"{4F608F9D-F430-49FF-A3ED-465ED151BEA4}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{5738159E-BE52-4906-B6E6-76F9CDD2E4AF}" = dir=in | app=c:\program files (x86)\vmware\vmware player\vmware-authd.exe | 
"{5951E2C5-F90B-4D66-97D6-06DE9AF7731F}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{6DB3E896-52A7-4C3D-B0E7-FED1235318B7}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{6F3DF0F7-8E8C-4BF3-944A-B09311B52A9A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{757E97E5-75D6-4F5A-8CCC-6171B7BEAF61}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7BA6AF27-918D-41F4-9878-60C209F997B8}" = dir=in | app=c:\program files (x86)\vmware\vmware player\vmware-authd.exe | 
"{7C12E7E2-3DE0-4717-AAD1-35898FE6E882}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\magix shared\upnpservice\upnpservice.exe | 
"{88D7F468-DCE4-4252-AE10-F3C94B9BCB1F}" = protocol=17 | dir=in | app=c:\program files (x86)\easybits for kids\programs\my first browser\myfirstbrowser.exe | 
"{8BB78E17-5D3B-4893-A5AC-67CFDC0FC750}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\magix shared\upnpservice\upnpservice.exe | 
"{8D1B7587-15B5-40F7-AD91-3F3E678D607E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{903F8DEC-D16E-4001-959F-ACC2A074D089}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\magix shared\upnpservice\upnpservice.exe | 
"{90AA9B7F-3C14-4A0F-82FB-88E648CA7FA8}" = protocol=17 | dir=in | app=c:\programme_2\swr_radio_recorder\server\rfx-server.exe | 
"{941C22A7-4B7C-4639-B668-8927F3B688DD}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{9B42EA88-E25F-4D29-9EBF-5AA39051503D}" = protocol=17 | dir=in | app=c:\programme_2\swr_radio_recorder\client\rfx-client.exe | 
"{9FB7EA73-F74E-4DB7-B2B2-9E0C962A2149}" = protocol=6 | dir=in | app=c:\programme_2\swr_radio_recorder\server\rfx-server.exe | 
"{A07BB865-DBF7-40D1-87C7-B14CD549D55B}" = protocol=17 | dir=in | app=i:\makemkv\makemkvcon64.exe | 
"{A3E12614-FE1A-4696-A612-5EECB0E6CC54}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{AD0FC6F6-8F84-46EA-9545-124C3392B1D9}" = protocol=6 | dir=in | app=c:\programme_3\opera_11\pluginwrapper\opera_plugin_wrapper.exe | 
"{B47D00CB-D747-46B2-9EED-25657DD3B3DE}" = protocol=17 | dir=in | app=c:\users\stephan\appdata\local\microsoft\skydrive\skydrive.exe | 
"{B4DE8F3D-4C52-421D-B282-0F9E4185BE3B}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{BFF6B4EB-0BB3-4615-99E0-3770466692A8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C478A5DB-44DF-45FD-B111-B07F36EE6A63}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr8.exe | 
"{C757CA38-4C96-4630-BA1E-BBA2DB64877D}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{C90F010E-219A-4E55-9794-25722B2B555E}" = protocol=17 | dir=in | app=c:\programme_3\opera_11\pluginwrapper\opera_plugin_wrapper.exe | 
"{CC239387-9C01-44EA-AD7C-A03CC45A2C9C}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{CFCE75BF-2192-4CB9-AE28-24603AFA47CE}" = protocol=6 | dir=in | app=c:\program files (x86)\magix\mp3_maker_15_download-version\mp3maker.exe | 
"{D5C52F86-3A83-4398-88ED-2D7286D28128}" = protocol=17 | dir=in | app=c:\programme_2\miro\miro_downloader.exe | 
"{D6476140-3F9A-427A-BCC5-41C1827FFC3A}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{E354A2BD-B838-43C5-9D56-C58F28DC8A56}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{E499AF38-EBCE-49BF-8851-512A88998A84}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E729FDC1-F22A-4AAE-906D-59C24F3732C5}" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"{EA5E2879-B8FB-4225-81B3-8E6A05642C41}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{F3B5311E-99D0-43D2-A99A-148DFD541AF6}" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"{F8CBD7D8-AE7C-443F-A1EF-791EAE8A610E}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"TCP Query User{68225EA8-9879-4A9D-9323-10AF2300F84F}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"TCP Query User{6B2FCB56-C7CB-48EC-B13C-2EAF564B9DC2}C:\programme_2\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\programme_2\miro\miro_downloader.exe | 
"TCP Query User{71121404-F0F6-4F3B-8950-863FCF86769C}I:\makemkv\makemkvcon64.exe" = protocol=6 | dir=in | app=i:\makemkv\makemkvcon64.exe | 
"TCP Query User{CBFE69CF-F799-4979-A0FA-7DABBABA7594}C:\program files (x86)\magix\mp3_maker_15_download-version\mp3maker.exe" = protocol=6 | dir=in | app=c:\program files (x86)\magix\mp3_maker_15_download-version\mp3maker.exe | 
"UDP Query User{4A2CB7C1-24AB-4B0D-ADA1-E00FFBB430DC}C:\programme_2\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\programme_2\miro\miro_downloader.exe | 
"UDP Query User{4DAF5696-1D69-47AC-B7A2-F7D62CB72899}C:\program files (x86)\magix\mp3_maker_15_download-version\mp3maker.exe" = protocol=17 | dir=in | app=c:\program files (x86)\magix\mp3_maker_15_download-version\mp3maker.exe | 
"UDP Query User{B86022B1-6263-427E-8CE8-95CF11133F3F}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"UDP Query User{BD3D17DA-B1A5-4A22-9F0B-E6640F5C0BD5}I:\makemkv\makemkvcon64.exe" = protocol=17 | dir=in | app=i:\makemkv\makemkvcon64.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{2D5D9603-22CF-4B99-83F6-0CD20330F62E}" = FRITZ!DSL64
"{422DAAC6-8E99-ED2E-CD46-0DEEE1A09EF8}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4FF5C7C9-86CC-41ED-B93B-0B51AB4FED24}" = VmciSockets
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{7020FC34-6E04-4858-924D-354B28CB2402}_is1" = Luminance HDR 2.1.0
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AC3CFAD-B8C0-668C-8761-920A63B1B574}" = ccc-utility64
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B374E6A8-501F-4BC0-BA59-4EE78F06B3B2}" = Oracle VM VirtualBox 4.1.10
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D285FC5F-3021-32E9-9C59-24CA325BDC5C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)
"CCleaner" = CCleaner
"EPSON BX305 Series" = EPSON BX305 Series Printer Uninstall
"GPL Ghostscript 9.01" = GPL Ghostscript 9.01
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"PhotomatixPro41x64_is1" = Photomatix Pro version 4.1.4
"SNS-HDR Lite_is1" = SNS-HDR Lite v1.4.7
"SNS-HDR Pro_is1" = SNS-HDR Pro v1.4.7
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0935B1FB-71D5-D1F7-9045-F44394E3FBDA}" = CCC Help Czech
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}" = Epson FAX Utility
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{13F0CFEB-1131-4DC1-5DEF-7E0F91858D99}" = CCC Help Finnish
"{15B2BC56-D179-4450-84B9-7A8D7F4CE1B9}" = Lexware Info Service
"{18166604-72E6-F535-B9E9-4D8EF2C599C8}" = CCC Help Polish
"{1873789F-59D5-4002-8A2F-60A827B78F98}_is1" = GmapTool 0.6.0a
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19A4B59F-A887-9A3B-C4CD-871A333AE838}" = CCC Help Thai
"{1C8E0A7E-2707-8E5F-BFCD-AE3CD1EB528E}" = Catalyst Control Center Graphics Previews Vista
"{1D04B4D4-80C2-4F02-B5BE-3A5991FF6077}" = MetaEditor
"{1D33BCF7-B5B6-4148-B888-9CC2EC208556}" = Konz 2012
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{23D18B1A-8B73-73AB-DE37-929A14A524F8}" = CCC Help Russian
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 25
"{27F10580-E040-11DF-8C28-005056B12123}" = Haufe iDesk-Service
"{289FF83C-14F2-F82F-C478-9342170C5029}" = CCC Help Chinese Traditional
"{2E238AA5-5B07-DEBF-4B9B-50FD33D108A2}" = CCC Help Japanese
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39F58DDB-B2B8-4B86-AF20-4706A80EB30D}" = Epson Easy Photo Print 2
"{3B341D0B-E84E-EFF7-9665-553E0315DC8E}" = CCC Help Turkish
"{3BEFC315-7F74-4F71-B704-2CAF4DC046BB}" = Steuer-Hilfesammlung 2010
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}" = LightScribe System Software
"{4785CED6-73B3-45FA-AFE6-EDEDFDE67842}" = Steuer 2011
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4B526075-AF27-47A2-860D-3DA92928A051}" = Steuer 2010
"{4C0001B8-244E-42C1-819B-B972895EF03F}" = WinCachebox
"{4F09C764-E4DB-4DED-8489-55119833FAF7}_is1" = PDF Expert 6 - Installer
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}" = InterVideo DeviceService
"{5313CFF7-E762-4752-BEC0-1E2CB2C685E4}" = uMedia uTV
"{54882CC4-DA1C-445C-91F0-6536ED10923C}" = MAGIX Music Maker 16
"{59E5D73C-E574-1C9A-CB26-0AA0D7298C31}" = Catalyst Control Center Graphics Previews Common
"{5BF5331F-E271-4A1F-AF5D-30A93EFF2584}_is1" = Franzis onlineTV 6
"{5D729989-59A9-591A-6419-08444EEAEDB3}" = CCC Help Portuguese
"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B249FAC-DD1A-405F-A8A2-AA6A2252ED32}" = Eisenbahn.exe Professional 6.0
"{6C5F8503-55D2-4398-858C-362B7A7AF51C}" = Firebird SQL Server - MAGIX Edition
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7D29228E-ECCC-055E-F0DF-3D52831D90D8}" = CCC Help Spanish
"{7F421DF0-AFD5-CA29-0F36-7E1F006150FA}" = CCC Help Hungarian
"{822C792C-371F-0990-14EE-C1583E4CE2E0}" = ccc-core-static
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8614FEE9-1E19-9A56-E445-E9F14178B7F2}" = CCC Help Greek
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8B026F59-3DB2-97C6-538D-0326B8855080}" = CCC Help Korean
"{8B41F2D9-B924-F249-CDFA-6792B4F58A34}" = CCC Help French
"{8BFB1992-45FC-BAAB-6AE3-69306202B584}" = CCC Help Swedish
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8CB19DF9-B209-E0B4-D541-AB171E65135E}" = Catalyst Control Center InstallProxy
"{8DC9EAD2-B869-A5C6-AEDB-35700F1444F4}" = CCC Help Chinese Standard
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-007D-0409-0000-0000000FF1CE}" = Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
"{954A99E7-D1BB-936A-FAEA-7E5A999D1506}" = CCC Help Italian
"{97922AE1-B850-4B21-85EF-FD1E7ED20D65}" = MAGIX Speed 2 (MSI)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A46A8135-FBAC-4508-BFC6-3FBB0625289B}" = HOME-Nostruktor 5.0
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8D6EA97-E688-417B-0A39-3E77AE60AA43}" = Catalyst Control Center Localization All
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{ABC887FA-1BAC-411B-9F0F-21BA16702F15}" = VideoStudio
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}" = Garmin MapSource
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{BBEBB14F-FFE7-4F00-9941-F1FBA94449AD}" = FDRTools Basic 2.5.1
"{BC702A05-A75D-F845-FC9D-ED37A04F78B8}" = CCC Help German
"{BED677E3-F67A-15E5-45F3-76D61D245EDF}" = CCC Help English
"{C07FEFB3-D039-182C-8D27-AF2852C70015}" = HydraVision
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C50ADEEF-AAAC-76BF-D9A0-E7BED8D855A8}" = CCC Help Danish
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C730B021-96D7-4F63-B52E-27F9A8155BE1}" = MAGIX Screenshare
"{C7411D97-EF5E-46B2-8B49-E408A344DF82}" = MAGIX Speed burnR (MSI)
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{CE1B03BC-3C99-4580-A2AC-A41DB9B83378}" = EasyWeather
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D102611A-6466-4101-A51D-51069303AC65}" = tools-linux
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D9390EF1-CBB2-4B06-A24C-73C03C8D2E2C}" = Catalyst Control Center - Branding
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF6AD522-CD48-47CD-89FA-DF69473635EB}_is1" = Vistawinexit Version 6
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E452E727-86B8-4233-8CC3-41FD817AFAFF}" = VMware Player
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E64A3228-2FDC-8A9D-F69F-E7AED8938C7D}" = CCC Help Dutch
"{E77A53A2-4623-4635-AE7F-702152168EE5}" = Google Drive
"{E95D2E2E-992A-4B3B-895A-C651EBCAC458}" = Tuning Tool
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}" = QuickTime
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
"{FC279721-37A6-4777-AFD8-7A56681EBA14}" = eXPert PDF 6
"{FD9C31B6-F572-414D-81E3-89368C97A125}_is1" = CamStudio OSS Desktop Recorder
"{FEA6954A-0B3E-C230-FBD2-B7A2926C0013}" = CCC Help Norwegian
"812A5AC8-50DA-43D8-B36E-30CDD7FCCAA1_is1" = Outlook Backup Assistant 5 (Testversion)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amaya" = Amaya
"Arbeitszeugnis-Generator_is1" = Deinstallation Arbeitszeugnis-Generator
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced 9.25
"Avira AntiVir Desktop" = Avira Free Antivirus
"DMX5_is1" = DriverMax 5
"Do Not Track Plus Add-on_is1" = Do Not Track Plus Add-on 2.2.0.514
"Dynamic-Photo HDR 5_is1" = Dynamic-Photo HDR 5
"EasyBits Magic Desktop" = Magic Desktop
"EasyGPS_is1" = EasyGPS 4.18
"EPSON BX305 Series Manual" = EPSON BX305 Series Handbuch
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"FileZilla Client" = FileZilla Client 3.5.3
"FormatFactory" = FormatFactory 2.70
"Forte 3000" = Forte 3000 
"Foxit Reader" = Foxit Reader
"Free Video Dub_is1" = Free Video Dub version 1.8.12.602
"Free YouTube Download_is1" = Free YouTube Download version 3.1.29.608
"FreeCommander_is1" = FreeCommander 2009.02b
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.0.2
"Google Calendar Sync" = Google Calendar Sync
"GSAK_is1" = GSAK 8.1.1.89 (patch)
"HUAWEI DataCard Driver" = HUAWEI DataCard Driver 4.22.19.00
"InstallShield_{1D33BCF7-B5B6-4148-B888-9CC2EC208556}" = Konz 2012
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{ABC887FA-1BAC-411B-9F0F-21BA16702F15}" = Ulead VideoStudio 11 SE DVD
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"IrfanView" = IrfanView (remove only)
"MAGIX MP3 Maker 15 Download-Version D" = MAGIX MP3 Maker 15 Download-Version 10.0.0.279 (D)
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX_{C730B021-96D7-4F63-B52E-27F9A8155BE1}" = MAGIX Screenshare
"MAGIX_{C7411D97-EF5E-46B2-8B49-E408A344DF82}" = MAGIX Speed burnR (MSI)
"MakeMKV" = MakeMKV v1.7.7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Miro" = Miro
"Mixxx (1.9.0)" = Mixxx 1.9.0
"mm16" = MAGIX Music Maker 16
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"o2DE" = Mobile Connection Manager
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"OpenAL" = OpenAL
"Opera 12.00.1467" = Opera 12.00
"Scribus 1.4.0" = Scribus 1.4.0rc1
"Songr" = Songr
"SystemRequirementsLab" = System Requirements Lab
"TECUNIONLINE" = TECUNIONLINE
"T-Mobile Internet Manager" = T-Mobile Internet Manager
"Tobit Radio.fx Server 4" = SWR RadioRecorder
"TrueCrypt" = TrueCrypt
"Uninstall_is1" = Uninstall 1.0.0.1
"Unknown Horizons" = Unknown Horizons
"VLC media player" = VLC media player 2.0.2
"VMware_Player" = VMware Player
"Vocup_is1" = Vocup 1.4.3
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"Wireshark" = Wireshark 1.4.6
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"RouteConverter" = RouteConverter
"SkyDriveSetup.exe" = Microsoft SkyDrive
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 9/3/2012 12:38:11 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:16 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:21 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:26 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:31 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:36 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:41 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:46 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:51 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
Error - 9/3/2012 12:38:56 AM | Computer Name = Stephan-HP | Source = SignInAssistant | ID = 0
Description = 
 
[ Hewlett-Packard Events ]
Error - 3/1/2011 7:47:43 AM | Computer Name = Stephan-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\031101124740.xml
 File not created by asset agent
 
Error - 6/21/2011 1:34:26 AM | Computer Name = Stephan-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\061121073418.xml
 File not created by asset agent
 
Error - 6/21/2011 6:27:13 AM | Computer Name = Stephan-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\061121122711.xml
 File not created by asset agent
 
[ Media Center Events ]
Error - 3/8/2011 2:57:52 PM | Computer Name = Stephan-HP | Source = MCUpdate | ID = 0
Description = 19:57:51 - Fehler beim Herstellen der Internetverbindung.  19:57:51 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 3/8/2011 2:58:26 PM | Computer Name = Stephan-HP | Source = MCUpdate | ID = 0
Description = 19:58:21 - Fehler beim Herstellen der Internetverbindung.  19:58:21 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 3/8/2011 3:59:19 PM | Computer Name = Stephan-HP | Source = MCUpdate | ID = 0
Description = 20:59:19 - Fehler beim Herstellen der Internetverbindung.  20:59:19 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 3/8/2011 3:59:49 PM | Computer Name = Stephan-HP | Source = MCUpdate | ID = 0
Description = 20:59:48 - Fehler beim Herstellen der Internetverbindung.  20:59:48 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ System Events ]
Error - 9/3/2012 6:35:09 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:35:11 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:35:11 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:35:11 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:39:23 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:39:23 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:39:23 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:40:09 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:40:09 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 9/3/2012 6:40:09 AM | Computer Name = Stephan-HP | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >

--- --- ---

cosinus · 03.09.2012, 19:44

Bitte mach doch erstmal nur das was ich poste! Es macht doch keinen Sinn urgendwas zu posten, was ich nicht oder noch nicht sehen will bzw. noch nicht brauche!

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

d-aus-h · 03.09.2012, 20:24

Sorry, gut gemeint ist nicht gut gemacht...

Hier der log von adwcleaner (s1):

Code:

ATTFilter

# AdwCleaner v2.000 - Datei am 09/03/2012 um 21:19:08 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzer : Stephan - STEPHAN-HP
# Normaler Modus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Stephan\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0 (de)

Profilname : default 
Datei : C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\yd8ecxu8.default\prefs.js

C:\Users\Stephan\AppData\Roaming\Mozilla\Firefox\Profiles\yd8ecxu8.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1501 octets] - [02/09/2012 21:55:07]
AdwCleaner[S1].txt - [2034 octets] - [03/09/2012 21:19:08]

########## EOF - C:\AdwCleaner[S1].txt - [2094 octets] ##########

cosinus · 03.09.2012, 21:04

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

d-aus-h · 03.09.2012, 21:39

zu 1.) bin jetzt im normalen Modus hochgefahren, in den letzten 5 Minuten läuft alles rund - dieser Post wird auch von betroffenen PC aus gemacht.
zu 2.) ein Eintrag ist leer (HP advisor - Softwarepaket vom PC-Hersteller) - bin mir aber nicht sicher, ob der nicht schon vorher leer war; ansonsten fällt mir nicht auf, dass was fehlt.

Nachtrag zu 1.) PC läuft jetzt schon über eine halbe Stunde ohne dass ich iwas merke...

cosinus · 04.09.2012, 09:34

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

d-aus-h · 04.09.2012, 10:44

Log von OTL:

Code:

ATTFilter

OTL logfile created on: 04.09.2012 11:28:11 - Run 5
OTL by OldTimer - Version 3.2.60.0     Folder = C:\Users\Stephan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6,00 Gb Total Physical Memory | 4,92 Gb Available Physical Memory | 82,04% Memory free
12,00 Gb Paging File | 10,24 Gb Available in Paging File | 85,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 527,19 Gb Total Space | 430,07 Gb Free Space | 81,58% Space Free | Partition Type: NTFS
Drive D: | 13,60 Gb Total Space | 1,67 Gb Free Space | 12,31% Space Free | Partition Type: NTFS
Drive G: | 150,26 Gb Total Space | 143,87 Gb Free Space | 95,75% Space Free | Partition Type: NTFS
Drive H: | 292,97 Gb Total Space | 247,10 Gb Free Space | 84,34% Space Free | Partition Type: NTFS
Drive I: | 244,14 Gb Total Space | 95,95 Gb Free Space | 39,30% Space Free | Partition Type: NTFS
Drive J: | 244,14 Gb Total Space | 130,87 Gb Free Space | 53,60% Space Free | Partition Type: NTFS
Drive L: | 390,62 Gb Total Space | 310,45 Gb Free Space | 79,48% Space Free | Partition Type: NTFS
 
Computer Name: STEPHAN-HP | User Name: Stephan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.04 11:24:54 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Stephan\Desktop\OTL.exe
PRC - [2012.08.16 22:01:39 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.20 15:17:14 | 012,218,904 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe
PRC - [2012.07.15 17:54:17 | 000,253,952 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Programme_3\T-Mobile Internet Manager\DataCardMonitor.exe
PRC - [2012.05.14 05:44:16 | 000,301,272 | ---- | M] (Abine Inc.) -- C:\Program Files (x86)\DoNotTrackPlus\IE\DNTPService.exe
PRC - [2012.05.08 18:24:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 18:24:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.01.18 16:11:40 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2012.01.18 16:11:32 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2012.01.18 13:27:20 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2012.01.10 20:30:16 | 000,201,344 | ---- | M] (Telefónica) -- C:\Programme_3\Mobile Partner\Mobile Connection Manager\ImpWiFiSvc.exe
PRC - [2011.11.18 15:51:12 | 003,673,944 | ---- | M] () -- c:\Programme_2\SWR_Radio_Recorder\Server\rfx-server.exe
PRC - [2011.05.24 11:33:30 | 001,840,128 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
PRC - [2011.04.08 14:50:02 | 000,542,264 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
PRC - [2010.04.23 22:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) -- C:\Windows\SysWOW64\ezSharedSvcHost.exe
PRC - [2010.04.23 22:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) -- C:\Windows\SysWOW64\ezSharedSvcHost.exe
PRC - [2010.01.06 08:09:22 | 001,237,504 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfprsrv.exe
PRC - [2009.12.31 14:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Stephan\AppData\Roaming\T-Mobile Internet Manager\ouc.exe
PRC - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.09.04 07:42:32 | 001,169,408 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._core_.pyd
MOD - [2012.09.04 07:42:32 | 001,056,256 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._controls_.pyd
MOD - [2012.09.04 07:42:32 | 001,018,368 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\windows._cacheinvalidation.pyd
MOD - [2012.09.04 07:42:32 | 000,807,424 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._windows_.pyd
MOD - [2012.09.04 07:42:32 | 000,792,576 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._gdi_.pyd
MOD - [2012.09.04 07:42:32 | 000,731,136 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._misc_.pyd
MOD - [2012.09.04 07:42:32 | 000,645,120 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\_ssl.pyd
MOD - [2012.09.04 07:42:32 | 000,571,392 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\pysqlite2._sqlite.pyd
MOD - [2012.09.04 07:42:32 | 000,354,304 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\pythoncom26.dll
MOD - [2012.09.04 07:42:32 | 000,311,808 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\_hashlib.pyd
MOD - [2012.09.04 07:42:32 | 000,263,168 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32com.shell.shell.pyd
MOD - [2012.09.04 07:42:32 | 000,153,088 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\pyexpat.pyd
MOD - [2012.09.04 07:42:32 | 000,121,856 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._wizard.pyd
MOD - [2012.09.04 07:42:32 | 000,111,104 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32file.pyd
MOD - [2012.09.04 07:42:32 | 000,110,592 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\pywintypes26.dll
MOD - [2012.09.04 07:42:32 | 000,096,256 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32api.pyd
MOD - [2012.09.04 07:42:32 | 000,086,016 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\_elementtree.pyd
MOD - [2012.09.04 07:42:32 | 000,073,728 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\_ctypes.pyd
MOD - [2012.09.04 07:42:32 | 000,070,656 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\wx._html2.pyd
MOD - [2012.09.04 07:42:32 | 000,040,448 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\_socket.pyd
MOD - [2012.09.04 07:42:32 | 000,039,424 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32inet.pyd
MOD - [2012.09.04 07:42:32 | 000,036,352 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32process.pyd
MOD - [2012.09.04 07:42:32 | 000,022,528 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32pdh.pyd
MOD - [2012.09.04 07:42:32 | 000,011,776 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32crypt.pyd
MOD - [2012.09.04 07:42:31 | 000,585,728 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\unicodedata.pyd
MOD - [2012.09.04 07:42:31 | 000,017,920 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\win32event.pyd
MOD - [2012.09.04 07:42:31 | 000,011,776 | ---- | M] () -- C:\Users\Stephan\AppData\Local\Temp\_MEI28682\select.pyd
MOD - [2010.01.06 08:09:22 | 001,237,504 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfprsrv.exe
MOD - [2009.10.30 14:04:34 | 000,240,640 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\expertpdf4core.bpl
MOD - [2009.10.30 14:04:32 | 000,731,648 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfcvt100.bpl
MOD - [2009.10.30 14:04:28 | 000,435,712 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\visage100.bpl
MOD - [2009.10.30 14:04:28 | 000,076,800 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\VSDesktop100.bpl
MOD - [2009.10.30 14:04:26 | 000,720,384 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\TMSlite100.bpl
MOD - [2009.10.30 14:04:26 | 000,087,552 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vsmisc100.bpl
MOD - [2009.10.30 14:04:24 | 001,856,000 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\te100.bpl
MOD - [2008.10.08 11:11:08 | 000,472,576 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\VirtualTree100.bpl
MOD - [2008.05.21 18:16:16 | 001,926,656 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\PKIECtrl100.bpl
MOD - [2008.04.14 17:38:28 | 000,688,128 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\js32.dll
MOD - [2007.12.28 10:32:44 | 000,142,336 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\uoolep100.bpl
MOD - [2003.08.22 04:23:16 | 000,225,792 | ---- | M] () -- C:\Program Files (x86)\Visagesoft\eXPert PDF 6\sqlite.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.03.22 04:04:16 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010.03.05 03:25:36 | 000,209,000 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV:64bit: - [2010.03.05 03:25:34 | 000,496,232 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV:64bit: - [2009.07.28 16:10:48 | 000,088,888 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.08.30 14:15:07 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.08 18:24:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 18:24:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.01.18 16:11:40 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2012.01.18 16:11:32 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2012.01.18 13:27:20 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2012.01.10 20:30:16 | 000,201,344 | ---- | M] (Telefónica) [Auto | Running] -- C:\Programme_3\Mobile Partner\Mobile Connection Manager\ImpWiFiSvc.exe -- (TGCM_ImportWiFiSvc)
SRV - [2011.11.18 15:51:12 | 003,673,944 | ---- | M] () [Auto | Running] -- c:\Programme_2\SWR_Radio_Recorder\Server\rfx-server.exe -- (Radio.fx)
SRV - [2011.08.29 22:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2011.05.24 11:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2011.04.26 14:54:12 | 002,702,848 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2010.06.25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.10.21 16:50:00 | 000,548,864 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2007.05.31 18:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 18:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.08 18:24:35 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.08 18:24:35 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.05.08 15:09:33 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2012.03.14 18:23:00 | 000,147,248 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.18 16:11:56 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2012.01.18 16:11:08 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2012.01.18 16:10:38 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2012.01.18 13:06:00 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2012.01.18 13:06:00 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.08.29 22:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.08.08 14:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.05.31 11:11:36 | 000,415,744 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbwwan.sys -- (ewusbmbb)
DRV:64bit: - [2011.05.18 09:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2011.05.03 09:42:40 | 000,222,464 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011.03.22 06:32:58 | 009,319,424 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.03.22 03:27:08 | 000,303,616 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.30 12:19:34 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.07.27 03:52:16 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2010.04.08 01:12:02 | 000,124,944 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.03.12 19:21:52 | 000,097,280 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ser2pl64.sys -- (Ser2pl)
DRV:64bit: - [2010.03.04 13:26:58 | 000,349,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009.12.15 10:46:38 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2009.12.15 10:46:30 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 01:58:24 | 000,507,392 | ---- | M] (ITETech                  ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AF15BDA.sys -- (AF15BDA)
DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2008.01.18 23:10:30 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wimfltr.sys -- (WimFltr)
DRV:64bit: - [2007.06.22 09:51:44 | 000,215,808 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emDevice64.sys -- (DCamUSBEMPIA)
DRV:64bit: - [2007.06.22 09:51:32 | 000,006,400 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emFilter64.sys -- (FiltUSBEMPIA)
DRV:64bit: - [2007.06.22 09:51:30 | 000,006,144 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emScan64.sys -- (ScanUSBEMPIA)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK/4
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{023E0B70-A979-461A-B097-CFEEAFC083B4}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{2F90B365-27B1-4275-9D3B-2799B7C481E6}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{96EFE4B0-1757-4CF6-BE98-222D391DC7B3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK/4
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{023E0B70-A979-461A-B097-CFEEAFC083B4}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKLM\..\SearchScopes\{2F90B365-27B1-4275-9D3B-2799B7C481E6}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{96EFE4B0-1757-4CF6-BE98-222D391DC7B3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.parkettschleicher.de/
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes,DefaultScope = {CCA7FF10-817F-4CC0-AE35-344E24DE72E6}
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{023E0B70-A979-461A-B097-CFEEAFC083B4}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{2F90B365-27B1-4275-9D3B-2799B7C481E6}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{96EFE4B0-1757-4CF6-BE98-222D391DC7B3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..\SearchScopes\{CCA7FF10-817F-4CC0-AE35-344E24DE72E6}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-4020697152-834944441-851474326-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Programme_3\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Programme_3\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2011.10.11 15:43:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 14:15:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 14:15:07 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.08.26 16:07:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephan\AppData\Roaming\mozilla\Extensions
[2011.02.04 14:14:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephan\AppData\Roaming\mozilla\Extensions\{ee53ece0-255c-4cc6-8a7e-81a8b6e5ba2c}
[2012.04.09 17:29:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephan\AppData\Roaming\mozilla\Firefox\Profiles\yd8ecxu8.default\extensions
[2011.11.07 22:00:31 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Stephan\AppData\Roaming\mozilla\Firefox\Profiles\yd8ecxu8.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012.04.09 17:29:07 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Stephan\AppData\Roaming\mozilla\Firefox\Profiles\yd8ecxu8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.11.07 21:01:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.08.30 14:15:07 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.11 10:08:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 14:15:06 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.03.11 10:08:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.11 10:08:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.11 10:08:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.11 10:08:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Do Not Track Plus) - {6E45F3E8-2683-4824-A6BE-08108022FB36} - C:\Program Files (x86)\DoNotTrackPlus\IE\DNTPAddon.dll (Abine)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme_3\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [eXPertPDF OLR] C:\PROGRA~2\BVRPSO~1\EXPERT~1\BVRPOlr.exe /eXPertPDF File not found
O4 - HKLM..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume File not found
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UVS11 Preload] C:\Programme_3\Ulead VideoStudio 11 SE DVD\uvPL.exe (InterVideo Digital Technology Corporation)
O4 - HKLM..\Run: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Player\hqtray.exe" File not found
O4 - HKLM..\Run: [vspdfprsrv.exe] C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfprsrv.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [EPSON BX305 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\Windows\TEMP\E_S9636.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [EPSON BX305 Series (Kopie 1)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\Windows\TEMP\E_S8E7A.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Google)
O4 - HKU\S-1-5-21-4020697152-834944441-851474326-1000..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] C:\Programme_3\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Stephan\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Stephan\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Do Not Track Plus (c) Abine - {6E45F3E8-2683-4824-A6BE-08108022FB36} - C:\Program Files (x86)\DoNotTrackPlus\IE\DNTPAddon.dll (Abine)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKU\S-1-5-21-4020697152-834944441-851474326-1000\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0CE0C407-89DD-4652-B1A5-AF523B859E17}: NameServer = 10.111.81.129 10.129.32.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3A6F60AB-53E3-4919-B908-9F0F1C60D98A}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57D3B3ED-876C-491D-907B-817BAF551868}: NameServer = 10.74.210.210 10.74.210.211
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{1d9a63b3-cc18-11e1-a002-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{1d9a63b3-cc18-11e1-a002-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{780c77a9-af9b-11e1-814e-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{780c77a9-af9b-11e1-814e-005056c00008}\Shell\AutoRun\command - "" = K:\Data\setup.exe
O33 - MountPoints2\{ca6f4753-fde6-11df-8f66-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ca6f4753-fde6-11df-8f66-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.bat
O33 - MountPoints2\{cbe1a509-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a509-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{cbe1a523-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a523-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{cbe1a54d-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a54d-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{cbe1a56f-ce47-11e1-b4b6-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{cbe1a56f-ce47-11e1-b4b6-005056c00008}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.I420 -  File not found
Drivers32: msacm.dvacm - C:\Program Files (x86)\Common Files\Ulead Systems\VIO\DVACM.acm (InterVideo Digital Technology Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\SysWOW64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.MPEGacm - C:\Program Files (x86)\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.ulmp3acm - C:\Program Files (x86)\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.VMnc - C:\Windows\SysWow64\vmnc.dll (VMware, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.03 12:21:20 | 000,599,040 | ---- | C] (OldTimer Tools) -- C:\Users\Stephan\Desktop\OTL.exe
[2012.09.03 06:37:04 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Local\{8746F1E1-7423-4374-ACEA-BA8A9547A6AD}
[2012.09.03 06:37:04 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Local\{48F2EEC3-E298-440A-90C4-343609F9A2A0}
[2012.09.01 20:07:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.31 21:58:58 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\Malwarebytes
[2012.08.31 21:58:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.31 21:58:39 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.31 21:58:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.31 21:58:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.26 14:02:01 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Debugmode
[2012.08.26 14:02:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugmode
[2012.08.26 12:12:12 | 000,000,000 | ---D | C] -- C:\Users\Stephan\.MakeMKV
[2012.08.26 12:12:05 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MakeMKV
[2012.08.26 11:58:54 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\vlc
[2012.08.26 11:58:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.08.26 11:13:38 | 000,000,000 | ---D | C] -- C:\ProgramData\DVD Shrink
[2012.08.26 10:18:41 | 000,000,000 | ---D | C] -- C:\Users\Stephan\AppData\Roaming\dvdcss
[2012.08.24 08:22:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.08.16 13:22:48 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.04 11:24:54 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Stephan\Desktop\OTL.exe
[2012.09.04 11:24:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.04 11:24:11 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.04 10:26:32 | 000,660,420 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.04 10:26:32 | 000,621,696 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.04 10:26:32 | 000,132,318 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.04 10:26:32 | 000,108,542 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.04 10:26:31 | 001,515,780 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.04 07:49:45 | 000,020,720 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.04 07:49:45 | 000,020,720 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.04 07:42:25 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.04 07:42:15 | 536,322,047 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.02 21:54:13 | 000,511,265 | ---- | M] () -- C:\Users\Stephan\Desktop\adwcleaner.exe
[2012.09.02 11:28:04 | 001,535,254 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.01 15:11:44 | 000,000,000 | ---- | M] () -- C:\Users\Stephan\defogger_reenable
[2012.09.01 07:06:16 | 000,050,477 | ---- | M] () -- C:\Users\Stephan\Desktop\Defogger.exe
[2012.08.31 22:11:30 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad
[2012.08.31 21:58:40 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.30 17:11:17 | 000,000,844 | ---- | M] () -- C:\Users\Stephan\.recently-used.xbel
[2012.08.28 18:46:42 | 000,054,173 | ---- | M] () -- C:\Users\Stephan\Documents\test1.PNG
[2012.08.26 14:10:41 | 000,170,690 | ---- | M] () -- C:\Users\Stephan\Documents\test.swf
[2012.08.26 14:10:41 | 000,000,712 | ---- | M] () -- C:\Users\Stephan\Documents\test.htm
[2012.08.26 14:10:41 | 000,000,118 | ---- | M] () -- C:\Users\Stephan\Documents\test.js
[2012.08.26 14:06:35 | 001,616,368 | ---- | M] () -- C:\Users\Stephan\Documents\test.wnk
[2012.08.26 11:58:49 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.08.23 15:43:36 | 000,419,345 | ---- | M] () -- C:\Users\Stephan\Documents\rg_pearl-LED.jpg
[2012.08.23 15:16:11 | 001,103,599 | ---- | M] () -- C:\Users\Stephan\Documents\PE5973_11_70365[1].pdf
[2012.08.21 10:46:49 | 000,641,144 | ---- | M] () -- C:\Users\Stephan\Documents\Teich_10.PNG
[2012.08.16 17:45:17 | 000,553,072 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.16 15:09:18 | 005,598,742 | ---- | M] () -- C:\Users\Stephan\Documents\Bedienungsanleitung_Cafissimo.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.02 21:54:43 | 000,511,265 | ---- | C] () -- C:\Users\Stephan\Desktop\adwcleaner.exe
[2012.09.01 15:11:44 | 000,000,000 | ---- | C] () -- C:\Users\Stephan\defogger_reenable
[2012.09.01 15:10:59 | 000,050,477 | ---- | C] () -- C:\Users\Stephan\Desktop\Defogger.exe
[2012.08.31 22:05:41 | 000,002,005 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
[2012.08.31 21:58:40 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.31 16:15:44 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad
[2012.08.30 17:11:17 | 000,000,844 | ---- | C] () -- C:\Users\Stephan\.recently-used.xbel
[2012.08.28 18:46:42 | 000,054,173 | ---- | C] () -- C:\Users\Stephan\Documents\test1.PNG
[2012.08.26 14:09:00 | 000,170,690 | ---- | C] () -- C:\Users\Stephan\Documents\test.swf
[2012.08.26 14:09:00 | 000,000,712 | ---- | C] () -- C:\Users\Stephan\Documents\test.htm
[2012.08.26 14:09:00 | 000,000,118 | ---- | C] () -- C:\Users\Stephan\Documents\test.js
[2012.08.26 14:06:35 | 001,616,368 | ---- | C] () -- C:\Users\Stephan\Documents\test.wnk
[2012.08.26 11:58:49 | 000,001,035 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.08.23 15:43:00 | 000,419,345 | ---- | C] () -- C:\Users\Stephan\Documents\rg_pearl-LED.jpg
[2012.08.23 15:35:44 | 001,103,599 | ---- | C] () -- C:\Users\Stephan\Documents\PE5973_11_70365[1].pdf
[2012.08.21 10:46:48 | 000,641,144 | ---- | C] () -- C:\Users\Stephan\Documents\Teich_10.PNG
[2012.08.16 15:16:10 | 005,598,742 | ---- | C] () -- C:\Users\Stephan\Documents\Bedienungsanleitung_Cafissimo.pdf
[2012.07.17 19:46:38 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.04.27 13:39:20 | 000,000,000 | ---- | C] () -- C:\Users\Stephan\.gtk-bookmarks
[2012.02.22 10:36:17 | 000,000,542 | ---- | C] () -- C:\Windows\wiso.ini
[2011.12.28 17:49:13 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2011.12.28 17:49:13 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2011.11.11 17:43:23 | 000,000,087 | ---- | C] () -- C:\Users\Stephan\.iccbutton_history
[2011.11.03 12:58:10 | 000,007,680 | ---- | C] () -- C:\Users\Stephan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.21 07:34:32 | 000,001,854 | ---- | C] () -- C:\Users\Stephan\AppData\Roaming\GhostObjGAFix.xml
[2011.04.29 21:45:13 | 000,003,949 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.03.21 21:03:24 | 000,172,032 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2011.02.28 22:56:53 | 000,321,536 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2011.02.24 18:13:38 | 000,210,456 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll
[2011.02.24 18:13:38 | 000,206,360 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll
[2011.02.24 18:13:38 | 000,198,168 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll
[2011.02.24 18:13:38 | 000,198,168 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll
[2011.02.24 18:13:38 | 000,194,072 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll
[2011.02.24 18:13:38 | 000,026,136 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll
[2011.02.21 14:10:43 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011.02.14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Pianos and Keyboards
[2011.02.14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Piano Med
[2011.02.14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\Users\Stephan\AppData\Roaming\Phaser
[2011.02.14 12:06:13 | 000,000,268 | RH-- | C] () -- C:\Users\Stephan\AppData\Roaming\Perl
[2011.02.14 12:06:13 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2011.02.14 12:06:13 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2011.02.14 12:06:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Piano Hard
[2011.02.14 12:06:12 | 000,000,268 | RH-- | C] () -- C:\Users\Stephan\AppData\Roaming\Percussion Kit
[2011.02.14 12:06:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2011.02.14 11:12:27 | 000,012,923 | ---- | C] () -- C:\Users\Stephan\AppData\Roaming\Microsoft Excel.CAL
[2011.02.14 11:11:37 | 000,038,936 | ---- | C] () -- C:\Users\Stephan\AppData\Roaming\Microsoft Excel.ADR
[2011.02.14 09:57:58 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.02.07 11:31:13 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2011.02.07 11:29:35 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.02.07 10:59:53 | 000,014,336 | ---- | C] () -- C:\Windows\SysWow64\vsmon1.dll
[2011.02.05 21:46:51 | 000,000,126 | ---- | C] () -- C:\Windows\SysWow64\AF15IRTBL.bin
[2011.02.04 14:14:39 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.02.01 18:54:45 | 001,535,254 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.01.31 10:46:24 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.12.02 06:31:12 | 000,009,988 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2010.12.02 05:59:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== LOP Check ==========
 
[2012.02.20 14:20:52 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\.minecraft
[2011.06.03 21:47:47 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\anpo.republika.pl
[2011.03.06 19:33:56 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Ashampoo
[2012.02.22 10:49:26 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Buhl Data Service
[2011.12.28 17:49:24 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\concept design
[2012.06.24 10:26:48 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\digital publishing
[2012.06.11 09:05:45 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\DVDVideoSoft
[2012.04.09 17:29:07 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.02.17 19:34:49 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Epson
[2012.08.30 10:23:50 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\EurekaLog
[2012.05.25 11:05:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\eXPert PDF 6
[2011.06.26 08:05:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\eXPert PDF Editor
[2012.02.21 21:54:03 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\fdrtools.com
[2012.07.15 09:13:24 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\FileZilla
[2012.01.02 21:02:18 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\fltk.org
[2011.02.28 16:05:42 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Foxit Software
[2011.04.22 19:50:57 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\FRITZ!
[2011.05.04 22:02:33 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\GARMIN
[2012.08.27 18:00:36 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\gsak
[2012.07.17 11:18:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\gtk-2.0
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\hdbADS
[2012.01.02 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\HDRsoft
[2012.07.13 17:50:48 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Internetmanager
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\IrfanView
[2011.02.18 17:14:07 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\KompoZer
[2011.03.28 08:05:27 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Lexware
[2011.12.28 12:36:10 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\MAGIX
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\MrJobs
[2011.02.14 20:26:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Nikon
[2011.02.07 10:36:30 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\OpenOffice.org
[2011.02.28 15:10:39 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Opera
[2011.02.18 16:56:30 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Participatory Culture Foundation
[2012.04.27 13:44:30 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\PCF-VLC
[2011.08.26 20:59:16 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\PhotoFiltre
[2012.01.07 00:11:10 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\pokerth
[2011.09.08 20:12:27 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Priotecs
[2012.07.15 17:54:23 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Programme_3
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Scribus
[2012.01.02 21:04:46 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\SNS-HDR
[2012.01.02 20:36:01 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\SNS-HDR_Lite
[2011.03.02 13:20:26 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\SoftGrid Client
[2011.02.04 14:14:39 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Spicebird
[2012.07.15 17:55:00 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\T-Mobile Internet Manager
[2012.07.15 13:44:14 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Telefónica
[2012.07.15 13:44:13 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\TGCMLog
[2011.02.21 14:10:53 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Tobit
[2011.02.01 18:55:42 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\TP
[2012.05.08 15:10:52 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\TrueCrypt
[2011.03.03 14:48:44 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Ulead Systems
[2012.06.24 13:13:23 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Vocup
[2011.02.01 21:58:03 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\WinBatch
[2012.06.06 16:13:07 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Wireshark
[2011.02.02 23:16:22 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\_MDLogs
[2012.09.01 06:48:15 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.02.20 14:20:52 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\.minecraft
[2011.02.01 18:19:43 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Adobe
[2011.06.03 21:47:47 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\anpo.republika.pl
[2011.03.06 19:33:56 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Ashampoo
[2011.01.31 10:53:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\ATI
[2011.11.02 10:34:21 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Avira
[2012.02.22 10:49:26 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Buhl Data Service
[2011.12.28 17:49:24 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\concept design
[2011.12.22 15:07:04 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\CyberLink
[2012.06.24 10:26:48 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\digital publishing
[2012.08.26 12:01:12 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\dvdcss
[2012.06.11 09:05:45 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\DVDVideoSoft
[2012.04.09 17:29:07 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.02.17 19:34:49 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Epson
[2012.08.30 10:23:50 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\EurekaLog
[2012.05.25 11:05:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\eXPert PDF 6
[2011.06.26 08:05:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\eXPert PDF Editor
[2012.02.21 21:54:03 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\fdrtools.com
[2012.07.15 09:13:24 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\FileZilla
[2012.01.02 21:02:18 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\fltk.org
[2011.02.28 16:05:42 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Foxit Software
[2011.04.22 19:50:57 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\FRITZ!
[2011.05.04 22:02:33 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\GARMIN
[2012.08.27 18:00:36 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\gsak
[2012.07.17 11:18:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\gtk-2.0
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\hdbADS
[2012.01.02 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\HDRsoft
[2011.02.01 23:07:05 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Hewlett-Packard
[2011.09.27 12:40:29 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\HP Support Assistant
[2011.02.01 22:05:41 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\hpqLog
[2011.09.27 12:40:29 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\HpUpdate
[2011.01.31 10:52:16 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Identities
[2011.02.05 21:42:41 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\InstallShield
[2012.07.13 17:50:48 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Internetmanager
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\IrfanView
[2011.02.18 17:14:07 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\KompoZer
[2011.03.28 08:05:27 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Lexware
[2011.02.01 18:19:45 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Macromedia
[2011.12.28 12:36:10 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\MAGIX
[2012.08.31 21:58:58 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Media Center Programs
[2011.09.06 20:43:13 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Media Player Classic
[2012.07.26 17:20:22 | 000,000,000 | --SD | M] -- C:\Users\Stephan\AppData\Roaming\Microsoft
[2011.10.21 15:57:49 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Mozilla
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\MrJobs
[2011.02.14 20:26:34 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Nikon
[2011.02.07 10:36:30 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\OpenOffice.org
[2011.02.28 15:10:39 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Opera
[2011.02.18 16:56:30 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Participatory Culture Foundation
[2012.04.27 13:44:30 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\PCF-VLC
[2011.08.26 20:59:16 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\PhotoFiltre
[2012.01.07 00:11:10 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\pokerth
[2011.09.08 20:12:27 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Priotecs
[2012.07.15 17:54:23 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Programme_3
[2011.07.05 20:16:59 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Scribus
[2012.01.02 21:04:46 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\SNS-HDR
[2012.01.02 20:36:01 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\SNS-HDR_Lite
[2011.03.02 13:20:26 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\SoftGrid Client
[2011.02.04 14:14:39 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Spicebird
[2012.07.15 17:55:00 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\T-Mobile Internet Manager
[2012.07.15 13:44:14 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Telefónica
[2012.07.15 13:44:13 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\TGCMLog
[2011.02.21 14:10:53 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Tobit
[2011.02.01 18:55:42 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\TP
[2012.05.08 15:10:52 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\TrueCrypt
[2011.03.03 14:48:44 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Ulead Systems
[2012.08.30 14:22:42 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\vlc
[2012.08.16 21:35:55 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\VMware
[2012.06.24 13:13:23 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Vocup
[2011.04.10 18:39:13 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Winamp
[2011.02.01 21:58:03 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\WinBatch
[2012.06.06 16:13:07 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\Wireshark
[2011.02.02 23:16:22 | 000,000,000 | ---D | M] -- C:\Users\Stephan\AppData\Roaming\_MDLogs
 
< %APPDATA%\*.exe /s >
[2011.06.25 22:22:30 | 000,010,134 | R--- | M] () -- C:\Users\Stephan\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe
[2011.06.25 22:22:30 | 000,000,766 | R--- | M] () -- C:\Users\Stephan\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe
[2011.04.21 22:03:27 | 000,080,896 | R--- | M] () -- C:\Users\Stephan\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe
[2011.02.14 12:08:09 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Stephan\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
[2012.03.25 09:38:49 | 000,119,808 | R--- | M] () -- C:\Users\Stephan\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
[2010.01.07 14:35:18 | 001,007,616 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Stephan\AppData\Roaming\T-Mobile Internet Manager\LiveUpdate.exe
[2009.12.31 14:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Stephan\AppData\Roaming\T-Mobile Internet Manager\ouc.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0000\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0100\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0103\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0200\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0800\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0a03\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0b00\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0c01\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0c02\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0c04\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\_pnp0c0c\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\acpi_fixedbutton\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\pci_cc_0500\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\pci_cc_0600\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\pci_cc_0601\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\pci_cc_0604\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\pci_ven_10de&dev_03eb\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\root_mssmbios\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\root_rdp_kbd\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\root_rdp_mou\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\root_swenum\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\root_vdrvroot\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Users\Stephan\Documents\My Drivers\System\root_volmgr\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2008.06.07 00:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2010.12.02 06:51:45 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2010.12.02 06:51:45 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.12.02 06:51:45 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2010.12.02 06:51:45 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.12.02 06:42:42 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.12.02 06:42:42 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:5F64C164

< End of report >

d-aus-h · 04.09.2012, 10:45

(gelöscht - doppelt gepostet)

d-aus-h · 04.09.2012, 10:47

(gelöscht - doppelt gepostet)

cosinus · 04.09.2012, 16:14

Code:

ATTFilter

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0CE0C407-89DD-4652-B1A5-AF523B859E17}: NameServer = 10.111.81.129 10.129.32.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3A6F60AB-53E3-4919-B908-9F0F1C60D98A}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57D3B3ED-876C-491D-907B-817BAF551868}: NameServer = 10.74.210.210 10.74.210.211

Ist das rein zufällig ein Büro/Firmen-PC?

d-aus-h · 04.09.2012, 16:48

Nein, das ist mein normaler Heim-PC.
Die Ultimate-Lizenz ist eine offiziell über die Firma für die Mitarbeiter gekaufte Lizenz; die Org.DVD und Lizenz liegt hier vor mir.

Kann das durch irgendein Programm so eingestellt worden sein?

Code:

ATTFilter

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

Diese IP hat in meinem Heimnetzwerk die Fritz.Box

03.09.2012, 21:04	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	GVU - Trojaner sperrt PC / Ukash Zahlung verlangt / W7 64bit / Malwarebytes erledigt Hätte da mal zwei Fragen bevor es weiter geht 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? __________________ Logfiles bitte immer in CODE-Tags posten

GVU - Trojaner sperrt PC / Ukash Zahlung verlangt / W7 64bit / Malwarebytes erledigt

Plagegeister aller Art und deren Bekämpfung: GVU - Trojaner sperrt PC / Ukash Zahlung verlangt / W7 64bit / Malwarebytes erledigt