mail delivery failed: returning message to sender web.de acount jetzt ich auch :-(

OTL logfile created on: 18.09.2012 21:13:54 - Run 1
OTL by OldTimer - Version 3.2.63.0     Folder = C:\Users\Pantzenhag\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,49 Gb Available Physical Memory | 49,58% Memory free
3,30 Gb Paging File | 1,39 Gb Available in Paging File | 42,19% Paging File free
Paging file location(s): c:\pagefile.sys 16 4605 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,62 Gb Total Space | 330,50 Gb Free Space | 72,54% Space Free | Partition Type: NTFS
Drive D: | 10,13 Gb Total Space | 0,96 Gb Free Space | 9,43% Space Free | Partition Type: NTFS
Drive J: | 465,76 Gb Total Space | 104,34 Gb Free Space | 22,40% Space Free | Partition Type: NTFS
 
Computer Name: PANTZENHAG-PC | User Name: Pantzenhag | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Pantzenhag\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
PRC - C:\Programme\AVG Secure Search\vprot.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
PRC - C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
PRC - C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Common Files\AVG Secure Search\DNTInstaller\12.2.6\avgdttbx.dll ()
MOD - C:\Programme\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\SiteSafety.dll ()
MOD - C:\Programme\AVG Secure Search\vprot.exe ()
MOD - C:\Programme\Evernote\Evernote\libtidy.dll ()
MOD - C:\Programme\Evernote\Evernote\libxml2.dll ()
MOD - C:\Programme\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater12.2.6) -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (TeamViewer7) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (KUSBusByTCPMasterBus) -- C:\Windows\System32\drivers\KUSBusByTCPMasterBus.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (KUSBusByTCP) -- C:\Windows\System32\drivers\KUSBusByTCP.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (CXAVSAUD) -- C:\Windows\System32\drivers\pvavsaud.sys (Conexant Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2431}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=431&sr=0&q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=hp
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 E6 EA 42 28 D8 CC 01  [binary data]
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\..\SearchScopes\{EAFBED9A-2401-46FA-9194-76588D01E9DC}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1865359597-145952119-466221636-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.roboform.com"
FF - prefs.js..extensions.enabledAddons: avg@toolbar:12.2.5.32
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.1
FF - prefs.js..keyword.URL: "https://isearch.avg.com/search?cid=%7B7131ced0-42e1-4d99-8738-6c52e23cc9cc%7D&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&ds=od011&v=12.2.5.32&lang=de&pr=sa&d=2012-07-20%2008%3A36%3A59&sap=ku&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.32\ [2012.08.30 18:44:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2012.09.18 20:33:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.07 21:00:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.07 21:00:52 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.07 21:00:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.07 21:00:52 | 000,000,000 | ---D | M]
 
[2012.03.22 18:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\Extensions
[2012.09.16 12:41:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\Firefox\Profiles\1km3j40h.default\extensions
[2011.12.11 19:54:26 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\Firefox\Profiles\1km3j40h.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.25 09:47:58 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.16 12:41:34 | 000,270,876 | ---- | M] () (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012.01.21 22:27:56 | 000,002,342 | ---- | M] () -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\searchplugins\icq-search.xml
[2012.02.03 06:35:38 | 000,000,950 | ---- | M] () -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\searchplugins\icqplugin.xml
[2012.03.22 16:33:08 | 000,002,519 | ---- | M] () -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\searchplugins\Search_Results.xml
[2012.09.07 21:00:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.08.30 18:44:29 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\PROGRAMDATA\AVG SECURE SEARCH\12.2.5.32
[2012.09.07 21:00:56 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.22 21:37:58 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.12.31 07:14:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 18:44:16 | 000,003,771 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.08.30 06:22:36 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.12.31 07:14:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.31 07:14:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.22 16:33:08 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2011.12.31 07:14:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.31 07:14:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1865359597-145952119-466221636-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Control Center] C:\Program Files\Digitus\MFP Server Control Center\Control Center.exe ()
O4 - HKLM..\Run: [ROC_ROC_JULY_P1] C:\Program Files\AVG Secure Search\ROC_ROC_JULY_P1.exe ()
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-1865359597-145952119-466221636-1000..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKU\S-1-5-21-1865359597-145952119-466221636-1000..\Run: [MobileDocuments] C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-21-1865359597-145952119-466221636-1000..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1865359597-145952119-466221636-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Pantzenhag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\Pantzenhag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: RF - Formular ausfüllen - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RF - Formular speichern - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: RF - Menü anpassen - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: RF - RoboForm-Leiste ein/aus - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - Formular ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - Formular speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - RoboForm-Leiste ein/aus - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{667B7524-13E2-4560-8299-05670171954C}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{667B7524-13E2-4560-8299-05670171954C}: NameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.18 21:12:40 | 000,600,576 | ---- | C] (OldTimer Tools) -- C:\Users\Pantzenhag\Desktop\OTL.exe
[2012.09.18 20:37:55 | 000,000,000 | ---D | C] -- C:\Users\Pantzenhag\AppData\Roaming\RoboForm
[2012.09.18 20:33:33 | 000,000,000 | ---D | C] -- C:\ProgramData\RoboForm
[2012.09.18 20:33:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
[2012.09.18 20:30:55 | 000,000,000 | ---D | C] -- C:\Users\Pantzenhag\Documents\My RoboForm Data
[2012.09.18 20:30:07 | 000,000,000 | ---D | C] -- C:\Program Files\Siber Systems
[2012.09.12 17:43:23 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\RNDISMP.sys
[2012.09.12 17:43:18 | 000,240,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2012.09.12 17:43:18 | 000,187,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2012.09.12 17:43:17 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2012.09.07 21:00:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.18 21:12:47 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Users\Pantzenhag\Desktop\OTL.exe
[2012.09.18 20:51:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.18 20:28:05 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.18 20:28:05 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.18 20:28:05 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.18 20:28:05 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.18 17:41:58 | 000,020,272 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.18 17:41:58 | 000,020,272 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.18 17:34:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.18 17:34:14 | 2414,731,264 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.16 20:37:09 | 002,490,368 | ---- | M] () -- C:\Users\Pantzenhag\Documents\Ebay.accdb
[2012.09.09 13:05:35 | 000,002,707 | ---- | M] () -- C:\Users\Pantzenhag\Desktop\images.jpg
[2012.09.04 22:21:49 | 004,587,520 | ---- | M] () -- C:\Users\Pantzenhag\Documents\Ebay_Backup.accdb
[2012.08.30 18:44:20 | 000,027,496 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.08.27 06:33:25 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.08.27 06:33:25 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.08.22 19:16:46 | 000,240,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2012.08.22 19:16:36 | 000,187,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.09 13:05:34 | 000,002,707 | ---- | C] () -- C:\Users\Pantzenhag\Desktop\images.jpg
[2012.09.08 07:32:41 | 004,587,520 | ---- | C] () -- C:\Users\Pantzenhag\Documents\Ebay_Backup.accdb
[2012.07.23 09:03:40 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2012.07.23 09:03:40 | 000,240,640 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2012.03.16 06:21:16 | 000,000,101 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.02.18 12:34:13 | 000,284,160 | ---- | C] () -- C:\Windows\unin0407.exe
[2012.02.09 21:05:44 | 000,416,064 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2012.02.04 12:48:05 | 000,005,093 | ---- | C] () -- C:\ProgramData\etgxespc.rpo
[2012.02.04 11:15:48 | 000,004,151 | ---- | C] () -- C:\ProgramData\hnbdehzc.pfe
[2012.01.21 16:42:55 | 000,004,096 | -H-- | C] () -- C:\Users\Pantzenhag\AppData\Local\keyfile3.drm
[2012.01.08 18:40:20 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2012.01.08 10:25:13 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.01.07 10:43:12 | 000,000,583 | ---- | C] () -- C:\Windows\wiso.ini
[2012.01.05 14:39:40 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.01.05 14:39:40 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.12.17 09:07:53 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.12 03:30:05 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 03:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 03:30:05 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 03:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
 
========== ZeroAccess Check ==========
 
[2012.08.30 18:44:29 | 000,000,000 | ---D | M] -- C:\Windows\Temp\avg@toolbar
[2012.08.30 18:44:29 | 000,000,000 | ---D | M] -- C:\Windows\Temp\avg@toolbar\chrome
[2012.08.30 18:44:29 | 000,000,000 | ---D | M] -- C:\Windows\Temp\avg@toolbar\components
[2012.08.30 18:44:29 | 000,000,000 | ---D | M] -- C:\Windows\Temp\avg@toolbar\locale
[2012.08.30 18:44:29 | 000,000,000 | ---D | M] -- C:\Windows\Temp\avg@toolbar\modules
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
========== LOP Check ==========
 
[2012.02.18 19:00:51 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Alawar Entertainment
[2012.04.05 20:31:20 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Auslogics
[2012.01.07 22:53:36 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\BOM
[2012.01.06 15:31:27 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Buhl Data Service
[2012.01.06 15:31:21 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Buhl Data Service GmbH
[2012.07.01 18:19:20 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\de.esells.iSQuitchLite
[2012.05.18 19:00:21 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoft
[2011.12.11 19:54:25 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.10 12:54:41 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\HandBrake
[2012.01.22 12:09:36 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\ICQ
[2011.12.17 14:29:38 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Meridian93
[2012.02.04 13:14:05 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Need4Video
[2012.07.19 18:42:51 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\OpenCandy
[2012.07.19 18:46:49 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\pdfforge
[2012.07.28 21:17:24 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\ProtectDISC
[2012.09.18 20:37:55 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\RoboForm
[2012.01.14 13:56:38 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\TeamViewer
[2012.09.02 08:43:24 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:4C21784C
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:CB0FEE2B
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:1B9E79B3
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:B1FBBD09
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:E6537A16
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:F98E6C67

< End of report >
         

OTL Extras logfile created on: 18.09.2012 21:13:55 - Run 1
OTL by OldTimer - Version 3.2.63.0     Folder = C:\Users\Pantzenhag\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,49 Gb Available Physical Memory | 49,58% Memory free
3,30 Gb Paging File | 1,39 Gb Available in Paging File | 42,19% Paging File free
Paging file location(s): c:\pagefile.sys 16 4605 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,62 Gb Total Space | 330,50 Gb Free Space | 72,54% Space Free | Partition Type: NTFS
Drive D: | 10,13 Gb Total Space | 0,96 Gb Free Space | 9,43% Space Free | Partition Type: NTFS
Drive J: | 465,76 Gb Total Space | 104,34 Gb Free Space | 22,40% Space Free | Partition Type: NTFS
 
Computer Name: PANTZENHAG-PC | User Name: Pantzenhag | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1865359597-145952119-466221636-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07FEB9DF-4176-4E95-9347-C6EA0C7D7E9B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{0976C76C-7A1C-48F4-9788-332CEB5E7618}" = lport=138 | protocol=17 | dir=in | app=system | 
"{11C79D14-2555-4514-B108-FCF57819C4BC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{2870E06B-A1A8-45D3-870A-878FF99E8FA5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{388BEE9E-98D6-48BA-93E8-52ECCA295A93}" = lport=445 | protocol=6 | dir=in | app=system | 
"{40DFA07B-0248-464E-A5D4-EDF9F40B6E99}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4E1950E4-6085-49C1-8CBA-A8DDA1F2FD4B}" = rport=137 | protocol=17 | dir=out | app=system | 
"{52700588-FC08-42F3-AF56-A53E953E1C77}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{587CCCA4-222E-471B-957A-62D2C5F16742}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{5CB45205-9362-4F06-87B0-66F91CC95EE8}" = lport=139 | protocol=6 | dir=in | app=system | 
"{62ADA832-AA69-4A73-9888-39AF23BCBDA6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{6701FA37-2A86-430D-AB39-33278EC223F3}" = rport=139 | protocol=6 | dir=out | app=system | 
"{87AE3FBA-3B12-492C-808F-136B64BE9ACD}" = lport=137 | protocol=17 | dir=in | app=system | 
"{88260F09-0DD4-46EC-BFD8-2990D023568E}" = rport=138 | protocol=17 | dir=out | app=system | 
"{9A3DF15C-6BE9-45D0-B060-BB1181D46B47}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9F757940-4A83-4BC5-A148-6EA211BF26DE}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A4CB86D0-A4BC-4F98-91B4-72FCA6C1EC46}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{AEC49948-05BC-4C6E-A572-910B3DBCDE98}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B312401E-2D83-43AC-85E1-BA5D3A31CDE4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B6FF2AEE-B993-404B-87C9-424CA563F54D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B7900F70-C194-4862-AF87-01CD046B5CA6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{BAE9944B-3A10-46A6-B9A7-9E82777112F8}" = lport=7303 | protocol=17 | dir=in | name=control center udp port | 
"{BD60CA44-1742-4C9A-8E04-776BDF12B550}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C5B8E01D-340E-4F94-88AF-A13D000FE28F}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{ED6B2ED2-2205-4396-BAD6-BF48E8D40FBB}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FA566890-4927-4AF0-A4DF-4B4951B3B88E}" = lport=3306 | protocol=6 | dir=in | name=mysql | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03E2A668-D39A-4461-BF76-6D4DDFD1C5AC}" = protocol=17 | dir=in | app=c:\program files\digitus\mfp server control center\control center.exe | 
"{08673840-F549-4135-A97F-F95DF8512680}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{08D68B41-14D3-4A7F-90E7-98F9ACDFCA4E}" = protocol=17 | dir=in | app=c:\program files\agrar simulator 2012\farm2012.dll | 
"{0B729355-7B44-4F56-85C6-7092BF920128}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0C44F0C8-0626-4582-96FC-F2F148B62035}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{10C17B47-240D-4493-AD7E-B377F786C72F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{14066A5D-5F2C-434D-9C2C-6C9AD0038E6D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{1F6B686F-FD0E-40B6-ADAB-9583DD915924}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{23CFB636-AD77-48A5-8038-F4C803395207}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe | 
"{2551D420-5A43-4A20-89B9-B7EDDB446A92}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{31135ED5-7262-4106-9816-AD148AE22B14}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{3D5268C5-1210-45DF-BAF1-77F9CF1F4A0E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3D7B0B47-701D-4E67-B7A4-BB898040EC2A}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe | 
"{41A6EC1E-1A27-4CE1-8A4E-368748096284}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{50040DF0-E6F2-4BC5-B50F-5947C40E82E3}" = protocol=6 | dir=in | app=c:\program files\digitus\mfp server control center\control center.exe | 
"{544330FF-BAD1-41E0-8D79-A3F1048C8138}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{609ED917-301B-4C10-81CB-7EEB28BF4209}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{6CD5B125-3B5C-4706-9CBD-981BFE0509D3}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{748428FF-95BA-44BC-A53C-F4D2A35756EA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe | 
"{832A7887-7B79-49E4-AB0C-11E5246B3D6E}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe | 
"{851D1495-92D9-4002-ABA4-1B44CD86A848}" = protocol=6 | dir=out | app=system | 
"{863FC768-7FBB-4325-89B9-213270B3B0B3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8F38F5F6-B17A-4662-9C51-6F40784F0E88}" = protocol=6 | dir=in | app=c:\program files\agrar simulator 2012\farm2012.dll | 
"{9038E9F2-2CA8-4C00-986A-71DABD677670}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"{9573C0D1-5CF8-469D-8F50-2DC0EFD4067B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{981BFD7E-7539-4115-8B52-97F974D50936}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A1868A7A-952F-48CB-AC9B-13DAB7CB5780}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"{A7AD3775-519F-4468-9892-C0DFA60125DD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{B8238C1D-61C1-4116-A882-DADAE4C1C209}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{BDECC4C4-051A-4C22-BC8F-349886D9174B}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{C66FF4AF-F943-43C6-A8FC-CD865D47857E}" = protocol=17 | dir=in | app=c:\program files\agrar simulator 2012\iupdate.dll | 
"{CF65D33F-9928-49C6-BCBE-92A25B37706D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DC7246A8-AE35-42D6-8E71-79129E84EF91}" = protocol=6 | dir=in | app=c:\program files\agrar simulator 2012\iupdate.dll | 
"{ECF8D80F-8644-47CE-BA7D-AD10D91F27DD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F8DC9E93-0118-40BD-9A3A-F5791BF0B660}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{FC94416E-90D5-40CA-AA9B-4CC4C6DC9693}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"TCP Query User{49F9BAF4-AAD4-4196-ABC2-CCC6C17C9E0A}C:\program files\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\backgrounddownloader.exe | 
"TCP Query User{785C9F22-62CF-4E47-8B87-075D01236C9A}C:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
"TCP Query User{834105EF-B4F1-4BA9-9D01-97A48B3430D7}C:\program files\digitus\mfp server control center\control center.exe" = protocol=6 | dir=in | app=c:\program files\digitus\mfp server control center\control center.exe | 
"TCP Query User{86ED78BC-92EC-481F-9259-FB8D0DEB9BB2}C:\program files\world of warcraft\launcher.patch.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.patch.exe | 
"TCP Query User{D9528C6A-E199-491E-9D19-04B9614A3A1A}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"UDP Query User{195A6392-006E-4333-AAC6-363E25D8A2EE}C:\program files\world of warcraft\launcher.patch.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.patch.exe | 
"UDP Query User{35915CD9-22C7-469F-A762-162AFB3AA384}C:\program files\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\backgrounddownloader.exe | 
"UDP Query User{49534C81-7DD6-49B4-8B57-0B9087CABB19}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"UDP Query User{52AB99FF-4AD2-4352-A894-1E20AA61EA29}C:\program files\digitus\mfp server control center\control center.exe" = protocol=17 | dir=in | app=c:\program files\digitus\mfp server control center\control center.exe | 
"UDP Query User{6F0853ED-3957-49DB-A000-34BDF2EE7D1F}C:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0BE73D3C-B5AF-11E1-933A-984BE15F174E}" = Evernote v. 4.5.7
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{291D8FE1-ED05-4934-80CE-A5F6B7A8718D}" = MySQL Server 5.1
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{452A1FAC-F5A0-471E-B8AA-F2B0990E18D6}" = Auction Studio
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EAE665D-957A-4D04-9679-3AD582008877}" = NVIDIA PhysX
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{86FA7865-F1BB-4BDA-B296-4120684A692C}" = WISO Mein Geld 2012 Standard
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D8024F1-2945-49A5-9B78-5AB7B11D7942}_is1" = Auslogics Registry Cleaner
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0209
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C299C9CE-54AF-EC9D-0505-3767185FFD87}" = iSQuitchLite
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{D93DC6C0-F88F-4560-94A5-5519FEEB9914}" = Digitus USB MFP Server Control Center
"{DA7DF8E2-4B8F-4286-97FE-DE3FFFE9B728}" = iCloud
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{DF9A6075-9308-4572-8932-A4316243C4D9}" = Brother P-touch Editor 5.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agrar Simulator 2012" = Agrar Simulator 2012
"AI RoboForm" = RoboForm 7-8-2-5 (All Users)
"AnyDVD" = AnyDVD
"Auction Studio" = Auction Studio
"AVG Secure Search" = AVG Security Toolbar
"Avira AntiVir Desktop" = Avira Free Antivirus
"BFGC" = Big Fish Games: Game Manager
"BFG-Farm Frenzy 3" = Farm Frenzy 3
"BFG-Pflanzen gegen Zombies" = Pflanzen gegen Zombies
"BFG-Vampire gegen Zombies" = Vampire gegen Zombies
"CCleaner" = CCleaner
"CloneDVD2" = CloneDVD2
"de.esells.iSQuitchLite" = iSQuitchLite
"Emergency 2012" = Emergency 2012
"Emergency 2012 Demo" = Emergency 2012 Demo
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Studio_is1" = Free Studio version 5.3.5
"Free Video to AppleTV Converter_is1" = Free Video to AppleTV Converter version 5.0.10.423
"InstallShield_{DF9A6075-9308-4572-8932-A4316243C4D9}" = Brother P-touch Editor 5.0
"maxdome - Online Videothek" = maxdome - Online Videothek
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Need4 Video Capture 7" = Need4 Video Capture 7
"Need4 Video Converter 8" = Need4 Video Converter 8
"Need4 Video Editor 1" = Need4 Video Editor 1
"Need4 Video Splitter 7" = Need4 Video Splitter 7
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Revo Uninstaller" = Revo Uninstaller 1.93
"Supreme Auction_is1" = Supreme Auction
"TeamViewer 7" = TeamViewer 7
"Verkehrsplaner - Die Simulation" = Verkehrsplaner - Die Simulation
"WinRAR archiver" = WinRAR Archivierer
"WISO Mein Geld 2012 Standard" = WISO Mein Geld 2012 Standard
"World of Warcraft" = World of Warcraft
"Xvid Video Codec 1.3.1" = Xvid Video Codec
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1865359597-145952119-466221636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 14.09.2012 00:21:55 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 14.09.2012 10:53:09 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 15.09.2012 00:46:42 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 15.09.2012 06:15:06 | Computer Name = Pantzenhag-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 15.0.1.4631,
 Zeitstempel: 0x5047f9c5  Name des fehlerhaften Moduls: xul.dll, Version: 15.0.1.4631,
 Zeitstempel: 0x5047f93b  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0010e567  ID des fehlerhaften
 Prozesses: 0x10f8  Startzeit der fehlerhaften Anwendung: 0x01cd92fd05afe880  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\firefox.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\Mozilla Firefox\xul.dll  Berichtskennung: 37eefcf4-ff1e-11e1-a4a2-001fc639553f
 
Error - 16.09.2012 02:25:36 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.09.2012 06:30:08 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 17.09.2012 00:20:22 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 17.09.2012 11:31:18 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.09.2012 00:06:44 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.09.2012 11:36:02 | Computer Name = Pantzenhag-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 17.02.2012 13:13:41 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 18:13:41 - Fehler beim Herstellen der Internetverbindung.  18:13:41 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 17.02.2012 13:13:53 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 18:13:46 - Fehler beim Herstellen der Internetverbindung.  18:13:46 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 07.05.2012 11:53:09 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 17:52:57 - EpgListing.enc konnte nicht abgerufen werden (Fehler: HTTP-Status
 404: Die angeforderte URL ist auf diesem Server nicht vorhanden.  )  
 
Error - 07.05.2012 12:53:38 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 18:53:30 - EpgListing.enc konnte nicht abgerufen werden (Fehler: HTTP-Status
 404: Die angeforderte URL ist auf diesem Server nicht vorhanden.  )  
 
Error - 16.06.2012 11:40:18 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 17:40:18 - Fehler beim Herstellen der Internetverbindung.  17:40:18 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 16.06.2012 11:40:33 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 17:40:23 - Fehler beim Herstellen der Internetverbindung.  17:40:23 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 11.07.2012 13:33:30 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 19:33:30 - Fehler beim Herstellen der Internetverbindung.  19:33:30 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 11.07.2012 13:34:09 | Computer Name = Pantzenhag-PC | Source = MCUpdate | ID = 0
Description = 19:34:00 - Fehler beim Herstellen der Internetverbindung.  19:34:00 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ OSession Events ]
Error - 05.08.2012 08:42:42 | Computer Name = Pantzenhag-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 2, Application Name: Microsoft Office Access, Application Version:
 12.0.6606.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 17523
 seconds with 360 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
Error - 29.04.2012 08:57:24 | Computer Name = Pantzenhag-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk3\DR3.
 
 
< End of report >
         

OTL logfile created on: 19.09.2012 06:11:31 - Run 3
OTL by OldTimer - Version 3.2.63.0     Folder = C:\Users\Pantzenhag\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,93 Gb Available Physical Memory | 64,42% Memory free
3,30 Gb Paging File | 1,81 Gb Available in Paging File | 54,79% Paging File free
Paging file location(s): c:\pagefile.sys 16 4605 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,62 Gb Total Space | 335,83 Gb Free Space | 73,71% Space Free | Partition Type: NTFS
Drive D: | 10,13 Gb Total Space | 0,96 Gb Free Space | 9,43% Space Free | Partition Type: NTFS
Drive J: | 465,76 Gb Total Space | 104,34 Gb Free Space | 22,40% Space Free | Partition Type: NTFS
 
Computer Name: PANTZENHAG-PC | User Name: Pantzenhag | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Pantzenhag\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
PRC - C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
PRC - C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Evernote\Evernote\libtidy.dll ()
MOD - C:\Programme\Evernote\Evernote\libxml2.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (TeamViewer7) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (KUSBusByTCPMasterBus) -- C:\Windows\System32\drivers\KUSBusByTCPMasterBus.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (KUSBusByTCP) -- C:\Windows\System32\drivers\KUSBusByTCP.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (CXAVSAUD) -- C:\Windows\System32\drivers\pvavsaud.sys (Conexant Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2431}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=431&sr=0&q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 E6 EA 42 28 D8 CC 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}
IE - HKCU\..\SearchScopes\{EAFBED9A-2401-46FA-9194-76588D01E9DC}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.roboform.com"
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.1
FF - prefs.js..keyword.URL: "https://isearch.avg.com/search?cid=%7B7131ced0-42e1-4d99-8738-6c52e23cc9cc%7D&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&ds=od011&v=12.2.5.32&lang=de&pr=sa&d=2012-07-20%2008%3A36%3A59&sap=ku&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2012.09.18 20:33:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.07 21:00:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.07 21:00:52 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.07 21:00:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.07 21:00:52 | 000,000,000 | ---D | M]
 
[2012.03.22 18:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\Extensions
[2012.09.16 12:41:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\Firefox\Profiles\1km3j40h.default\extensions
[2011.12.11 19:54:26 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\Firefox\Profiles\1km3j40h.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.25 09:47:58 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.16 12:41:34 | 000,270,876 | ---- | M] () (No name found) -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012.01.21 22:27:56 | 000,002,342 | ---- | M] () -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\searchplugins\icq-search.xml
[2012.02.03 06:35:38 | 000,000,950 | ---- | M] () -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\searchplugins\icqplugin.xml
[2012.03.22 16:33:08 | 000,002,519 | ---- | M] () -- C:\Users\Pantzenhag\AppData\Roaming\mozilla\firefox\profiles\1km3j40h.default\searchplugins\Search_Results.xml
[2012.09.07 21:00:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.07 21:00:56 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.22 21:37:58 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.12.31 07:14:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 18:44:16 | 000,003,771 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.08.30 06:22:36 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.12.31 07:14:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.31 07:14:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.22 16:33:08 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2011.12.31 07:14:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.31 07:14:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Control Center] C:\Program Files\Digitus\MFP Server Control Center\Control Center.exe ()
O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKCU..\Run: [MobileDocuments] C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Users\Pantzenhag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\Pantzenhag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: RF - Formular ausfüllen - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RF - Formular speichern - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: RF - Menü anpassen - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: RF - RoboForm-Leiste ein/aus - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - Formular ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - Formular speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - RoboForm-Leiste ein/aus - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{667B7524-13E2-4560-8299-05670171954C}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{667B7524-13E2-4560-8299-05670171954C}: NameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.18 22:16:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.09.18 21:28:52 | 000,000,000 | ---D | C] -- C:\Users\Pantzenhag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012.09.18 21:12:40 | 000,600,576 | ---- | C] (OldTimer Tools) -- C:\Users\Pantzenhag\Desktop\OTL.exe
[2012.09.18 20:37:55 | 000,000,000 | ---D | C] -- C:\Users\Pantzenhag\AppData\Roaming\RoboForm
[2012.09.18 20:33:33 | 000,000,000 | ---D | C] -- C:\ProgramData\RoboForm
[2012.09.18 20:33:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
[2012.09.18 20:30:55 | 000,000,000 | ---D | C] -- C:\Users\Pantzenhag\Documents\My RoboForm Data
[2012.09.18 20:30:07 | 000,000,000 | ---D | C] -- C:\Program Files\Siber Systems
[2012.09.07 21:00:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.19 05:51:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.19 05:03:08 | 000,020,272 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.19 05:03:08 | 000,020,272 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.18 21:12:47 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Users\Pantzenhag\Desktop\OTL.exe
[2012.09.18 20:28:05 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.18 20:28:05 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.18 20:28:05 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.18 20:28:05 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.18 17:34:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.18 17:34:14 | 2414,731,264 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.16 20:37:09 | 002,490,368 | ---- | M] () -- C:\Users\Pantzenhag\Documents\Ebay.accdb
[2012.09.09 13:05:35 | 000,002,707 | ---- | M] () -- C:\Users\Pantzenhag\Desktop\images.jpg
[2012.09.04 22:21:49 | 004,587,520 | ---- | M] () -- C:\Users\Pantzenhag\Documents\Ebay_Backup.accdb
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.09 13:05:34 | 000,002,707 | ---- | C] () -- C:\Users\Pantzenhag\Desktop\images.jpg
[2012.09.08 07:32:41 | 004,587,520 | ---- | C] () -- C:\Users\Pantzenhag\Documents\Ebay_Backup.accdb
[2012.07.23 09:03:40 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2012.07.23 09:03:40 | 000,240,640 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2012.03.16 06:21:16 | 000,000,101 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.02.18 12:34:13 | 000,284,160 | ---- | C] () -- C:\Windows\unin0407.exe
[2012.02.09 21:05:44 | 000,416,064 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2012.02.04 12:48:05 | 000,005,093 | ---- | C] () -- C:\ProgramData\etgxespc.rpo
[2012.02.04 11:15:48 | 000,004,151 | ---- | C] () -- C:\ProgramData\hnbdehzc.pfe
[2012.01.21 16:42:55 | 000,004,096 | -H-- | C] () -- C:\Users\Pantzenhag\AppData\Local\keyfile3.drm
[2012.01.08 18:40:20 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2012.01.08 10:25:13 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.01.07 10:43:12 | 000,000,583 | ---- | C] () -- C:\Windows\wiso.ini
[2012.01.05 14:39:40 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.01.05 14:39:40 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.12.17 09:07:53 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.12 03:30:05 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 03:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 03:30:05 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 03:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
========== LOP Check ==========
 
[2012.02.18 19:00:51 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Alawar Entertainment
[2012.04.05 20:31:20 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Auslogics
[2012.01.07 22:53:36 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\BOM
[2012.01.06 15:31:27 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Buhl Data Service
[2012.01.06 15:31:21 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Buhl Data Service GmbH
[2012.09.18 22:06:06 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\de.esells.iSQuitchLite
[2012.05.18 19:00:21 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoft
[2011.12.11 19:54:25 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.10 12:54:41 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\HandBrake
[2012.01.22 12:09:36 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\ICQ
[2011.12.17 14:29:38 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Meridian93
[2012.02.04 13:14:05 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\Need4Video
[2012.07.19 18:42:51 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\OpenCandy
[2012.07.19 18:46:49 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\pdfforge
[2012.07.28 21:17:24 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\ProtectDISC
[2012.09.18 20:37:55 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\RoboForm
[2012.01.14 13:56:38 | 000,000,000 | ---D | M] -- C:\Users\Pantzenhag\AppData\Roaming\TeamViewer
[2012.09.02 08:43:24 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< OTL logfile created on: 18.09.2012 22:27:47 - Run 2 >
 
< OTL by OldTimer - Version 3.2.63.0     Folder = C:\Users\Pantzenhag\Desktop >
 
<  Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation >
 
< Internet Explorer (Version = 9.0.8112.16421) >
 
< Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy >
 
<   >
 
< 3,00 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 60,55% Memory free >
 
< 3,30 Gb Paging File | 1,86 Gb Available in Paging File | 56,16% Paging File free >
 
< Paging file location(s): c:\pagefile.sys 16 4605 [binary data] >
 
<   >
 
< %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files >
 
< Drive C: | 455,62 Gb Total Space | 335,48 Gb Free Space | 73,63% Space Free | Partition Type: NTFS >
 
< Drive D: | 10,13 Gb Total Space | 0,96 Gb Free Space | 9,43% Space Free | Partition Type: NTFS >
 
< Drive J: | 465,76 Gb Total Space | 104,34 Gb Free Space | 22,40% Space Free | Partition Type: NTFS >
 
<   >
 
< Computer Name: PANTZENHAG-PC | User Name: Pantzenhag | Logged in as Administrator. >
 
< Boot Mode: Normal | Scan Mode: Current user >
 
< Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days >
 
<   >
 
< ========== Processes (SafeList) ========== >
Invalid Switch: color]
 
<   >
 
< PRC - C:\Users\Pantzenhag\Desktop\OTL.exe (OldTimer Tools) >
 
< PRC - C:\Programme\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems) >
 
< PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) >
 
< PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) >
 
< PRC - C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) >
 
< PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) >
 
< PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) >
 
< PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) >
 
< PRC - C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) >
 
< PRC - C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) >
 
< PRC - C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) >
 
< PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) >
 
< PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) >
 
< PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) >
 
< PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) >
 
< PRC - C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) >
 
< PRC - C:\Programme\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH) >
 
< PRC - C:\Programme\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH) >
 
< PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) >
 
< PRC - C:\Windows\explorer.exe (Microsoft Corporation) >
 
< PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) >
 
< PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) >
 
< PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) >
 
< PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) >
 
< PRC - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) >
 
< PRC - C:\Programme\Digitus\MFP Server Control Center\Control Center.exe () >
 
<   >
 
<   >
 
< ========== Modules (No Company Name) ========== >
Invalid Switch: color]
 
<   >
 
< MOD - C:\Programme\Evernote\Evernote\libtidy.dll () >
 
< MOD - C:\Programme\Evernote\Evernote\libxml2.dll () >
 
< MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll () >
 
< MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll () >
 
< MOD - C:\Programme\Digitus\MFP Server Control Center\Control Center.exe () >
 
< MOD - C:\Programme\WinRAR\RarExt.dll () >
 
<   >
 
<   >
 
< ========== Services (SafeList) ========== >
Invalid Switch: color]
 
<   >
 
< SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) >
 
< SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) >
 
< SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) >
 
< SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) >
 
< SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) >
 
< SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) >
 
< SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) >
 
< SRV - (TeamViewer7) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) >
 
< SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) >
 
< SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) >
 
< SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) >
 
< SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) >
 
< SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) >
 
< SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) >
 
<   >
 
<   >
 
< ========== Driver Services (SafeList) ========== >
Invalid Switch: color]
 
<   >
 
< DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) >
 
< DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) >
 
< DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.) >
 
< DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) >
 
< DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) >
 
< DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) >
 
< DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) >
 
< DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation) >
 
< DRV - (NVNET) -- C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation) >
 
< DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) >
 
< DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation) >
 
< DRV - (KUSBusByTCPMasterBus) -- C:\Windows\System32\drivers\KUSBusByTCPMasterBus.sys (Windows (R) Codename Longhorn DDK provider) >
 
< DRV - (KUSBusByTCP) -- C:\Windows\System32\drivers\KUSBusByTCP.sys (Windows (R) Codename Longhorn DDK provider) >
 
< DRV - (CXAVSAUD) -- C:\Windows\System32\drivers\pvavsaud.sys (Conexant Systems, Inc.) >
 
<   >
 
<   >
 
< ========== Standard Registry (SafeList) ========== >
Invalid Switch: color]
 
<   >
 
<   >
 
< ========== Internet Explorer ========== >
Invalid Switch: color]
 
<   >
 
< IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} >
 
< IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC >
 
< IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms} >
 
< IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2431}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=431&sr=0&q={searchTerms} >
 
<   >
 
< IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=hp >
Invalid Switch: ?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=hp
 
< IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN >
Invalid Switch: ?ocid=iehp
 
< IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE >
 
< IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 E6 EA 42 28 D8 CC 01  [binary data] >
 
< IE - HKCU\..\URLSearchHook:  - No CLSID value found >
 
< IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} >
 
< IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={936FEEF6-7CB5-44FC-AA9E-93C888E62576}&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&lang=de&ds=od011&pr=sa&d=2012-07-20 08:36:59&v=12.2.5.32&sap=dsp&q={searchTerms} >
 
< IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms} >
 
< IE - HKCU\..\SearchScopes\{EAFBED9A-2401-46FA-9194-76588D01E9DC}: "URL" = hxxp://www.google.de/search?q={searchTerms} >
 
< IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 >
 
< IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local >
 
<   >
 
< ========== FireFox ========== >
Invalid Switch: color]
 
<   >
 
< FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" >
 
< FF - prefs.js..browser.search.order.1: "Search Results" >
 
< FF - prefs.js..browser.search.useDBForOrder: true >
 
< FF - prefs.js..browser.startup.homepage: "hxxp://start.roboform.com" >
 
< FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.1 >
 
< FF - prefs.js..keyword.URL: "https://isearch.avg.com/search?cid=%7B7131ced0-42e1-4d99-8738-6c52e23cc9cc%7D&mid=7ee3b8f0c44f47d0b934d15680ddbccc-1a0f40bb82b00bdc938145096f8d9d49a0ce31eb&ds=od011&v=12.2.5.32&lang=de&pr=sa&d=2012-07-20%2008%3A36%3A59&sap=ku&q=" >
 
<   >
 
<   >
 
< FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll () >
Invalid Switch: FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
 
< FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found >
Invalid Switch: iTunes,version=:  File not found
 
< FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () >
Invalid Switch: iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
 
< FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) >
Invalid Switch: GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
 
< FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) >
Invalid Switch: JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
 
< FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) >
Invalid Switch: NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
 
< FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) >
Invalid Switch: OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
 
< FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) >
Invalid Switch: 3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
 
< FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) >
Invalid Switch: 3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
 
< FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) >
 
<   >
 
< FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2012.09.18 20:33:36 | 000,000,000 | ---D | M] >
 
< FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\ >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:4C21784C
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:CB0FEE2B
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:1B9E79B3
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:B1FBBD09
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:E6537A16
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:F98E6C67

< End of report >