BKA Trojaner v1.15 Windows 7 Pro 32-Bit

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.20.06

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Alexander :: ALEXANDER-PC [Administrator]

20.09.2012 16:37:53
mbam-log-2012-09-20 (16-43-32).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 186540
Laufzeit: 5 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Alexander\AppData\Roaming\hellomoto (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt.

Infizierte Dateien: 2
C:\Users\Alexander\AppData\Roaming\hellomoto\TujP.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt.
C:\Users\Alexander\AppData\Roaming\hellomoto\BukF.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt.

(Ende)
         

OTL logfile created on: 20.09.2012 16:09:24 - Run 4
OTL by OldTimer - Version 3.2.64.0     Folder = C:\Users\Alexander\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,44 Gb Available Physical Memory | 72,59% Memory free
3,98 Gb Paging File | 3,48 Gb Available in Paging File | 87,54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 108,89 Gb Total Space | 1,94 Gb Free Space | 1,78% Space Free | Partition Type: NTFS
Drive D: | 104,51 Gb Total Space | 35,48 Gb Free Space | 33,95% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-PC | User Name: Alexander | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.20 16:06:03 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Alexander\Desktop\OTL.exe
PRC - [2012.09.09 18:09:02 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.09.09 18:09:01 | 002,244,064 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.02.09 02:56:38 | 000,296,448 | ---- | M] () -- C:\Programme\Notepad++\NppShell_04.dll
MOD - [2010.07.04 23:32:38 | 000,010,752 | ---- | M] () -- C:\Programme\Unlocker\UnlockerCOM.dll
MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2012.09.09 18:09:01 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.29 04:09:18 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.06 12:33:20 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.06.05 15:17:44 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.08 09:54:50 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 09:54:49 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.10.27 11:34:30 | 000,718,384 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.06.02 16:58:20 | 000,246,520 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.04.07 20:30:32 | 000,636,192 | ---- | M] (Broadcom Corporation.) [Auto | Stopped] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.05.08 09:54:51 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 09:54:50 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.13 03:32:24 | 002,228,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.16 13:05:55 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.07.04 21:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2009.10.30 14:39:44 | 000,384,576 | ---- | M] (BEHRINGER) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BUSB2902.sys -- (BEHRINGER_2902)
DRV - [2009.10.30 14:39:44 | 000,039,488 | ---- | M] (BEHRINGER) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\busbwdm.sys -- (BUSB_AUDIO_WDM)
DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 00:02:53 | 000,311,296 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009.07.01 12:46:20 | 000,043,944 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2008.08.26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B4 AB 20 72 1E 6D CB 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: groovesharkUnlocker@overlord1337:1.2
FF - prefs.js..extensions.enabledAddons: printpdf@pavlov.net:0.76
FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.3.3
FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.08.07 13:21:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.09 18:09:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.17 16:16:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.06.16 20:57:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.08.18 12:19:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.09 18:09:02 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.17 16:16:59 | 000,000,000 | ---D | M]
 
[2010.12.17 14:29:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\Extensions
[2010.12.17 14:29:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.09.17 03:22:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\Firefox\Profiles\5jd1ozve.default\extensions
[2012.09.17 03:22:35 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Alexander\AppData\Roaming\mozilla\Firefox\Profiles\5jd1ozve.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.04.24 02:33:27 | 000,029,003 | ---- | M] () (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\extensions\groovesharkUnlocker@overlord1337.xpi
[2011.08.11 15:52:19 | 000,009,644 | ---- | M] () (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\extensions\printpdf@pavlov.net.xpi
[2012.07.28 19:49:06 | 000,184,864 | ---- | M] () (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\extensions\stealthyextension@gmail.com.xpi
[2012.09.13 14:21:45 | 000,527,915 | ---- | M] () (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.07.25 06:16:42 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.09.10 16:35:25 | 000,089,388 | ---- | M] () (No name found) -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}.xpi
[2012.04.24 15:14:38 | 000,001,311 | ---- | M] () -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\searchplugins\internet-archive.xml
[2012.03.05 10:34:32 | 000,001,142 | ---- | M] () -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\searchplugins\scroogle.xml
[2012.01.16 00:09:53 | 000,001,032 | ---- | M] () -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\searchplugins\wikipedia-eng.xml
[2011.09.07 00:26:35 | 000,004,140 | ---- | M] () -- C:\Users\Alexander\AppData\Roaming\mozilla\firefox\profiles\5jd1ozve.default\searchplugins\youtube.xml
[2012.09.09 18:08:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.09 18:09:02 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.07.11 23:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.06.27 22:41:55 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 02:49:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.27 22:41:55 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.27 22:41:55 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.27 22:41:55 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.27 22:41:55 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.05.28 00:17:21 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [WatchMyCam]  File not found
O4 - HKCU..\Run: [wwancfg] C:\Users\Alexander\AppData\Local\Microsoft\Windows\4907\wwancfg.exe (IEInspector Software)
O4 - Startup: C:\Users\Alexander\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Alexander\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7F4F9A44-8851-44CD-843C-B2F4E83A83AB}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -  File not found
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -  File not found
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29 - HKLM SecurityProviders - (credssp.dll) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.20 16:05:58 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Alexander\Desktop\OTL.exe
[2012.09.20 15:46:50 | 000,000,000 | ---D | C] -- C:\Users\Alexander\AppData\Roaming\hellomoto
[2012.09.17 16:17:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.09.17 16:16:59 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.09.17 16:16:59 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.09.17 16:16:19 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.09.17 16:16:19 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.09.17 16:16:19 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.09.17 16:15:44 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.09.16 23:13:27 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\utilman.exe
[2012.09.16 07:07:30 | 000,546,816 | ---- | C] (Realtek Semiconductor Corporation                           ) -- C:\Windows\System32\drivers\rtl819xp.sys
[2012.09.16 07:07:30 | 000,027,704 | ---- | C] (SAMSUNG ELECTRONICS) -- C:\Windows\System32\drivers\SABI3.dll
[2012.09.16 07:07:29 | 000,655,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\msvcr90.dll
[2012.09.16 07:07:29 | 000,258,560 | ---- | C] (TODO: <Company name>) -- C:\Windows\System32\drivers\MakeMarkerFile.exe
[2012.09.16 07:07:29 | 000,214,024 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012.09.16 07:07:29 | 000,130,424 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys
[2012.09.16 07:07:29 | 000,079,816 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012.09.16 07:07:29 | 000,040,552 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys
[2012.09.16 07:07:29 | 000,035,272 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012.09.16 07:07:29 | 000,034,248 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys
[2012.09.16 07:07:25 | 000,047,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\VBAME.DLL
[2012.09.16 07:07:24 | 000,039,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SCP32.DLL
[2012.09.16 07:07:22 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2012.09.16 07:07:22 | 000,344,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcr70.dll
[2012.09.16 07:07:22 | 000,125,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSSTDFMT.DLL
[2012.09.16 07:07:21 | 000,032,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msonpmon.dll
[2012.09.16 07:07:20 | 002,531,328 | ---- | C] (Intel Corporation) -- C:\Windows\System32\igd10umd32.dll
[2012.09.16 07:07:20 | 000,155,648 | ---- | C] (Intel Corporation) -- C:\Windows\System32\igfxCoIn_v1972.dll
[2012.09.16 07:07:19 | 001,194,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FM20.DLL
[2012.09.16 07:07:19 | 000,041,296 | R--- | C] (Microsoft Corporation) -- C:\Windows\System32\hlp95en.dll
[2012.09.16 07:07:19 | 000,036,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FM20DEU.DLL
[2012.09.16 07:07:19 | 000,033,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FM20ENU.DLL
[2012.09.16 07:07:18 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\corpol.dll
[2012.09.16 07:07:17 | 006,214,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CardGames.dll
[2012.09.15 17:51:38 | 000,000,000 | ---D | C] -- C:\Users\Alexander\AppData\Roaming\Malwarebytes
[2012.09.15 17:51:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.15 17:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.15 17:51:25 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.15 17:51:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.09.15 03:33:32 | 000,000,000 | ---D | C] -- C:\Users\Alexander\Desktop\Steve From England - Rooney! (EP)
[2012.09.15 03:32:43 | 000,000,000 | ---D | C] -- C:\Users\Alexander\Desktop\Steve_From_England-Serenity_Is_Just_A_Relic
[2012.09.12 14:23:39 | 000,240,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2012.09.12 14:23:39 | 000,187,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2012.09.11 04:33:18 | 000,000,000 | ---D | C] -- C:\Users\Alexander\Desktop\11.09
[2012.09.09 18:08:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.08.23 00:11:40 | 000,000,000 | ---D | C] -- C:\Users\Alexander\Desktop\23.8
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.20 16:06:03 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Alexander\Desktop\OTL.exe
[2012.09.20 15:55:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.20 15:55:27 | 1602,195,456 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.20 15:54:44 | 000,015,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.20 15:54:44 | 000,015,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.20 15:41:07 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.19 03:32:14 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.19 03:32:14 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.19 03:32:13 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.19 03:32:13 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.17 16:15:53 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.09.17 16:15:51 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.09.17 16:15:51 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.09.17 16:15:51 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.09.17 16:15:50 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.09.17 16:15:50 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.09.16 01:54:10 | 000,292,672 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.06 13:40:08 | 000,028,685 | ---- | M] () -- C:\Users\Alexander\Desktop\Report670bce7e-8147-4957-8f2e-fed2a50bc50c.pdf
[2012.08.29 04:09:18 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.08.29 04:09:18 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.08.22 19:16:46 | 000,240,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2012.08.22 19:16:36 | 000,187,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.16 07:07:29 | 000,003,224 | ---- | C] () -- C:\Windows\System32\drivers\MakeMarkerFile.xml
[2012.09.16 07:07:28 | 000,000,000 | ---- | C] () -- C:\Windows\System32\drivers\144D_SAMSUNG_N_N150_08JI.mrk
[2012.09.16 07:07:27 | 000,311,296 | ---- | C] () -- C:\Windows\System32\Rezip.exe
[2012.09.16 07:07:16 | 000,000,002 | ---- | C] () -- C:\Windows\HotFixList.ini
[2012.09.06 13:40:39 | 000,028,685 | ---- | C] () -- C:\Users\Alexander\Desktop\Report670bce7e-8147-4957-8f2e-fed2a50bc50c.pdf
[2012.02.02 02:14:14 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2012.02.02 02:11:54 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2011.11.14 22:44:26 | 000,001,473 | ---- | C] () -- C:\Users\Alexander\.recently-used.xbel
[2011.09.15 01:20:10 | 000,007,597 | ---- | C] () -- C:\Users\Alexander\AppData\Local\Resmon.ResmonCfg
[2011.09.11 22:52:10 | 000,003,584 | ---- | C] () -- C:\Users\Alexander\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.11 16:06:18 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.05.27 16:18:10 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.01.21 00:11:14 | 000,018,040 | ---- | C] () -- C:\Windows\War3Unin.dat
[2010.11.30 23:48:04 | 635,103,232 | ---- | C] () -- C:\Users\Alexander\iAXE CD Vol.3.mdf
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
========== LOP Check ==========
 
[2012.09.02 11:59:35 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\.purple
[2012.02.02 02:10:29 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Babylon
[2011.12.11 16:27:39 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\CBL-Electronics
[2010.12.01 00:25:46 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\DAEMON Tools Lite
[2012.09.20 15:47:22 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Dropbox
[2012.07.06 15:14:06 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Firefly Studios
[2010.11.20 00:25:13 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\GetRightToGo
[2011.11.14 22:44:27 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\gtk-2.0
[2012.09.20 15:48:57 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\hellomoto
[2012.05.10 19:13:19 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\ICQ
[2010.11.27 15:47:32 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Mp3tag
[2011.08.22 16:45:12 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Need for Speed World
[2012.09.20 16:19:15 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\NetSpeedMonitor
[2011.05.21 01:34:41 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Nokia
[2011.05.21 01:34:42 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Nokia Ovi Suite
[2012.01.16 01:43:06 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Nokia Suite
[2011.05.21 14:08:22 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Notepad++
[2010.10.19 11:31:31 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\OpenOffice.org
[2011.05.21 00:08:57 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\PC Suite
[2012.07.06 14:59:54 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\RotMG.Production
[2011.08.17 17:27:45 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\ScummVM
[2010.12.17 14:29:26 | 000,000,000 | ---D | M] -- C:\Users\Alexander\AppData\Roaming\Thunderbird
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 20.09.2012 16:09:24 - Run 4
OTL by OldTimer - Version 3.2.64.0     Folder = C:\Users\Alexander\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,44 Gb Available Physical Memory | 72,59% Memory free
3,98 Gb Paging File | 3,48 Gb Available in Paging File | 87,54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 108,89 Gb Total Space | 1,94 Gb Free Space | 1,78% Space Free | Partition Type: NTFS
Drive D: | 104,51 Gb Total Space | 35,48 Gb Free Space | 33,95% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-PC | User Name: Alexander | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.reg [@ = regfile] -- regedit.exe "%1"
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [open] -- regedit.exe "%1"
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V"
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2BE06C39-F71B-45A9-BB4E-11C7B106539E}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{3402E820-D376-4885-A25D-6DEA43D9DD56}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{3583DA90-2611-432C-8E4C-944CF03BFF9C}" = lport=139 | protocol=6 | dir=in | app=system | 
"{3B694A7D-D681-44FB-B84C-131C541A607E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3D7F9DF3-01E0-438C-87B9-4D131D994C2E}" = lport=1542 | protocol=6 | dir=in | name=realtek wps tcp prot | 
"{42839400-2E21-4899-9F4B-C1F3EE34FA74}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{4F560AA2-307F-402B-8C65-BCDBFC4F5421}" = lport=137 | protocol=17 | dir=in | app=system | 
"{5AD0573B-BE8D-4C80-8CFE-481E7A4F8301}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6BAE94E2-345B-4CCF-A087-1D022F1A52AB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6CD45D8B-BD76-4B32-B885-01F8BFA078A5}" = rport=445 | protocol=6 | dir=out | app=system | 
"{7483F097-F2A6-4204-AFE3-CD4D06DA0481}" = lport=1542 | protocol=17 | dir=in | name=realtek wps udp prot | 
"{776CEF55-8324-4344-BB13-ED6B3ACDCEAC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{7F758865-6D7C-4235-B935-7E3EF6143453}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{84A3B53F-1035-45E3-B506-56AD71E2A8E1}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{86D58AA0-DA39-4927-9615-EB613CF99209}" = rport=137 | protocol=17 | dir=out | app=system | 
"{8D0951CB-64E6-4C48-8268-960D8857F97E}" = lport=445 | protocol=6 | dir=in | app=system | 
"{A089CD88-73A4-47AE-B910-8EED69333FCC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B686EF9C-070F-4586-A773-9555C1CDE3D9}" = rport=139 | protocol=6 | dir=out | app=system | 
"{BB92640D-8ED9-446E-95B5-382E78710038}" = lport=53 | protocol=17 | dir=in | name=realtek ap udp prot | 
"{C1FAD33D-0C23-4DC0-AD73-A6FD7F8645E4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D1CFDD26-C29F-40FE-AF25-DFD45421FF62}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{EB830C62-E576-4B0E-A9F2-BE1531479DB1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EC234C00-44C9-4C1F-941A-5F934E50BCFB}" = rport=138 | protocol=17 | dir=out | app=system | 
"{FEDA42BF-D43C-4054-A8E3-6744262840AF}" = lport=138 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DC5D60F-89C1-41C6-8DE3-23B6D1B0FBEA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\steamid0210\counter-strike\hl.exe | 
"{1345D320-B9BB-481F-B16B-1E1297F4BDB0}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{1B8773F0-843D-4C12-9EB4-68FA92C30DFD}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{1ECB3254-3B8B-4C62-B98B-1AFAF0FEA27D}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{29069C61-A97C-463F-9EAE-EACEF49B4F7A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\steamid0210\counter-strike\hl.exe | 
"{29862E5F-A1A9-4BF1-A66B-566933344704}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{2B058280-7215-450F-9974-98268610C496}" = protocol=17 | dir=in | app=c:\program files\realtek wireless lan software\rtwlan.exe | 
"{336FD6B7-43BC-49D4-A14B-DD55445E8CE4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{34B15DEF-6677-477E-803F-7C7E701A465E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{379F4A43-607E-4253-A038-2CF1F22DEA2A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4033C073-D7B9-4546-BA75-BBB64AA48860}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{43DAFC5F-B4A8-4BA8-83B9-5BD115AED16F}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{43E223AB-37E0-4E3E-9E77-9487F5EDDBF1}" = protocol=6 | dir=in | app=c:\program files\realtek wireless lan software\rtwlan.exe | 
"{67ABD0DC-4EA8-457B-8766-A2EF3439FE53}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{6B321B7D-0835-4617-95E2-DC31847E8933}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\steamid0210\counter-strike\hl.exe | 
"{72D9E25D-808D-44D5-B511-29E7F0970043}" = protocol=6 | dir=in | app=c:\users\alexander\appdata\roaming\dropbox\bin\dropbox.exe | 
"{72FCB12F-0D41-405D-935E-570CE6BA0DE9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{750A3736-FBB9-4081-9581-ECCAA1EBC0D1}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{7683B90C-798B-422F-BD00-55E553431828}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\steamid0210\half-life\hl.exe | 
"{864BBCD3-9DD3-4C08-9460-5A49ED1D566B}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\steamid0210\half-life\hl.exe | 
"{88FBFB75-8DA4-4BEC-9A3B-0AEB6A1C8090}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{8A01BEF8-C995-401F-B228-AE73A5F6FC5F}" = protocol=17 | dir=in | app=c:\users\alexander\appdata\roaming\dropbox\bin\dropbox.exe | 
"{A3AE3D55-F00E-4A6C-9B47-CC1FD00481EC}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\stronghold kingdoms\strongholdkingdoms.exe | 
"{A5A82470-FAF9-4D5F-BF15-0A7C2088A1B8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{A9F255F8-2928-4420-873F-1EEAD67E7B22}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\steamid0210\half-life\hl.exe | 
"{B08362A1-49C0-4B71-B341-5AF5642C004D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B58B21D0-34EA-4CA4-9C50-B19D0D5CE974}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B87E8BEE-5A72-4C9B-8CEE-381C29C9F5B3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B8BCC11C-BF02-486B-9E43-CB67F31ED05B}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{BC8A9FBF-D664-435A-A9A9-943EF1DF487A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C6EB8FAB-0D02-4DBE-A479-5C4BBFA2DA79}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\steamid0210\half-life\hl.exe | 
"{CB4AB49C-18C7-41C2-8234-C10A054D5EB1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{CF74E9EE-70E4-4475-A8AF-6FD628F80A05}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{D5C715AD-D308-41BA-89CC-9669AACC1901}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{DB2B1244-7AE3-4D8F-8B5E-86BD8D095A0C}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{DD3E2DF1-FB2A-44F4-A2D1-F7A4F58AF997}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{E1731784-522E-41CF-B2C5-EC57E9C57B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E605C053-B791-40C8-9D19-3A693FC97117}" = protocol=6 | dir=out | app=system | 
"{E7D0D4DB-D5A4-4927-A0C3-4EFEA6A6FDAA}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\stronghold kingdoms\strongholdkingdoms.exe | 
"{F88BEFCC-D6F0-429C-8252-71F13242B385}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\steamid0210\counter-strike\hl.exe | 
"{FEB4429A-6B3D-47BB-AFF8-A33A1F0E963B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{00F793C4-D7E8-4E54-AA55-D592FB45DD11}C:\users\alexander\desktop\neuer ordner\blobby\volley.exe" = protocol=6 | dir=in | app=c:\users\alexander\desktop\neuer ordner\blobby\volley.exe | 
"TCP Query User{01CB461A-8946-40BC-94DB-4954F32305AD}C:\program files\team17\worms world party\wwp.exe" = protocol=6 | dir=in | app=c:\program files\team17\worms world party\wwp.exe | 
"TCP Query User{0B7F96FB-90A3-4CE7-AB31-BD7493474A47}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{12AB636A-89F8-4BB5-8352-14C31B528AD9}C:\program files\rockstar games\gta2\gta2.exe" = protocol=6 | dir=in | app=c:\program files\rockstar games\gta2\gta2.exe | 
"TCP Query User{20266154-5EB3-4D28-9FD4-9DCAB28684B4}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe | 
"TCP Query User{316F85BC-DEAA-49DA-8886-1AD01B7B1F09}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
"TCP Query User{3A9284F0-5C19-4F4A-960A-8E6F4C83B183}C:\program files\watchmycam\watchmycam.exe" = protocol=6 | dir=in | app=c:\program files\watchmycam\watchmycam.exe | 
"TCP Query User{40807A22-42F7-4E30-A4D2-5FD98E63A01E}C:\users\alexander\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\alexander\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{5839B3FD-093D-4771-93A6-450EEFB9837A}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{59107D10-32FF-42A8-B4D7-771EF43BF0F5}C:\users\alexander\desktop\blobby\volley.exe" = protocol=6 | dir=in | app=c:\users\alexander\desktop\blobby\volley.exe | 
"TCP Query User{67308C30-EE02-4CF3-B4FF-91D6AF966095}C:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe" = protocol=6 | dir=in | app=c:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe | 
"TCP Query User{8CD0B14E-C677-4D64-BAC2-64D0B40FD4FC}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{9426F67D-D90A-49D0-BEB4-1393089A9975}C:\program files\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"TCP Query User{9899849F-0CE7-4110-845E-F9E809A5F7D2}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"TCP Query User{9BBEE38C-2CDA-440B-8CEC-B4A784ECD9A4}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{A11CE9E6-83C1-416C-9B75-6195D679A528}C:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe" = protocol=6 | dir=in | app=c:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe | 
"TCP Query User{A29DA6A0-05FE-4E8F-87ED-3B9B7B33D555}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe | 
"TCP Query User{A6369477-423B-4835-BBC8-C14262BF6463}F:\spiele\rune\system\rune.exe" = protocol=6 | dir=in | app=f:\spiele\rune\system\rune.exe | 
"TCP Query User{A8020B87-5C27-4A44-9EFC-F9BF657FB2DF}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"TCP Query User{BB965721-9B44-4A17-AF4F-C4CEDF762418}C:\users\alexander\desktop\blobby\volley.exe" = protocol=6 | dir=in | app=c:\users\alexander\desktop\blobby\volley.exe | 
"TCP Query User{C3A9027E-D5E4-46C2-AF71-F49FD88B2398}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe | 
"TCP Query User{C3FBF63C-223D-4A87-9651-95A6A9EEE903}C:\program files\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"TCP Query User{C969D4AD-6C76-4800-8335-DEA0A13D2085}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"TCP Query User{D5F45034-DFA4-4BDB-9A18-2835C39CC1F7}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
"TCP Query User{D6A7059E-4237-42D0-A621-AF2BCD334C9C}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"TCP Query User{E3A654FC-086F-4803-809A-B89224EFD5D9}C:\program files\watchmycam\watchmycam.exe" = protocol=6 | dir=in | app=c:\program files\watchmycam\watchmycam.exe | 
"TCP Query User{F4EA1FB4-904D-4C24-A3CB-B54E0A022F68}C:\users\alexander\desktop\neuer ordner\blobby\volley.exe" = protocol=6 | dir=in | app=c:\users\alexander\desktop\neuer ordner\blobby\volley.exe | 
"TCP Query User{FCC1325B-74FD-4C12-BBE5-CA4D23889427}C:\program files\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"UDP Query User{011AF700-5E84-4931-B3BF-338154732FEE}C:\users\alexander\desktop\blobby\volley.exe" = protocol=17 | dir=in | app=c:\users\alexander\desktop\blobby\volley.exe | 
"UDP Query User{0B00C9F1-FB2F-437C-B8A3-FDB1FCA787D2}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{0D1F9F87-D25C-441B-8B73-7CFECAF9F36E}C:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe" = protocol=17 | dir=in | app=c:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe | 
"UDP Query User{0F9788CA-E255-4769-871C-572AE40451D7}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
"UDP Query User{0FC90098-3765-4C0A-99DC-E079305B82A3}C:\program files\watchmycam\watchmycam.exe" = protocol=17 | dir=in | app=c:\program files\watchmycam\watchmycam.exe | 
"UDP Query User{115DD699-3342-4CEA-A92D-3A917F24FFE6}C:\users\alexander\desktop\blobby\volley.exe" = protocol=17 | dir=in | app=c:\users\alexander\desktop\blobby\volley.exe | 
"UDP Query User{11E27DAF-FB6E-45F8-ABA6-286E389C7941}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{11FA472F-CB88-408B-BB0E-28AB2E73BB4A}C:\program files\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"UDP Query User{1847BD41-25E1-4354-829F-CA5B592543DE}C:\users\alexander\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\alexander\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{24E1BE49-1D3D-475F-97E0-D62A7C021E72}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{3871527E-6ED2-459F-8B0C-8BDB3C5C98BD}C:\users\alexander\desktop\neuer ordner\blobby\volley.exe" = protocol=17 | dir=in | app=c:\users\alexander\desktop\neuer ordner\blobby\volley.exe | 
"UDP Query User{55543277-DD2D-4925-9D44-ADFB6CCF013F}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe | 
"UDP Query User{5FB800EC-6DD7-4700-B769-CC0CC6D396F7}C:\program files\rockstar games\gta2\gta2.exe" = protocol=17 | dir=in | app=c:\program files\rockstar games\gta2\gta2.exe | 
"UDP Query User{657DB2A2-3517-4047-B1AC-9B13A7BEB671}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"UDP Query User{761CC9FD-D12E-4893-9F40-22372C59F29F}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
"UDP Query User{8BD96875-0042-453C-BC5A-1143AE04D46F}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{8DBB32EE-9071-4899-8E43-06CCA89CBF19}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe | 
"UDP Query User{908FBF51-82D1-4938-A70D-2FC84F29AB97}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"UDP Query User{98266230-FA96-46F4-9420-F56204F6E154}C:\program files\watchmycam\watchmycam.exe" = protocol=17 | dir=in | app=c:\program files\watchmycam\watchmycam.exe | 
"UDP Query User{AEA81539-42C3-4054-A52A-F0492A8DE346}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe | 
"UDP Query User{B2A585F9-D27F-4E30-923A-AB507906EACD}C:\program files\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"UDP Query User{C51C6100-A4B6-418C-A6BD-7DD0D6CF8EEA}C:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe" = protocol=17 | dir=in | app=c:\users\alexander\appdata\local\temp\rarsfx0\quake3.exe | 
"UDP Query User{D6B63E04-1663-45B2-852D-675A050974C5}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"UDP Query User{DAA0B17E-AF53-41B9-9E0B-BE302FB4E9D4}C:\program files\team17\worms world party\wwp.exe" = protocol=17 | dir=in | app=c:\program files\team17\worms world party\wwp.exe | 
"UDP Query User{E9B32DC0-4C23-4A7C-AA51-03F707814B4F}F:\spiele\rune\system\rune.exe" = protocol=17 | dir=in | app=f:\spiele\rune\system\rune.exe | 
"UDP Query User{EED96F5D-4047-4219-9DBC-98C934FAF235}C:\users\alexander\desktop\neuer ordner\blobby\volley.exe" = protocol=17 | dir=in | app=c:\users\alexander\desktop\neuer ordner\blobby\volley.exe | 
"UDP Query User{F9743E7D-B66E-43F0-9120-86D66FEDC5ED}C:\program files\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"UDP Query User{FE511F2E-3ABA-4441-B477-9EBDAA26A88B}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.5 Build #5242 Banner Remover 1.1
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{45535A5E-1F81-4F35-BE1D-43D10A7D03B4}" = Easy Resolution Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DF4CAB9-B628-4924-AD9A-1C457DD2960A}" = VirtualDJ Home FREE
"{55EB7967-5BB1-4EA2-8AFF-B2F9E487E553}" = PC Connectivity Solution
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender
"{86501894-E722-4385-A792-B7C2F28FAE7B}" = NetSpeedMonitor 2.5.4.0 x86
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}" = ChargeableUSB
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.2 - Deutsch
"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF88496B-4BBA-4922-97E9-2582D3A28358}" = Nokia Connectivity Cable Driver
"{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}" = Easy Network Manager
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{CCC2B140-B47A-45FA-AAE3-BD60DA41AE00}" = Samsung Support Center
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{DB24A9E5-A068-43DD-88D0-B51BED3C0B99}" = Nokia Suite
"{DB61F989-7664-4E18-97C8-0AC4C5DD9FFC}" = e-mix 5.6.4 Basic Edition
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"5513-1208-7298-9440" = JDownloader 0.9
"755087041320E005CB1E8A67C5C55A260EB81B90" = Windows Driver Package - Broadcom Bluetooth  (09/11/2009 6.2.0.9407)
"A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800)
"DivX Setup" = DivX-Setup
"DS-MP3 Source" = DS-MP3 Source 1.30
"Guitar Pro 5_is1" = Guitar Pro 5.2
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ICQToolbar" = ICQ Toolbar
"jEdit_is1" = jEdit 4.3.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"Mozilla Thunderbird 15.0.1 (x86 de)" = Mozilla Thunderbird 15.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.47a
"Native Instruments AC Box Combo" = Native Instruments AC Box Combo
"Native Instruments Plexi Combo" = Native Instruments Plexi Combo
"Nokia Suite" = Nokia Suite
"Notepad++" = Notepad++
"Pidgin" = Pidgin
"Pidgin-Musictracker" = Pidgin-Musictracker plugin (remove only)
"Scribe" = Express Scribe
"ScummVM_is1" = ScummVM 1.3.1
"Steam App 10" = Counter-Strike
"Steam App 47410" = Stronghold Kingdoms
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TmNationsForever_is1" = TmNationsForever
"Unlocker" = Unlocker 1.9.1
"USB_AUDIO_DEusb-audio.deBehringer2902" = BEHRINGER USB AUDIO DRIVER
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 2.0.1
"Warcraft III" = Warcraft III
"WatchMyCam_is1" = WatchMyCam - Live Video Streaming
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.09.2012 09:48:42 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3058
Description = 
 
Error - 20.09.2012 09:48:42 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 7010
Description = 
 
Error - 20.09.2012 09:49:23 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3029
Description = 
 
Error - 20.09.2012 09:49:23 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3028
Description = 
 
Error - 20.09.2012 09:49:23 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3058
Description = 
 
Error - 20.09.2012 09:49:23 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 7010
Description = 
 
Error - 20.09.2012 09:50:13 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3029
Description = 
 
Error - 20.09.2012 09:50:13 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3028
Description = 
 
Error - 20.09.2012 09:50:13 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 3058
Description = 
 
Error - 20.09.2012 09:50:13 | Computer Name = Alexander-PC | Source = Windows Search Service | ID = 7010
Description = 
 
[ System Events ]
Error - 20.09.2012 10:16:15 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:17:17 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:17:17 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:17:17 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:18:15 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:18:15 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:18:15 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:19:25 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:19:25 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 20.09.2012 10:19:25 | Computer Name = Alexander-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >