Also ich habe den Verdacht, dass mein PC infiziert wurde und ein Hacker die Kontrolle über meinen PC hat (z.B schließen und öffnen sich einfach irgendwelche Tabs wie "Google Chrome")

Und bei cmd netstat steht da etwas verdächtiges undzwar:
fra07s07-in-f101.1e100.net HERGESTELLT

Als ich das gegoogelt habe und die Ip herausgefunden habe (209.85.148.101) Stand da, dass die Quelle in den Vereiningten Staaten, Mountain View ist.

Wie kann ich das loswerden und meinen PC säubern

Danke

hi
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Ok das hier ist OTL.txt
OTL Logfile:

OTL logfile created on: 15.09.2012 19:22:34 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Acer\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 74,46% Memory free
5,99 Gb Paging File | 4,87 Gb Available in Paging File | 81,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,99 Gb Total Space | 143,96 Gb Free Space | 48,31% Space Free | Partition Type: NTFS
Drive D: | 5,68 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 3,32 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: ACER-PC | User Name: Acer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Acer\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Web Assistant\ExtensionUpdaterService.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (Web Assistant Updater) -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe ()
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (BITCOMET_HELPER_SERVICE) -- C:\Programme\BitComet\tools\BitCometService.exe (www.BitComet.com)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (XDva399) -- C:\Windows\system32\XDva399.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (mcaudrv_simple) -- C:\Windows\System32\drivers\mcaudrv.sys (ManyCam LLC)
DRV - (ManyCam) -- C:\Windows\System32\drivers\mcvidrv.sys (ManyCam LLC)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) -- C:\Windows\System32\drivers\AtihdW73.sys (Advanced Micro Devices)
DRV - (k57nd60x) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (NETwNs32) -- C:\Windows\System32\drivers\NETwNs32.sys (Intel Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SMTM&dpid=SMTM&co=DE&userid=9e020b78-ad8a-4ebb-aa38-aea058f5a1ba&searchtype=ds&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SMTM&dpid=SMTM&co=DE&userid=9e020b78-ad8a-4ebb-aa38-aea058f5a1ba&searchtype=ds&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SMTM&dpid=SMTM&co=DE&userid=9e020b78-ad8a-4ebb-aa38-aea058f5a1ba&searchtype=ds&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb178?a=6PQJF2t9FA&i=26
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B6 29 0C FC 88 75 CD 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=SMTM&dpid=SMTM&co=DE&userid=9e020b78-ad8a-4ebb-aa38-aea058f5a1ba&searchtype=ds&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=SMTM&dpid=SMTM&co=DE&userid=9e020b78-ad8a-4ebb-aa38-aea058f5a1ba&searchtype=ds&q={searchTerms}
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SMTM&dpid=SMTM&co=DE&userid=9e020b78-ad8a-4ebb-aa38-aea058f5a1ba&searchtype=ds&q={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6PQJF2t9FA&i=26
IE - HKCU\..\SearchScopes\{DA9A888A-378B-41D4-B881-45A2EAE3AEC3}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3503.0728: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Acer\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Acer\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.09.15 00:30:29 | 000,000,000 | ---D | M]
 
[2012.09.15 00:30:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.de/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Acer\AppData\Local\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Acer\AppData\Local\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Acer\AppData\Local\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Acer\AppData\Local\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Acer\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Web Assistant = C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.100_0\
CHR - Extension: AdBlock = C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.43_0\
CHR - Extension: New tab for Chrome\u2122 = C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll ()
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programme\BitComet\tools\BitCometBHO_1.5.4.11.dll (BitComet)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB DE Toolbar) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - C:\Programme\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [PLFSetL] C:\Windows\PLFSetL.exe (sonix)
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\Acer\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [Browser Infrastructure Helper] C:\Users\Acer\AppData\Local\Smartbar\Application\SnapDo.exe (Smartbar)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe" File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: &Alles mit BitComet herunterladen - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Mit BitComet herunter&laden - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0738B012-2608-433F-B18E-03CF4CAE384E}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.07.11 17:03:34 | 000,000,000 | R--D | M] - D:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2006.02.04 13:33:04 | 000,724,992 | R--- | M] (Electronic Arts Inc.) - D:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2006.02.04 14:03:19 | 000,000,161 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2006.01.31 06:56:47 | 000,942,080 | R--- | M] (Electronic Arts Inc.) - D:\AutoRunGUI.dll -- [ UDF ]
O32 - AutoRun File - [2012.07.31 03:20:10 | 000,055,176 | R--- | M] (Electronic Arts) - F:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2012.05.22 23:23:10 | 000,000,049 | R--- | M] () - F:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{28b51c6f-e212-11e1-a92f-00262d68d070}\Shell - "" = AutoRun
O33 - MountPoints2\{28b51c6f-e212-11e1-a92f-00262d68d070}\Shell\AutoRun\command - "" = F:\Autorun.exe -- [2012.07.31 03:20:10 | 000,055,176 | R--- | M] (Electronic Arts)
O33 - MountPoints2\{700f7c60-ac8b-11de-81d7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{700f7c60-ac8b-11de-81d7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2006.02.04 13:33:04 | 000,724,992 | R--- | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.15 19:15:23 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Acer\Desktop\OTL.exe
[2012.09.15 01:13:40 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Malwarebytes
[2012.09.15 01:13:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.15 01:13:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.15 01:13:19 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.15 01:13:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.09.15 00:30:38 | 000,000,000 | ---D | C] -- C:\Program Files\Perion
[2012.09.15 00:30:34 | 000,000,000 | ---D | C] -- C:\Program Files\Incredibar.com
[2012.09.15 00:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.09.15 00:30:28 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant
[2012.09.14 18:13:20 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Local\Smartbar
[2012.09.13 18:30:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya
[2012.09.13 18:27:02 | 000,000,000 | ---D | C] -- C:\Program Files\alaplaya
[2012.09.13 12:56:12 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\project64 1.6
[2012.09.13 12:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Project64 1.6
[2012.09.12 18:15:21 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cheatbook Database2009
[2012.09.12 17:51:51 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2012.09.12 12:11:14 | 000,000,000 | ---D | C] -- C:\Users\Acer\Documents\Electronic Arts
[2012.09.12 11:59:35 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2012.09.10 03:20:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ManyCam
[2012.09.10 03:20:31 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Local\ManyCam
[2012.09.10 03:20:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ManyCam
[2012.09.10 03:20:30 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\ManyCam
[2012.09.10 03:20:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2012.09.10 03:20:00 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Local\APN
[2012.09.10 03:19:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2012.09.10 03:19:57 | 000,000,000 | ---D | C] -- C:\Program Files\ManyCam
[2012.09.10 03:19:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask
[2012.09.09 20:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Empire Earth 2
[2012.09.09 17:51:05 | 000,000,000 | ---D | C] -- C:\Users\Acer\Documents\My Cheat Tables
[2012.09.09 17:51:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.2
[2012.09.09 17:50:58 | 000,000,000 | ---D | C] -- C:\Program Files\Cheat Engine 6.2
[2012.09.09 10:22:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2012.09.09 10:22:49 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2012.09.09 10:22:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield
[2012.09.09 10:03:06 | 000,000,000 | ---D | C] -- C:\Users\Acer\Documents\FUSSBALL MANAGER 11
[2012.09.09 09:54:39 | 000,000,000 | ---D | C] -- C:\Program Files\EA Sports
[2012.09.09 09:53:41 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\dvdcss
[2012.09.09 01:36:22 | 000,000,000 | ---D | C] -- C:\Program Files\Bus Driver
[2012.09.09 01:30:28 | 000,000,000 | ---D | C] -- C:\Users\Acer\Documents\Bus Driver
[2012.09.09 01:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Need for Speed Most Wanted
[2012.09.09 01:11:42 | 000,000,000 | ---D | C] -- C:\Users\Acer\Documents\NFS Most Wanted
[2012.08.17 18:26:45 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\.minecraft
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.15 19:23:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1170200248-491751642-3240281084-1000UA.job
[2012.09.15 19:23:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1170200248-491751642-3240281084-1000Core.job
[2012.09.15 19:15:24 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Acer\Desktop\OTL.exe
[2012.09.15 18:33:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.15 10:34:47 | 000,019,488 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.15 10:34:47 | 000,019,488 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.15 10:34:41 | 000,696,770 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.15 10:34:41 | 000,652,048 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.15 10:34:41 | 000,148,034 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.15 10:34:41 | 000,120,980 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.15 10:27:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.15 10:27:18 | 2411,925,504 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.15 01:13:26 | 000,001,074 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.12 20:26:42 | 000,059,904 | ---- | M] () -- C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.08 21:48:39 | 000,002,443 | ---- | M] () -- C:\Users\Acer\Desktop\Google Chrome.lnk
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.09.15 01:13:26 | 000,001,074 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.10 22:00:36 | 000,059,904 | ---- | C] () -- C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.09 19:35:46 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2012.08.09 19:35:46 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2012.08.09 19:35:46 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2012.08.09 19:32:47 | 000,000,218 | ---- | C] () -- C:\Windows\SIERRA.INI
[2012.08.09 02:22:35 | 000,000,856 | ---- | C] () -- C:\Users\Acer\AppData\Local\recently-used.xbel
[2012.08.06 11:43:51 | 001,754,368 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2012.08.06 11:43:50 | 000,028,800 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2012.08.06 11:43:44 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2012.08.06 11:43:39 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2012.08.06 11:43:39 | 000,000,055 | ---- | C] () -- C:\Windows\PidList.ini
[2012.08.06 11:41:02 | 000,237,701 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2012.08.06 11:41:02 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2012.08.06 11:35:51 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
 
========== LOP Check ==========
 
[2012.08.17 18:27:07 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\.minecraft
[2012.08.09 22:26:54 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Ashampoo
[2012.08.14 00:37:52 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Audacity
[2012.08.11 02:44:44 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\BitComet
[2012.09.14 19:56:30 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DAEMON Tools Lite
[2012.08.11 22:03:46 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DVDVideoSoft
[2012.08.11 02:21:04 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.09.10 03:20:55 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\ManyCam
[2012.09.12 18:00:49 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2012.08.11 01:48:18 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Publish Providers
[2012.08.09 15:46:49 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Sierra
[2012.08.11 01:48:16 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\Sony
[2012.09.15 11:56:15 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\uTorrent
[2012.08.11 17:03:06 | 000,000,000 | ---D | M] -- C:\Users\Acer\AppData\Roaming\XMedia Recode
[2009.07.14 06:53:46 | 000,010,204 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.08.08 21:59:01 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.09.29 03:02:07 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.07.14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.08.06 11:03:57 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.09.15 01:32:39 | 000,000,000 | ---D | M] -- C:\Downloads
[2012.08.10 12:45:00 | 000,000,000 | ---D | M] -- C:\PacSteamT
[2009.07.14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.09.15 12:12:15 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.09.15 01:13:22 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.08.06 11:03:57 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.08.06 11:03:58 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.08.09 19:32:47 | 000,000,000 | ---D | M] -- C:\Sierra
[2012.09.15 19:23:53 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.08.10 14:25:51 | 000,000,000 | ---D | M] -- C:\temp
[2012.08.06 11:04:52 | 000,000,000 | R--D | M] -- C:\Users
[2012.09.15 10:27:17 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2009.07.14 03:14:11 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2010.03.09 12:29:29 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2010.03.09 12:26:59 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2010.03.09 12:26:59 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2010.03.09 12:29:29 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.03.09 12:29:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2010.03.09 12:29:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2010.03.09 12:29:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.09.15 19:23:40 | 002,883,584 | -HS- | M] () -- C:\Users\Acer\NTUSER.DAT
[2012.09.15 19:23:40 | 000,262,144 | -HS- | M] () -- C:\Users\Acer\ntuser.dat.LOG1
[2012.08.06 11:04:52 | 000,000,000 | -HS- | M] () -- C:\Users\Acer\ntuser.dat.LOG2
[2012.08.06 11:44:31 | 000,065,536 | -HS- | M] () -- C:\Users\Acer\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2012.08.06 11:44:31 | 000,524,288 | -HS- | M] () -- C:\Users\Acer\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2012.08.06 11:44:31 | 000,524,288 | -HS- | M] () -- C:\Users\Acer\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2012.08.06 11:04:52 | 000,000,020 | -HS- | M] () -- C:\Users\Acer\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         

--- --- ---


Extras.txt
OTL Logfile:

OTL Extras logfile created on: 15.09.2012 19:22:34 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Acer\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 74,46% Memory free
5,99 Gb Paging File | 4,87 Gb Available in Paging File | 81,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,99 Gb Total Space | 143,96 Gb Free Space | 48,31% Space Free | Partition Type: NTFS
Drive D: | 5,68 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 3,32 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: ACER-PC | User Name: Acer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02D0CC3C-C3B0-42C2-93B3-8B580CECD7A3}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{0E086F73-0C37-4663-A517-C160233A8A07}" = lport=445 | protocol=6 | dir=in | app=system | 
"{15835DB4-7D22-4BE7-A367-F27855573BF9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3D5FFB67-17B4-4A32-A1D8-8140128BB2ED}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{3EC9DA69-469A-453A-978E-2AC033FDD778}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{4B9210DC-79A4-4775-BDE7-246EC18F2C0B}" = lport=137 | protocol=17 | dir=in | app=system | 
"{524F4F0C-6E7B-4DE5-BBB1-2C5736ECBDF9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5F7FBE2B-408F-4673-9128-F22DBBE67577}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{63BAD6A4-2A4F-4AED-BFC1-B775E94609B8}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{655FD1E7-D879-4749-874E-FF4F8AE7E57A}" = rport=139 | protocol=6 | dir=out | app=system | 
"{71AE6103-05BC-42F6-A10F-457EA0476203}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{72EB98F1-5BA8-49DF-B731-699812F13096}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7E25AAAB-4831-40A8-9BF5-C07B1B17CDAF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{88105B43-E9DC-4ADA-89BC-16633C4EE170}" = lport=138 | protocol=17 | dir=in | app=system | 
"{8983D5C0-C1A8-4014-A939-D2CB16E7F3A7}" = rport=138 | protocol=17 | dir=out | app=system | 
"{8D96AD20-E118-4C3B-9EA1-FBE9A0934F9B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{9C25605F-789C-4574-80C7-4ABE0D5550F4}" = rport=137 | protocol=17 | dir=out | app=system | 
"{AB9AF41E-7DC3-4FE3-8536-A1C39A62783A}" = lport=139 | protocol=6 | dir=in | app=system | 
"{B12AB890-31EC-4F51-A8C0-B4DDD2DB887F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B7B7C5E2-725E-4F31-8A4F-01200F56C9DC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{BB522A55-F235-48DF-ADD1-E3B00FEF665B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C3A4834B-F9D2-4C87-9B91-A3720D35B413}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{F01E8167-6E32-4338-AB46-8F07F7CDF761}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FDA42B4B-D5A7-4197-8264-5CCAC11981F1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0357AA0A-FADA-4C78-8A80-3539F57CE854}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{073E53B5-256D-476F-966C-C1B7085EE002}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{073FE39F-D86E-4D35-915A-26C3EA7EFFB0}" = protocol=6 | dir=in | app=c:\program files\thq\company of heroes\reliccoh.exe | 
"{0FCE3CD2-E8F5-439E-906D-254173E84022}" = protocol=6 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{2180499F-63BC-47F2-9D80-02C66E1E5A95}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{27949EDC-3E06-4D11-BE02-5DD019A6B1BE}" = protocol=17 | dir=in | app=c:\pacsteamt\steam.exe | 
"{2AA1CE90-534C-4085-A1B9-2940643FCB1A}" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe | 
"{2B202851-220F-4866-B8BE-E0B98302449B}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{4C17AF65-8FF8-4EF6-875A-A89D5E2026C5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4D74C6AE-908E-4DFF-9F4E-5A46A06F6237}" = protocol=17 | dir=in | app=c:\program files\electronic arts\die schlacht um mittelerde ii\game.dat | 
"{54D952CF-3315-4588-B0D3-0ED58726340E}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{59A2551D-0588-4DFA-9776-BE719F5D91AD}" = protocol=17 | dir=in | app=c:\program files\thq\company of heroes\reliccoh.exe | 
"{5FEA9940-D58E-4F1C-AF73-19671112D433}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\supreme commander\bin\supremecommander.exe | 
"{6E4426F6-9EF8-4FC9-AC72-08CEA14BBCB6}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{71319406-C7B4-4297-8FAD-B0A7AF4D8A80}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{74513FB1-C7E1-46FB-BCCF-74D4C4D8F7F2}" = protocol=6 | dir=out | app=system | 
"{74B3F79F-7EC4-4510-8B2E-2BCBF915AB19}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7F1B33D4-2AE7-4DA3-9DA5-52D55A7EB4B6}" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe | 
"{93C20106-9921-4A67-96B2-644EEF80B429}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{94427E02-DE29-4CF1-BDDC-57F65D242200}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\supreme commander\bin\supremecommander.exe | 
"{9752107C-03EE-4FC6-8AE0-50E72AF7DDDE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{A41C9B74-0033-4175-9A78-84EE2A45BC3E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{A4503D62-5679-4CB2-8809-FD14382E348E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A4A07909-E12A-4A66-A97C-A85BBEDF5197}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B3DC0082-F69E-4F3C-9EC9-5DA42B159DFF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B9C2F5F5-1A93-43D0-BFC2-87EF5790E88F}" = protocol=17 | dir=in | app=c:\program files\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{C264B235-4920-4079-B0C7-4CE3B4104ABE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{C79C7648-7F62-45CD-89A5-F817BF50042F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CBC82D2C-BB05-4762-8C55-2D7FF2987A75}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{CD56161E-5DD7-4E0E-85FB-1F3690186F7C}" = protocol=17 | dir=in | app=c:\pacsteamt\steamapps\destinywarrior15\counter-strike\hl.exe | 
"{D45C6BD7-07AB-4915-B87F-7911695B2BB8}" = protocol=6 | dir=in | app=c:\program files\electronic arts\die schlacht um mittelerde ii\game.dat | 
"{D506C655-938A-477F-B92E-711FDACD5BCD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{EABF45D8-DC41-4433-8F78-F51854805240}" = protocol=6 | dir=in | app=c:\pacsteamt\steamapps\destinywarrior15\counter-strike\hl.exe | 
"{EE9F0241-AD39-40D8-AE64-2D4A57DA3294}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe | 
"{F08DD717-5CEC-48CC-BBD5-FE3EE36A970C}" = protocol=6 | dir=in | app=c:\pacsteamt\steam.exe | 
"{F13FD812-2202-4530-B742-253835CC4EAF}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe | 
"{F8665CCE-5D0C-492E-9C33-D9AC58AC3413}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{FC0B624A-CAEF-4407-8531-2A044377ACDE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{0076B6A9-5A54-45E7-8B2A-9F3E9F02D4EA}C:\program files\jdownloader\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\jdownloader\jre\bin\javaw.exe | 
"TCP Query User{01361E3B-42FE-4030-8502-35AD4B118E8A}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe | 
"TCP Query User{38762574-7B9E-4DC6-9235-AEFB590FEF5E}C:\users\acer\desktop\counter.strike.source.2010.orange.box.nosteam.[setti]\counter strike source 2010\hl2.exe" = protocol=6 | dir=in | app=c:\users\acer\desktop\counter.strike.source.2010.orange.box.nosteam.[setti]\counter strike source 2010\hl2.exe | 
"TCP Query User{45A082A5-9386-41AE-97D2-CF81FD3435DC}E:\pc spiele\steamless left4dead2 pack\left4dead2.exe" = protocol=6 | dir=in | app=e:\pc spiele\steamless left4dead2 pack\left4dead2.exe | 
"TCP Query User{C6671684-4FBB-479A-9A97-55DF2AE2EF75}C:\program files\fifa 12\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\fifa 12\game\fifa.exe | 
"TCP Query User{F6112FC1-D343-47FC-B479-52BBA9C78C98}C:\program files\thq\company of heroes\reliccoh.exe" = protocol=6 | dir=in | app=c:\program files\thq\company of heroes\reliccoh.exe | 
"UDP Query User{1A07457A-FAEF-4978-A4AF-BD58C8315BB0}C:\program files\fifa 12\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\fifa 12\game\fifa.exe | 
"UDP Query User{2381ACD2-3139-4B2C-BC6D-B0C184F602FC}C:\program files\jdownloader\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\jdownloader\jre\bin\javaw.exe | 
"UDP Query User{50ADCAD6-93DC-472A-AD10-D7E80FA94511}C:\users\acer\desktop\counter.strike.source.2010.orange.box.nosteam.[setti]\counter strike source 2010\hl2.exe" = protocol=17 | dir=in | app=c:\users\acer\desktop\counter.strike.source.2010.orange.box.nosteam.[setti]\counter strike source 2010\hl2.exe | 
"UDP Query User{61D2E149-7990-4535-9E96-EB630D65C05D}E:\pc spiele\steamless left4dead2 pack\left4dead2.exe" = protocol=17 | dir=in | app=e:\pc spiele\steamless left4dead2 pack\left4dead2.exe | 
"UDP Query User{9E4689AC-511D-484E-831B-58247C39BA06}C:\program files\thq\company of heroes\reliccoh.exe" = protocol=17 | dir=in | app=c:\program files\thq\company of heroes\reliccoh.exe | 
"UDP Query User{A3C593D9-E1AA-4619-9B8D-9F2BF0261965}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1057511B-F8FE-4230-9ED3-AB949A57EE4A}" = Windows Live PIMT Platform
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{19B35770-32DC-493D-8992-1BDC6A9B19DD}" = S4 League_EU
"{20ADC09F-B0AF-4868-85A5-45B972DC4082}_is1" = Windows Movie Maker Enhancement Pack 2010
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{29315CEC-E6CE-4394-84DC-6F862E8D9A52}" = Windows Live UX Platform
"{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}" = Die Schlacht um Mittelerde™ II
"{2FAFE37E-D796-47B8-BA8F-D09819B12DF6}" = Windows Live Essentials
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.100
"{35E583DD-5C66-46B4-ADA2-C22640D4B54D}" = Snap.Do
"{3BBFD444-5FAB-49F6-98B1-A1954E831399}" = Die Sims™ 3 Showtime
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = Die Sims™ 3 Late Night
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F9A382F-4478-4036-905C-F77DF2EA0370}" = Windows Live SOXE
"{4FA8F084-C42F-45E1-B7E5-E0C8A1083DC5}" = Windows Live SOXE Definitions
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{618F39BD-9720-47CF-A89C-108AB41B1493}" = Windows Live UX Platform Language Pack
"{62813F65-4D78-43AF-A53C-DFAFA122E065}" = Windows Live Messenger
"{64DF7404-9D46-44AF-AFA1-A2F8D5648C2D}" = Windows Live Photo Common
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{6D592E30-11EC-11E0-859C-0013D3D69929}" = Vegas Pro 10.0
"{6F1242A4-9B11-46D2-B891-E3A53724A1A2}" = S4 League_EU
"{7032B400-11EC-11E0-A9BF-0013D3D69929}" = MSVCRT Redists
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EE8FE7-1957-4C51-9074-4930A8CFB1AF}" = Windows Live Installer
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{7F682A00-6497-4551-A2A6-063AE667D1CF}" = Movie Maker
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{8256F87F-8554-4457-8C3D-3F3324697D9F}" = Windows Live ID Sign-in Assistant
"{84BEAA30-1AF1-450B-9DD7-AD38B84004BA}" = Windows Live Messenger
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{9B2E55F8-5BA8-4A45-9682-ACB6F2CC0DA5}" = Photo Gallery
"{B19E03EA-067C-412F-A81E-271720E601AB}" = Fotogalerie
"{B27FA0A3-D80F-41A9-8BAD-C5F2D859AB22}" = Photo Common
"{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}" = Die Sims™ 3 Supernatural
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{BA73469B-D8C7-4FE3-B33C-1340D09F0709}" = Windows Live Communications Platform
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C194D333-B84A-4BB7-B35E-060732D98DC4}" = GPGNet
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D71BC54E-A4E6-4E06-866C-FD6EE16EA187}" = Movie Maker
"{DDA3C325-47B2-4730-9672-BF3771C08799}_is1" = XMedia Recode Version 3.1.1.8
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = Die Sims™ 3 Lebensfreude
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Ashampoo ClipFinder HD_is1" = Ashampoo ClipFinder HD v.2.2.7
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"BitComet" = BitComet 1.33
"CCleaner" = CCleaner
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"Cheatbook Database 2009" = Cheatbook Database 2009
"Company of Heroes" = Company of Heroes
"DAEMON Tools Lite" = DAEMON Tools Lite
"DVDVideoSoftTB_DE Toolbar" = DVDVideoSoftTB DE Toolbar
"FIFA 12 (c) EA_is1" = FIFA 12 (c) EA version 1
"Free Studio_is1" = Free Studio version 5.6.3.706
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"GIMP-2_is1" = GIMP 2.8.0
"incredibar" = Incredibar Toolbar  on IE
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"ManyCam" = ManyCam 3.0.80 (remove only)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Steam App 10" = Counter-Strike
"Steam App 240" = Counter-Strike: Source
"uTorrent" = µTorrent
"VLC media player" = VLC media player 2.0.3
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{25A1E6A4-2DBD-4AC0-8650-8EA9A45B183D}" = Supreme Commander
"{31D95937-B237-405D-920C-A3EF4E482395}" = Supreme Commander - Forged Alliance
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 11.09.2012 11:59:27 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dolphin.exe, Version: 0.0.0.0, Zeitstempel:
 0x4e042bde  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00000280  ID des fehlerhaften Prozesses:
 0x668  Startzeit der fehlerhaften Anwendung: 0x01cd9036587557d9  Pfad der fehlerhaften
 Anwendung: C:\Users\Acer\Desktop\Spiele\Emulatoren\Dolphin\dolphin-3.0-win32\Dolphin.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: a99e066c-fc29-11e1-ae1b-00262d68d070
 
Error - 11.09.2012 11:59:29 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dolphin.exe, Version: 0.0.0.0, Zeitstempel:
 0x4e042bde  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00000000  ID des fehlerhaften Prozesses:
 0x668  Startzeit der fehlerhaften Anwendung: 0x01cd9036587557d9  Pfad der fehlerhaften
 Anwendung: C:\Users\Acer\Desktop\Spiele\Emulatoren\Dolphin\dolphin-3.0-win32\Dolphin.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: aac39ef8-fc29-11e1-ae1b-00262d68d070
 
Error - 12.09.2012 10:37:38 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dolphin.exe, Version: 0.0.0.0, Zeitstempel:
 0x4e042bde  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0x80000003  Fehleroffset: 0x1428a865  ID des fehlerhaften Prozesses:
 0xc8c  Startzeit der fehlerhaften Anwendung: 0x01cd90f21fbd41aa  Pfad der fehlerhaften
 Anwendung: C:\Users\Acer\Desktop\Spiele\Emulatoren\Dolphin\dolphin-3.0-win32\Dolphin.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 65e20e37-fce7-11e1-beef-00262d68d070
 
Error - 12.09.2012 10:43:56 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dolphin.exe, Version: 0.0.0.0, Zeitstempel:
 0x4e042bde  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x164b8840  ID des fehlerhaften Prozesses:
 0xe40  Startzeit der fehlerhaften Anwendung: 0x01cd90f42d00e72c  Pfad der fehlerhaften
 Anwendung: C:\Users\Acer\Desktop\Spiele\Emulatoren\Dolphin\dolphin-3.0-win32\Dolphin.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 470a6be8-fce8-11e1-beef-00262d68d070
 
Error - 12.09.2012 12:01:40 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: game.dat, Version: 1.6.2429.30210,
 Zeitstempel: 0x45185e33  Name des fehlerhaften Moduls: game.dat, Version: 1.6.2429.30210,
 Zeitstempel: 0x45185e33  Ausnahmecode: 0xc0000005  Fehleroffset: 0x009a4006  ID des fehlerhaften
 Prozesses: 0xa9c  Startzeit der fehlerhaften Anwendung: 0x01cd90ff8a96a98d  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Electronic Arts\Die Schlacht um Mittelerde
 II\game.dat  Pfad des fehlerhaften Moduls: C:\Program Files\Electronic Arts\Die Schlacht
 um Mittelerde II\game.dat  Berichtskennung: 230bfc24-fcf3-11e1-beef-00262d68d070
 
Error - 12.09.2012 12:12:02 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: game.dat, Version: 1.6.2429.30210,
 Zeitstempel: 0x45185e33  Name des fehlerhaften Moduls: game.dat, Version: 1.6.2429.30210,
 Zeitstempel: 0x45185e33  Ausnahmecode: 0xc0000005  Fehleroffset: 0x009a4017  ID des fehlerhaften
 Prozesses: 0x788  Startzeit der fehlerhaften Anwendung: 0x01cd91010bc8f8ac  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Electronic Arts\Die Schlacht um Mittelerde
 II\game.dat  Pfad des fehlerhaften Moduls: C:\Program Files\Electronic Arts\Die Schlacht
 um Mittelerde II\game.dat  Berichtskennung: 95c4fe81-fcf4-11e1-beef-00262d68d070
 
Error - 12.09.2012 16:40:07 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dolphin.exe, Version: 0.0.0.0, Zeitstempel:
 0x4e042bde  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0x80000003  Fehleroffset: 0x14bf405d  ID des fehlerhaften Prozesses:
 0x1178  Startzeit der fehlerhaften Anwendung: 0x01cd91220fd57f96  Pfad der fehlerhaften
 Anwendung: C:\Users\Acer\Desktop\Spiele\Emulatoren\Dolphin\dolphin-3.0-win32\Dolphin.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 093aa511-fd1a-11e1-beef-00262d68d070
 
Error - 13.09.2012 14:31:55 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: S4Client.exe, Version: 0.8.32.56067,
 Zeitstempel: 0x503707fe  Name des fehlerhaften Moduls: S4Client.exe, Version: 0.8.32.56067,
 Zeitstempel: 0x503707fe  Ausnahmecode: 0xc0000005  Fehleroffset: 0x008c3600  ID des fehlerhaften
 Prozesses: 0xf1c  Startzeit der fehlerhaften Anwendung: 0x01cd91de0aee3fd4  Pfad der
 fehlerhaften Anwendung: C:\Program Files\alaplaya\S4League\S4Client.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files\alaplaya\S4League\S4Client.exe  Berichtskennung:
 4abc62ca-fdd1-11e1-a9d5-00262d68d070
 
Error - 14.09.2012 07:21:24 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: S4Client.exe, Version: 0.8.32.56067,
 Zeitstempel: 0x503707fe  Name des fehlerhaften Moduls: S4Client.exe, Version: 0.8.32.56067,
 Zeitstempel: 0x503707fe  Ausnahmecode: 0xc0000005  Fehleroffset: 0x008c3600  ID des fehlerhaften
 Prozesses: 0xd24  Startzeit der fehlerhaften Anwendung: 0x01cd926b0fd7cf3c  Pfad der
 fehlerhaften Anwendung: C:\Program Files\alaplaya\S4League\S4Client.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files\alaplaya\S4League\S4Client.exe  Berichtskennung:
 50d1629e-fe5e-11e1-8d0b-00262d68d070
 
Error - 14.09.2012 18:49:04 | Computer Name = Acer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: S4Client.exe, Version: 0.8.32.56067,
 Zeitstempel: 0x503707fe  Name des fehlerhaften Moduls: S4Client.exe, Version: 0.8.32.56067,
 Zeitstempel: 0x503707fe  Ausnahmecode: 0xc0000005  Fehleroffset: 0x008c3600  ID des fehlerhaften
 Prozesses: 0x8f8  Startzeit der fehlerhaften Anwendung: 0x01cd92cb21645470  Pfad der
 fehlerhaften Anwendung: C:\Program Files\alaplaya\S4League\S4Client.exe  Pfad des
 fehlerhaften Moduls: C:\Program Files\alaplaya\S4League\S4Client.exe  Berichtskennung:
 61ca5280-febe-11e1-bdb0-00262d68d070
 
[ System Events ]
Error - 12.09.2012 08:18:05 | Computer Name = Acer-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 12.09.2012 08:18:06 | Computer Name = Acer-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 12.09.2012 08:18:06 | Computer Name = Acer-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 12.09.2012 08:18:07 | Computer Name = Acer-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 13.09.2012 06:36:57 | Computer Name = Acer-PC | Source = bowser | ID = 8003
Description = 
 
Error - 13.09.2012 12:19:09 | Computer Name = Acer-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Akamai NetSession Interface" ist als interaktiver Dienst
 gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste
 nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 
Error - 14.09.2012 07:21:36 | Computer Name = Acer-PC | Source = bowser | ID = 8003
Description = 
 
Error - 14.09.2012 18:20:45 | Computer Name = Acer-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?15.?09.?2012 um 00:19:44 unerwartet heruntergefahren.
 
Error - 14.09.2012 18:23:58 | Computer Name = Acer-PC | Source = bowser | ID = 8003
Description = 
 
Error - 15.09.2012 10:31:09 | Computer Name = Acer-PC | Source = bowser | ID = 8003
Description = 
 
 
< End of report >
         

--- --- ---



Hoffe es hilft

hi

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.