gvu besuch

OTL logfile created on: 11.09.2012 12:46:46 - Run 1
OTL by OldTimer - Version 3.2.61.3     Folder = C:\Dokumente und Einstellungen\seppel\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,63 Gb Available Physical Memory | 87,74% Memory free
4,85 Gb Paging File | 4,67 Gb Available in Paging File | 96,36% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 78,13 Gb Total Space | 30,88 Gb Free Space | 39,53% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 26,93 Gb Free Space | 27,57% Space Free | Partition Type: NTFS
Drive F: | 57,09 Gb Total Space | 29,35 Gb Free Space | 51,40% Space Free | Partition Type: NTFS
Drive K: | 7,55 Gb Total Space | 7,33 Gb Free Space | 97,07% Space Free | Partition Type: FAT32
 
Computer Name: DER-PETER | User Name: seppel | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.11 12:46:15 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\seppel\Desktop\OTL.exe
PRC - [2012.09.08 22:58:15 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.09.08 22:58:13 | 002,244,064 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.07.27 22:51:38 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2008.02.04 13:29:02 | 000,688,128 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
MOD - [2007.09.20 18:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.09.08 22:58:14 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- c:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- c:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- c:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbdev.sys -- (hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.09.11 11:33:08 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.08.21 11:13:15 | 000,729,752 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.08.21 11:13:15 | 000,355,632 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.08.21 11:13:15 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.08.21 11:13:14 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012.08.21 11:13:14 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012.08.21 11:13:13 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2012.08.21 11:13:13 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012.04.29 09:46:58 | 000,223,128 | ---- | M] (DT Soft Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dtscsi.sys -- (dtscsi)
DRV - [2012.04.29 09:44:56 | 000,664,064 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2011.05.03 16:33:46 | 006,404,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2009.11.18 07:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009.11.18 07:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008.04.23 00:34:52 | 002,880,000 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008.03.03 20:00:00 | 000,043,392 | R--- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SiSGbeXP.sys -- (SiSGbeXP)
DRV - [2007.10.26 02:20:36 | 000,549,184 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2007.10.01 14:59:46 | 001,769,984 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC)
DRV - [2006.12.17 23:11:58 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: anttoolbar@ant.com:2.4.7.1
FF - prefs.js..extensions.enabledAddons: wrc@avast.com:7.0.1466
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: E:\MyCamera Download Plugin\NPCIG.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Programme\AVAST Software\Avast\WebRep\FF [2012.09.10 02:08:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.08 22:58:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
 
[2012.04.19 09:52:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Mozilla\Extensions
[2012.07.13 11:16:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Mozilla\Firefox\Profiles\dyfj6f36.default\extensions
[2012.07.13 11:16:02 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Mozilla\Firefox\Profiles\dyfj6f36.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.06.10 12:49:54 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Mozilla\Firefox\Profiles\dyfj6f36.default\extensions\anttoolbar@ant.com
[2012.07.01 13:02:08 | 000,002,045 | ---- | M] () -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Mozilla\Firefox\Profiles\dyfj6f36.default\searchplugins\benefind.xml
[2012.06.03 02:16:44 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.10 02:08:30 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAMME\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012.09.08 22:58:15 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.06.19 14:34:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.08 22:58:11 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.19 14:34:39 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.19 14:34:39 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.19 14:34:39 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.19 14:34:39 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2002.08.29 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATKOSD2] C:\Programme\ATKOSD2\ATKOSD2.exe ()
O4 - HKLM..\Run: [avast] C:\Programme\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] c:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\seppel\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DD68006A-B34C-4789-B80F-BB360CB7202D}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\seppel\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\seppel\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.04.19 01:22:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{236aace4-d4f6-11e1-8cc2-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{236aace4-d4f6-11e1-8cc2-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{236aace4-d4f6-11e1-8cc2-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{236aace6-d4f6-11e1-8cc2-001e101fbf24}\Shell - "" = AutoRun
O33 - MountPoints2\{236aace6-d4f6-11e1-8cc2-001e101fbf24}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{236aace6-d4f6-11e1-8cc2-001e101fbf24}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O33 - MountPoints2\{26da4e55-e524-11e1-8ced-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{26da4e55-e524-11e1-8ced-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26da4e55-e524-11e1-8ced-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{375fd282-d687-11e1-8cc7-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{375fd282-d687-11e1-8cc7-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{375fd282-d687-11e1-8cc7-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{42b1f044-d66d-11e1-8cc6-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{42b1f044-d66d-11e1-8cc6-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{42b1f044-d66d-11e1-8cc6-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{7889f1cc-e562-11e1-8cef-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{7889f1cc-e562-11e1-8cef-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7889f1cc-e562-11e1-8cef-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{7a2ee9c2-d43e-11e1-8cc0-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{7a2ee9c2-d43e-11e1-8cc0-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7a2ee9c2-d43e-11e1-8cc0-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{7a2ee9c5-d43e-11e1-8cc0-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{7a2ee9c5-d43e-11e1-8cc0-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7a2ee9c5-d43e-11e1-8cc0-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{ec3c44b0-d74a-11e1-8cc9-0022152b33d1}\Shell - "" = AutoRun
O33 - MountPoints2\{ec3c44b0-d74a-11e1-8cc9-0022152b33d1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec3c44b0-d74a-11e1-8cc9-0022152b33d1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.11 12:46:33 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\seppel\Desktop\OTL.exe
[2012.09.11 11:31:25 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012.09.11 11:31:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Malwarebytes
[2012.09.11 11:31:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.09.11 11:31:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.09.11 11:31:01 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.09.11 11:31:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.09.11 01:33:27 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\seppel\PrivacIE
[2012.09.07 12:19:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\seppel\Lokale Einstellungen\Anwendungsdaten\WMTools Downloaded Files
[2012.08.28 17:45:17 | 000,000,000 | ---D | C] -- C:\fugger2
[2012.08.28 17:27:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\seppel\Lokale Einstellungen\Anwendungsdaten\DOSBox
[2012.08.28 17:26:50 | 000,000,000 | ---D | C] -- C:\Programme\DOSBox-0.74
[2012.08.28 17:26:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DOSBox-0.74
[2012.08.25 13:44:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.11 12:47:36 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.09.11 12:46:15 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\seppel\Desktop\OTL.exe
[2012.09.11 12:45:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.09.11 12:42:56 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\seppel\defogger_reenable
[2012.09.11 11:33:08 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012.09.11 11:31:03 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.11 11:23:55 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.09.11 01:40:24 | 003,932,184 | ---- | M] () -- C:\snp2uvc-001.raw
[2012.09.11 01:39:53 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dsgsdgdsgdsgw.pad
[2012.09.11 01:39:41 | 000,000,308 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012.09.11 01:39:28 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.11 01:02:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.10 02:08:33 | 000,003,001 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.09.06 20:14:35 | 000,249,725 | ---- | M] () -- C:\Dokumente und Einstellungen\seppel\Desktop\Triple-Flyer_vorn.jpg
[2012.09.06 20:12:19 | 000,102,912 | ---- | M] () -- C:\Dokumente und Einstellungen\seppel\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.06 00:11:30 | 000,000,512 | ---- | M] () -- C:\Dokumente und Einstellungen\seppel\Desktop\IMG_0706.MOV
[2012.08.28 17:26:51 | 000,001,545 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DOSBox 0.74.lnk
[2012.08.21 11:13:15 | 000,729,752 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012.08.21 11:13:15 | 000,355,632 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012.08.21 11:13:15 | 000,054,232 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012.08.21 11:13:14 | 000,097,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012.08.21 11:13:14 | 000,089,624 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012.08.21 11:13:14 | 000,035,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012.08.21 11:13:13 | 000,025,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012.08.21 11:13:13 | 000,021,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012.08.21 11:12:33 | 000,041,224 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012.08.21 11:12:23 | 000,227,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012.08.19 14:56:08 | 000,449,492 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.08.19 14:56:08 | 000,433,138 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.08.19 14:56:08 | 000,080,754 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.08.19 14:56:08 | 000,068,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.08.15 10:11:58 | 000,125,320 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.08.15 09:43:22 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.11 12:42:45 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\seppel\defogger_reenable
[2012.09.11 11:31:03 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.11 01:33:18 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dsgsdgdsgdsgw.pad
[2012.09.07 11:33:36 | 000,000,512 | ---- | C] () -- C:\Dokumente und Einstellungen\seppel\Desktop\IMG_0706.MOV
[2012.09.06 20:14:35 | 000,249,725 | ---- | C] () -- C:\Dokumente und Einstellungen\seppel\Desktop\Triple-Flyer_vorn.jpg
[2012.08.28 17:26:51 | 000,001,545 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DOSBox 0.74.lnk
[2012.07.16 12:31:46 | 000,000,127 | ---- | C] () -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\burnaware.ini
[2012.06.27 17:36:52 | 001,769,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2012.06.27 17:36:52 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2012.04.27 15:27:01 | 000,102,912 | ---- | C] () -- C:\Dokumente und Einstellungen\seppel\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.22 14:14:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2012.04.21 14:25:41 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.04.21 12:51:22 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.04.19 12:31:08 | 000,886,192 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dll
[2012.04.19 12:05:29 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2012.04.19 12:05:29 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2012.04.19 12:05:29 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2012.04.19 12:05:29 | 000,067,965 | ---- | C] () -- C:\WINDOWS\System32\Oemdspif.dll
[2012.04.19 12:05:28 | 000,168,883 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2012.04.19 09:45:20 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2012.04.19 02:15:36 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012.04.19 02:14:31 | 000,125,320 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.04.19 01:23:51 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012.04.19 01:20:01 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
 
========== LOP Check ==========
 
[2012.04.19 09:37:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software
[2012.07.30 13:52:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ
[2012.07.24 20:55:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMSetup
[2012.08.23 11:36:43 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2012.07.24 20:57:13 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJSolutionMenuEX
[2012.07.24 20:55:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJWSpt
[2012.07.13 11:17:09 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2012.04.29 09:42:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2012.07.23 20:42:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService
[2012.06.18 20:46:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PDF Writer
[2012.07.13 11:18:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2012.07.13 11:17:10 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.08.23 11:36:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Canon
[2012.07.18 16:03:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Cenauv
[2012.09.11 01:39:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Dropbox
[2012.07.13 11:16:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\DVDVideoSoft
[2012.07.13 11:16:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\DVDVideoSoftIEHelpers
[2012.07.19 01:45:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Gilyy
[2012.07.13 11:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\OpenCandy
[2012.04.21 14:36:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\OpenOffice.org
[2012.06.18 20:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\PDF Writer
[2012.07.13 11:17:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\TuneUp Software
[2012.04.29 10:02:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Ulead Systems
[2012.09.11 01:39:41 | 000,000,308 | -H-- | M] () -- C:\WINDOWS\Tasks\avast! Emergency Update.job
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 11.09.2012 12:46:46 - Run 1
OTL by OldTimer - Version 3.2.61.3     Folder = C:\Dokumente und Einstellungen\seppel\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,63 Gb Available Physical Memory | 87,74% Memory free
4,85 Gb Paging File | 4,67 Gb Available in Paging File | 96,36% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 78,13 Gb Total Space | 30,88 Gb Free Space | 39,53% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 26,93 Gb Free Space | 27,57% Space Free | Partition Type: NTFS
Drive F: | 57,09 Gb Total Space | 29,35 Gb Free Space | 51,40% Space Free | Partition Type: NTFS
Drive K: | 7,55 Gb Total Space | 7,33 Gb Free Space | 97,07% Space Free | Partition Type: FAT32
 
Computer Name: DER-PETER | User Name: seppel | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Digital Photo Professional] -- E:\Digital Photo Professional\DPPViewer.exe /path "%1"
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mit Corel PaintShop Pro X4 durchsuchen] -- "e:\Programme\Corel\Corel PaintShop Pro X4\Corel PaintShop Pro.exe" "%L" (Corel, Inc.)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "e:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "e:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "e:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\seppel\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{00580795-581C-4587-B9F2-37320D7AB37F}" = Corel PaintShop Pro X4
"{00580795-581C-4587-B9F2-37320D7AB37F}" = ICA
"{006CAAEF-CA96-4181-AC22-FE56D61432E4}" = PSPPContent
"{00AE1A2D-7BC2-4359-A0EC-E19F36E391BB}" = Corel PaintShop Pro X4
"{00BEE329-BAAB-49FF-9B66-55E4B12B9ADD}" = IPM_PSP_COM
"{00D13418-7DDF-4D3D-A237-E297B103BB6B}" = Setup
"{00D74A7A-F7AD-4D00-ABD2-0973836292C7}" = PSPPHelp
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2580117B-C14B-F48D-A327-6D90AEF2F61D}" = Catalyst Control Center Localization Turkish
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{281B2F20-B2E6-E3F0-ACD7-235209A9B313}" = Catalyst Control Center Localization Danish
"{2C9E18E4-68A2-D53E-00E0-4AEFAC8E9ACF}" = Skins
"{2D9465E8-863A-8661-58CD-D2748D132B25}" = CCC Help Greek
"{2E14AE17-EF98-D6EB-3B1C-4A9C735DD79E}" = Catalyst Control Center Localization Chinese Standard
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer
"{3B768993-0866-E671-D4DE-138DE07BA174}" = CCC Help Japanese
"{3E2CC5AA-6318-4364-4E44-453F480729EE}" = CCC Help Portuguese
"{3FDBE6F9-FC0A-8E5B-305F-3BA1980888E7}" = CCC Help Danish
"{412FE81D-BE52-508F-BA83-4EE163D194DB}" = Catalyst Control Center Localization Finnish
"{4369109E-E519-3CE3-C2FC-4B24E69FE53C}" = CCC Help Turkish
"{488FE5C5-D9DF-D25D-6DC9-610732EB9A0E}" = CCC Help Hungarian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3DEAEA-D4F6-EA38-452D-09ED51FFD894}" = CCC Help Czech
"{4A8926B8-F56D-EAD4-8839-FC5C3052EE00}" = Catalyst Control Center Localization Thai
"{4A965C96-AC5F-6DD4-8189-BD6EDD479041}" = ccc-core-preinstall
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{539139C6-9165-2608-1C67-0F6E2C2D12D0}" = CCC Help Chinese Traditional
"{5A9240FC-D86C-8D7B-4BE3-4BE0C223863B}" = Catalyst Control Center Localization Italian
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5FFE06F8-158F-1434-5F59-DA7F3BB8B427}" = CCC Help Polish
"{60CB7D6D-D55F-174E-6FBD-841A0FB75DF7}" = ccc-utility
"{612DF751-0F94-B0B2-113B-E711F31871AC}" = CCC Help Spanish
"{65875C76-C064-7875-0828-CC4978B4941D}" = Catalyst Control Center Graphics Light
"{66706938-B1B8-48AB-1A0D-E1341AD79313}" = CCC Help English
"{6C383E5A-A8D6-2F06-DAAD-474176487162}" = CCC Help Thai
"{6E32B134-CA8D-49DD-B94C-0DB155CE70B5}" = ccc-Branding
"{6FE97F8E-C4B0-39C1-BFD6-8445C931F69C}" = Catalyst Control Center Localization Japanese
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73CFD1B1-6E78-6804-2347-FC3A8641F2C3}" = CCC Help Korean
"{768AEFF6-0ADB-EC94-0F0B-DAA54B52B365}" = Catalyst Control Center Localization Chinese Traditional
"{76EA55BD-535F-4AB4-AD80-A8CA331F4E6F}" = Windows Messenger 5.1
"{790263AF-A697-0F38-06EB-5939B0CE17F9}" = Catalyst Control Center Graphics Full New
"{7A271D30-6D65-ED23-872F-3F7A3E6BF2A3}" = Catalyst Control Center Localization Polish
"{82A64F42-6C9E-9740-6962-968A0D01205F}" = CCC Help Italian
"{831F4245-19C0-84C2-9D9C-7EE90295D200}" = Catalyst Control Center Localization German
"{8441FF59-54B7-03A3-5740-B7A5E90C0018}" = CCC Help German
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8DF31BC6-7BEF-22C5-64AA-1D18049BAAD2}" = Catalyst Control Center Graphics Previews Common
"{920AB7AD-AC2F-3D20-14E9-BA90E7906B37}" = CCC Help Russian
"{92E15E9B-1B5F-A0B3-3267-B27D7F38E90C}" = Catalyst Control Center Localization Greek
"{990EF1F3-0C93-AB86-DDC1-7CD7BECD3D94}" = CCC Help Norwegian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A7912A0-A08F-073D-3A58-BCC6166F0B7D}" = Catalyst Control Center Localization Portuguese
"{9ED10FE8-6A6D-012F-8ED7-2D88CE8AF6E3}" = Catalyst Control Center Graphics Full Existing
"{A2D19B52-046B-F483-7354-C2F66EC8F89A}" = CCC Help Finnish
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3CAB163-3EE3-0DDD-28FC-8FDC387111FF}" = Catalyst Control Center Localization Swedish
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AEE5AB86-8C98-8BB8-7405-8A386EF6ABC6}" = Catalyst Control Center Core Implementation
"{B26FB649-D13B-5D5D-BA13-8620C13CA698}" = Catalyst Control Center Localization Norwegian
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C16C6B-AAFE-0371-08AD-8D17D4B375FD}" = Catalyst Control Center Localization Dutch
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DC9766F2-A95D-FCD0-16A3-F7DFD6185210}" = Catalyst Control Center Localization Spanish
"{DD952146-DDA5-6640-8DCF-FAB255EB6120}" = Catalyst Control Center Localization Hungarian
"{E6640A29-18EB-87B8-7EC5-A48FE518EC5C}" = Catalyst Control Center Localization Czech
"{E82B17D6-4A94-0124-E96D-3068DC60B4E7}" = ccc-core-static
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7B2328E-523D-D652-0449-F1EAE1B0A937}" = CCC Help Dutch
"{F8DE24C2-64E5-57A9-ECB5-077D36EEBB60}" = CCC Help Chinese Standard
"{F98025F9-CA5F-03E7-2C38-4D88D7FE7F1B}" = Catalyst Control Center Localization Korean
"{FCEC5C39-8E8F-376C-B426-78FC723DBC03}" = Catalyst Control Center Localization French
"{FDC868E5-9338-042E-15C6-46732984E247}" = CCC Help Swedish
"{FF1E9419-269F-96F5-4D07-92B111A7EA69}" = CCC Help French
"{FF255BD9-A26D-B524-8728-F5CD18DE55E2}" = Catalyst Control Center Localization Russian
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"avast" = avast! Free Antivirus
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 8.2.0.1406
"BurnAware Free_is1" = BurnAware Free 2.1
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"DPP" = Canon Utilities Digital Photo Professional 3.10
"EOS Sample Music" = Canon Utilities EOS Sample Music
"EOS Utility" = Canon Utilities EOS Utility
"EOS Video Snapshot Task" = Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MovieUploaderForYouTube" = Canon Utilities Movie Uploader for YouTube
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"VLC media player" = VLC media player 2.0.1
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 13.07.2012 05:29:08 | Computer Name = DER-PETER | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung winamp.exe, Version 5.5.4.2165, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x0000008c.
 
Error - 17.07.2012 04:00:09 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application mom.exe, version 2.0.0.0, stamp 469cdcb3, faulting
 module mscorwks.dll, version 2.0.50727.3634, stamp 4ef6c0ec, debug? 0, fault address
 0x000b0db2.
 
Error - 17.07.2012 18:05:17 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application mom.exe, version 2.0.0.0, stamp 469cdcb3, faulting
 module mscorwks.dll, version 2.0.50727.3634, stamp 4ef6c0ec, debug? 0, fault address
 0x000b0db2.
 
Error - 17.07.2012 18:05:23 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 ccc.exe, P2 2.0.0.0, P3 469cdc9c, P4 mscorlib,
 P5 2.0.0.0, P6 4ef6c16f, P7 f4f, P8 7, P9 n3ctrye2kn3c34sgl4zqyrbfte4m13nb, P10
 NIL.
 
Error - 18.07.2012 03:08:43 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application mom.exe, version 2.0.0.0, stamp 469cdcb3, faulting
 module mscorwks.dll, version 2.0.50727.3634, stamp 4ef6c0ec, debug? 0, fault address
 0x000b0db2.
 
Error - 18.07.2012 07:13:10 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application mom.exe, version 2.0.0.0, stamp 469cdcb3, faulting
 module mscorwks.dll, version 2.0.50727.3634, stamp 4ef6c0ec, debug? 0, fault address
 0x000b0db2.
 
Error - 18.07.2012 10:02:41 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application mom.exe, version 2.0.0.0, stamp 469cdcb3, faulting
 module mscorwks.dll, version 2.0.50727.3634, stamp 4ef6c0ec, debug? 0, fault address
 0x000b0db2.
 
Error - 18.07.2012 10:02:43 | Computer Name = DER-PETER | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 469cdc9c, faulting
 module mscorwks.dll, version 2.0.50727.3634, stamp 4ef6c0ec, debug? 0, fault address
 0x000b0db2.
 
[ System Events ]
Error - 11.09.2012 05:16:13 | Computer Name = DER-PETER | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   Aavmker4  aswSnx  aswSP  aswTdi  Fips  intelppm
 
Error - 11.09.2012 05:18:26 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 11.09.2012 05:18:29 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 11.09.2012 05:18:53 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 11.09.2012 05:21:16 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 11.09.2012 05:21:23 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 11.09.2012 06:43:29 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 11.09.2012 06:43:35 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 11.09.2012 06:45:47 | Computer Name = DER-PETER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 11.09.2012 06:46:56 | Computer Name = DER-PETER | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   Aavmker4  aswSnx  aswSP  aswTdi  Fips  intelppm
 
 
< End of report >
         

GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2012-09-11 14:35:53
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST9250827AS rev.3.AAA
Running: ufmpbzuu.exe; Driver: C:\DOKUME~1\seppel\LOKALE~1\Temp\uwlcypow.sys


---- Kernel code sections - GMER 1.0.15 ----

?               lvgxxhos.sys                                                                                                         Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                            AswRdr.SYS (avast! TDI Redirect Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x52 0xE6 0x0A 0x13 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xEC 0xCE 0x58 0xAF ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x7D 0xAE 0x98 0x62 ...
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools\
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x52 0xE6 0x0A 0x13 ...
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xEC 0xCE 0x58 0xAF ...
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x7D 0xAE 0x98 0x62 ...

---- EOF - GMER 1.0.15 ----