Hi leute^^

habe ein kleines Problem und zwar kommt seit einiger zeit ein win32 generic trojaner im temp Ordner von windows ständig neu. habe schon diverse scanner durch auch Rettungsdisks bis jetzt leider ohne erfolg. Meistens wird der trojaner gefunden wenn ich mit Browser im Interet bin, egal welchen ich nutze.

hier mal logs von mam und OTL:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.10.22.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Karén :: TIMCAMPYIII [Administrator]

22.Okt.2012 19:48:03
mbam-log-2012-10-22 (19-48-03).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 201948
Laufzeit: 10 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

hxxp://www.file-upload.net/download-6724259/OTL.Txt.html
hxxp://www.file-upload.net/download-6724266/Extras.Txt.html

werde jetz mal einen fullscan durchführen werden aber wahrscheinlich auch null ergebnise bei mam raus kommen. hoffe ihr könnt mir helfen

EDIT: so da bin ich wieder. habe keinen edit button gefunden, deswegen ein weiterer post.

mam fullscan log:

Malwarebytes Anti-Malware 1.65.1.1000
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.10.22.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Karén :: TIMCAMPYIII [Administrator]

22.Okt.2012 20:22:06
mbam-log-2012-10-22 (20-22-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 390219
Laufzeit: 1 Stunde(n), 35 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Hi,

Logfiles bitte hier in den Thread posten.

danke für deine antwort, die logfiles sind bereits im ersten post verlinkt

Deswegen schreib ich ja in den Thread posten .

Das macht das analysieren einfacher, abgesehen davon dass die seite durch den Proxy auf Arbeit gesperrt ist

so musste erstmal rausfinden wie das geht hat beim 3 versuch erst angenommen

OTL Extras logfile created on: 22.Okt.2012 19:43:32 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Karén\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MMM.yyyy
 
4,00 Gb Total Physical Memory | 1,58 Gb Available Physical Memory | 39,57% Memory free
9,99 Gb Paging File | 6,83 Gb Available in Paging File | 68,30% Paging File free
Paging file location(s): c:\pagefile.sys 6141 6141 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 156,52 Gb Total Space | 114,14 Gb Free Space | 72,92% Space Free | Partition Type: NTFS
Drive E: | 407,33 Gb Total Space | 199,40 Gb Free Space | 48,95% Space Free | Partition Type: NTFS
 
Computer Name: TIMCAMPYIII | User Name: Karén | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 1
"DefaultInboundAction" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe:*:Enabled:Spybot-S&D 2 Firewall service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe:*:Enabled:Spybot-S&D 2 On-Access monitor service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe:*:Enabled:Spybot-S&D 2 Scan On Demand service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe:*:Enabled:Spybot-S&D 2 Firewall service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe:*:Enabled:Spybot-S&D 2 On-Access monitor service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe:*:Enabled:Spybot-S&D 2 Scan On Demand service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05D725FA-6A1A-4F2A-B00D-6A98A34092D4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{0D68334A-02BA-4CE0-9724-97921C7A2F65}" = rport=445 | protocol=6 | dir=out | app=system | 
"{0EA1FA3E-C0FE-4CD8-BCEF-9FD70A3C27A1}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{10E97E26-94FF-4E44-B86D-334865D69FDE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{13DDA003-0B88-451D-A4C2-5063260E67D1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1CB502F2-5F2F-412B-8302-421520D23CD2}" = rport=139 | protocol=6 | dir=out | app=system | 
"{2A37D83F-82B3-4770-8D61-05F3FCB9412D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{3271DFF3-5F1C-4BAB-9B29-85C0A5BE90E6}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{35F3181A-4395-4447-8D86-0430D17F7DC9}" = lport=80 | protocol=6 | dir=in | name=http | 
"{375E081F-DB91-492E-B5C2-D5288F8380DA}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{3F81900F-E894-42A8-86E5-AEC11DB35FA6}" = lport=445 | protocol=6 | dir=in | app=system | 
"{4DA5D67C-9DE9-44FE-A33B-CC0515237B68}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{503742D6-F022-4C7F-BFB0-4FCD2D69A93C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{5B4F7888-A41F-4874-BA51-E470FCEB7B03}" = lport=1034 | protocol=6 | dir=in | name=akamai netsession interface | 
"{6DC52A7A-66BC-47C0-9A5D-D4EA1B37CAAB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{75B47968-CB51-4CFD-BCA5-BD2AB4DA72F3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{785160F6-64F6-434C-8966-F2467E025FC1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{81EA5664-9C84-48C7-8AC3-AC82D347023D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8447D85C-C80D-4844-AE4E-47E29B1C6F4C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{84BD9024-C86E-4173-B6B5-5827FFBE93B8}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{86207B32-9D72-4794-A5A3-1385F7E7ACEE}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{8B1B646B-8D57-4C85-9933-FD9603D65DE0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{93BEC3A4-5DBD-4952-AE88-DCD9EDD93447}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{9722B570-4F2D-4985-8DCA-A25E8651F805}" = lport=138 | protocol=17 | dir=in | app=system | 
"{AC1E02BB-6999-47F8-9445-FF4E81D687FA}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{AD3C4A1C-902E-4020-9757-7D4234589825}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B5297963-E51E-4130-AB32-646222D75C20}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{C5914EA9-E813-4EA3-A771-C50639D3D93A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D170404D-09D8-497C-AB2E-347E085ED0B8}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{D9A84746-E88C-49B2-8D83-A7BFE297A246}" = rport=138 | protocol=17 | dir=out | app=system | 
"{E10383C6-A8B0-4121-99E7-224EF88021D0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E5667488-A19F-4308-9057-F28E8B9A5B3E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E5FBE0E9-027E-41EC-BB0E-4DC5D62968E6}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E813604C-6124-423A-9FDB-33045F99B6EC}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{F355E97C-2F2C-43C0-9961-8DE0C760FF7F}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{FB650CD0-43A1-4965-B094-0BEF30A921BF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{FC428F36-E4C2-484C-9781-AE54EE93BCD6}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B2C13C9-E5FD-412C-91B3-A07B2021B0C6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{14AC8E2E-FEDF-470D-B22E-AFB9A81CEFE6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{177EC101-AAB4-46BE-8F7F-B4B54A62A1FF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{18FC673C-E7E5-4224-8E2C-6E339DEA7C78}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{1A410D00-D3B6-4144-8040-ACCCCFA2A704}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{243DBFED-4079-4668-9413-30755C3FDD1B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{24DE5529-2D2F-470A-8F84-785587DCDCAF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{25E358E4-0186-44E5-B048-25E7873487F4}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steam.exe | 
"{274073A9-7BFB-4821-B671-1260DD3836B2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{2836A397-408F-4212-A481-A4B8E2FB71C3}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{2B2E09D5-79B0-453A-8F8F-6005A29AAF63}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3E1862D4-29AC-4065-A6C8-805B2EFC05B3}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe | 
"{4B76CFE7-DD21-48B3-935E-C58DC4CCF221}" = protocol=6 | dir=in | app=e:\program files (x86)\utorrent\utorrent.exe | 
"{4EEDAD19-7D74-48E3-9E64-87E8A14AAFE7}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{4FA29913-5F2B-4ECC-AD36-50C50E27B694}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{513561E8-4C39-402B-B697-E4C472F3040C}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd9\powerdvd9\powerdvd9.exe | 
"{5CAED36A-96C3-4030-AA24-9662D867B245}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5D421EDA-86C3-4DE4-B2AC-89180BBB3E5F}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{5EC6B3D9-D4B9-49E1-8432-9660F4964BCF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{62E0A3CC-AE38-4225-9855-6C599926ABE9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{6D334245-EE04-4E9D-A0A0-008AFBBBE471}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{76F9B7CC-3381-4853-A29D-8BE75AEB0303}" = dir=out | app=%programfiles% (x86)\tuneup utilities 2012\updatewizard.exe | 
"{818449F9-C757-4871-8866-1450F5D60E7F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8259D1CD-7250-4665-AF9E-F365A9FC1D6D}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{82F98093-BA14-455A-8EC9-245B32517721}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{8AB1ACC6-C912-4CC5-A93F-D99208894BF8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{904DE0E9-1107-40BF-8B20-452C58969C1A}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{910D56AE-D4B3-4190-BA07-567CAA76F33A}" = protocol=17 | dir=in | app=e:\program files (x86)\utorrent\utorrent.exe | 
"{9197C95C-E018-4E2D-8C06-EE06D559A564}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{9646F270-AB76-4FFC-873F-6DC03241069F}" = protocol=17 | dir=in | app=e:\program files (x86)\wlite\wlite.exe | 
"{972090BA-CD35-4F86-B679-D4AECF9CCC9E}" = dir=out | app=%programfiles% (x86)\tuneup utilities 2012\silentupdater.exe | 
"{988CBD04-0C31-4B6D-B311-AD9FDFE57263}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{9B5DB2E7-88C1-4544-9A03-AF0CE1E0AD24}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steam.exe | 
"{9FD72E23-CD98-436F-9A8B-7ECD0D2BFD08}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{A260E773-EF50-4960-9FA4-E5FFC5B6D81D}" = protocol=6 | dir=out | app=system | 
"{A2E9B114-7B1D-415D-A85F-589A8FB5549C}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe | 
"{BA38728A-9095-4B1E-8858-3FA511978554}" = protocol=6 | dir=in | app=e:\program files (x86)\wlite\wservice.exe | 
"{BBFDAC9D-3A9D-4560-8A9D-733A020C4688}" = dir=out | app=%programfiles% (x86)\tuneup utilities 2012\integrator.exe | 
"{D1314A37-0E20-421D-AE76-9CAF2C9A4DD8}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D2775DBB-6A68-46C5-ABF3-2D7643F238E1}" = protocol=6 | dir=in | app=e:\program files (x86)\wlite\wlite.exe | 
"{D35E6831-8A74-40E0-BFAF-15D95040E716}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{D566EF6A-BE88-4D33-90AC-421218555761}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) | 
"{DBAD7293-95DE-4CB9-B78F-8C8C7FCB8BB9}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{DC9ABC53-EBA4-48FB-B800-84A231F61BA4}" = protocol=17 | dir=in | app=e:\program files (x86)\wlite\wservice.exe | 
"{E971843F-1C40-4BE0-BBB9-1801197D4F78}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{EBFA4F35-A6DB-448A-AF84-6ADE5755BA99}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{FC355C75-5CF5-4DB3-BA5E-79B3D84F6A3A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{FD05D387-6E10-4332-B603-7DB1BACFACD4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{76845C56-8E22-4658-A146-923813849EBA}E:\program files\java64\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files\java64\bin\javaw.exe | 
"TCP Query User{943740F7-0706-4DA4-86AA-145AF4D75AA1}E:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{ABCD6C0F-1066-4E79-86CC-31769485813E}E:\downloads\utorrentportable\app\utorrent\utorrent.exe" = protocol=6 | dir=in | app=e:\downloads\utorrentportable\app\utorrent\utorrent.exe | 
"TCP Query User{B7E59611-6A00-49EB-BA9F-07712D3F9499}E:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=e:\program files (x86)\java\jre7\bin\java.exe | 
"TCP Query User{BC376C28-BA6D-4330-B942-BF5EE7FF6BCC}C:\users\karén\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\karén\appdata\local\akamai\netsession_win.exe | 
"TCP Query User{C38D1BD3-63E4-4C2E-9D73-559277653A40}E:\downloads\emulatoren\dolphin 3.0\dolphin.exe" = protocol=6 | dir=in | app=e:\downloads\emulatoren\dolphin 3.0\dolphin.exe | 
"TCP Query User{DC4B456E-94B0-4F74-9544-155B6C3D8D19}E:\program files (x86)\java\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\java\bin\javaw.exe | 
"UDP Query User{02F426E2-05B8-4DE4-B586-E7D80E8855C3}E:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=e:\program files (x86)\java\jre7\bin\java.exe | 
"UDP Query User{0B73DE28-FB78-4096-8B5A-F2BC2ED6172D}E:\downloads\emulatoren\dolphin 3.0\dolphin.exe" = protocol=17 | dir=in | app=e:\downloads\emulatoren\dolphin 3.0\dolphin.exe | 
"UDP Query User{2D81BBD2-368B-41AC-A575-3D017900C69B}E:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{90FECAB7-D42F-46FA-A5E9-FAF62A647B01}E:\program files\java64\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files\java64\bin\javaw.exe | 
"UDP Query User{A2CACECF-13C4-4219-B986-DA2221254326}E:\program files (x86)\java\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\java\bin\javaw.exe | 
"UDP Query User{BE6A42B5-55C3-4040-A346-B2D37881C284}E:\downloads\utorrentportable\app\utorrent\utorrent.exe" = protocol=17 | dir=in | app=e:\downloads\utorrentportable\app\utorrent\utorrent.exe | 
"UDP Query User{EBE7522C-4B37-4695-8CAC-1DE06AD4CB16}C:\users\karén\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\karén\appdata\local\akamai\netsession_win.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B1D5174-634F-DAB2-EC67-EAC51F7F0F99}" = AMD Fuel
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{23B01E31-9CBC-53FD-72F4-5CF437DA676F}" = ccc-utility64
"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.6.0003
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{541D3A3F-1FFC-9EB6-6C77-75809AAB87AE}" = ATI Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{66A4349A-AA55-43E5-A781-62867A701A90}" = MacroKey Manager
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{C263ED32-78DB-40EB-8B12-2925C8213E28}" = HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6822EFD-3F7D-4B35-8845-757A26AEC8E2}" = Windows Live MIME IFilter
"97149975-b4b1-4d2b-b9fe-7ba413d0efeb_is1" = SummerProperties 1.2
"CCleaner" = CCleaner
"DriverAgent.exe" = DriverAgent by eSupport.com
"HashTab" = HashTab 4.0.0.2
"HWiNFO64_is1" = HWiNFO64 Version 4.06
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Registry First Aid_is1" = Registry First Aid
"Sandboxie" = Sandboxie 3.74 (64-bit)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.00 (64-Bit)
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{006D931C-AD2E-A65F-51E2-AE3FB83CB235}" = CCC Help Hungarian
"{03CC9D58-B132-4CC0-A521-4F3660AA43C7}" = Movie Maker
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1" = MiniTool Partition Wizard Home Edition 7.6
"{075A7877-02CA-4B15-8534-1211712A8E79}" = ZoneAlarm Firewall
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{15EB20D6-5F13-41D0-BEF9-C9C44D6AC620}" = SDFormatter
"{15F3A6F5-06AE-4332-AE3E-21CD0416827A}" = Windows Live Mail
"{18272881-CFC0-434D-A975-E5BE44206AA0}" = Windows Live UX Platform Language Pack
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{1BD9E24B-DB16-491C-8092-F158664BB9F6}" = ZoneAlarm Security
"{1EA7C505-E6DA-4B85-9432-EBD3C70D510D}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23A3E560-069F-4CFC-8F6C-1B526EC735FC}" = Windows Live Writer Resources
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83217001FF}" = Java(TM) 7 Update 1
"{291447FE-2099-FBAF-CD15-43B98191B097}" = CCC Help English
"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3C3DCD2B-6FC7-41BF-BB80-40A936E1A785}" = Windows Live Writer
"{3CBD94C1-BA15-488C-888B-D8DD296CC6DC}" = Fotogalerie
"{3CFB128F-2E73-7CB3-A2B4-6DE6C70BF1E6}" = Catalyst Control Center InstallProxy
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell Power Management
"{400C31E4-796F-4E86-8FDC-C3C4FACC6847}" = Junk Mail filter update
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4FD0B0CE-BEEE-C3B6-A3B7-6D0A72CA8A6A}" = CCC Help Greek
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}" = RGSS-RTP Standard
"{5B100086-71B6-10B4-0F46-9E637828AFCD}" = CCC Help Portuguese
"{5BABDA39-61CF-41EE-992D-4054B6649A9B}" = Movie Maker
"{5F7CCC36-9B1A-888D-03EE-4EED0D194505}" = Catalyst Control Center Graphics Previews Common
"{690F5BA3-5DEB-42CD-962B-F687EE59FAA7}" = Windows Live Essentials
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{6D172D0A-B9F1-4046-AFAB-8599288545BF}" = Safari
"{70854FE6-3BF1-4C69-94D0-BEB821102E34}" = Windows Live Mail
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B56E98-B4F8-D665-D451-2CB8CFB8AF2C}" = AMD VISION Engine Control Center
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}" = HP Deskjet 2050 J510 series Hilfe
"{7E210E1C-52A1-40E3-817B-D504E9F64DFA}_is1" = Flyff
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management
"{86C40513-B5A4-476E-9EAB-EC118DCF4502}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8913AC02-67B8-4B52-91B2-BBA7B9C265B5}" = Windows Live Writer Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{924C77DE-4C69-FC11-1835-8BD7E65FE2B5}" = CCC Help Polish
"{9532F6E0-ED0A-41A4-87F9-49478E44E8C1}" = ZoneAlarm Antivirus
"{97C79BEC-43F7-4BD8-A6A7-85C0257E488A}" = Windows Live Writer
"{98722C60-1CA9-BE00-D1A6-BEF7F09E4B0F}" = CCC Help Italian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E3301DE-169A-E81D-04DE-38F150AF4A8E}" = Catalyst Control Center Localization All
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.3
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AE364ACC-B9DF-466B-B4EA-AEECD0CD581E}" = Windows Live Messenger
"{B727564C-47D3-473A-AC9E-F4BE7B1BD5D3}" = Windows Live UX Platform Language Pack
"{B80D3EA9-A252-4AE5-AC51-81729F5C586F}" = Windows Live Mail
"{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1" = Emsisoft Anti-Malware
"{C034A6F9-6569-491B-B3BF-F5D15221A708}" = Windows Live Essentials
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C7461496-595D-E1F0-D0BF-549B0AAE00A7}" = CCC Help French
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2C146B1-948D-47EF-8387-5D1C6B980F7C}" = Windows Live Writer
"{D888F114-7537-4D48-AF03-5DA9C82D7540}" = Photo Common
"{DD89CE29-BC88-40C6-A845-E2548682C5D6}" = Alcor Micro USB Card Reader
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1203F8C-FF34-4968-A4A5-B4F1F8533DAB}" = Photo Common
"{E6170043-7909-2B51-919E-CCD74C3A06DA}" = CCC Help Spanish
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Packard Bell Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F51288D5-3735-1DC9-2277-2FC062860216}" = CCC Help German
"{FC6C7107-7D72-41A1-A031-3CE751159BAB}" = Photo Gallery
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CDisplayEx_is1" = CDisplayEx 1.8
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"DMX5_is1" = DriverMax 6
"DRAGON" = DRAGON 1.7
"FileHippo.com" = FileHippo.com Update Checker
"GhostMouse_is1" = GhostMouse
"Glary Utilities_is1" = Glary Utilities 2.32.0.1126
"ImgBurn" = ImgBurn
"InstallShield_{66A4349A-AA55-43E5-A781-62867A701A90}" = MacroKey Manager
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Packard Bell MyBackup
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"InstallShield_{DD89CE29-BC88-40C6-A845-E2548682C5D6}" = Alcor Micro USB Card Reader
"Kill-ID für Chrome_is1" = Kill-ID 1.2.4.0 für Chrome
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Messenger Plus!" = Messenger Plus! 5
"MiniTool Power Data Recovery_is1" = MiniTool Power Data Recovery
"Mozilla Firefox 16.0.1 (x86 de)" = Mozilla Firefox 16.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Packard Bell Registration" = Packard Bell Registration
"PS3 Media Server" = PS3 Media Server
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPGAdvocates_RTP_1.0" = Common RTP 1.0
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"WinLiveSuite" = Windows Live Essentials
"Wireshark" = Wireshark 1.6.7 (64-bit)
"ZoneAlarm Free Antivirus + Firewall" = ZoneAlarm Free Antivirus + Firewall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 19.Aug.2012 10:19:29 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: snes9x.exe, Version: 1.5.2.0, Zeitstempel:
 0x4b51ef5e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00033ab3  ID des fehlerhaften Prozesses:
 0x1228  Startzeit der fehlerhaften Anwendung: 0x01cd7e151781b13f  Pfad der fehlerhaften
 Anwendung: E:\downloads\emulatoren\snes9x-1.52-win32.fix4\snes9x.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: e3229203-ea08-11e1-889f-206a8a24457b
 
Error - 19.Aug.2012 13:00:01 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 20.Aug.2012 03:34:17 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe_Winmgmt, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: wmisvc.dll, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5be102  Ausnahmecode: 0xc0000006  Fehleroffset: 0x000000000000b0b7
ID
 des fehlerhaften Prozesses: 0x1ec  Startzeit der fehlerhaften Anwendung: 0x01cd7ea554fd350d
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften
 Moduls: c:\windows\system32\wbem\wmisvc.dll  Berichtskennung: 7222f4ca-ea99-11e1-ad51-206a8a24457b
 
Error - 20.Aug.2012 03:34:33 | Computer Name = TimcampyIII | Source = Application Error | ID = 1005
Description = Aus einem der folgenden Gründe kann nicht auf die Datei "C:\Windows\System32\wbem\WMIsvc.dll"
 zugegriffen werden:  Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger
 mit der gespeicherten Datei bzw. den auf dem Computer installierten  Speichertreibern,
 oder der Datenträger fehlt.  Das Programm Hostprozess für Windows-Dienste wurde wegen
 dieses Fehlers geschlossen.    Programm: Hostprozess für Windows-Dienste  Datei: C:\Windows\System32\wbem\WMIsvc.dll

Der
 Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.  Benutzeraktion  1. 
Öffnen Sie die Datei erneut.  Diese Situation ist eventuell ein temporäres Problem,
 das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.  2.  Wenn
 Sie weiterhin nicht auf die Datei zugreifen können und   - diese sich im Netzwerk 
befindet,   dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem
 besteht und dass eine Verbindung mit dem Server hergestellt werden kann.   - diese
 sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet,
 überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.  3. Überprüfen
 und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu
 im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben
 Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4.
 Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin
 besteht.  5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet
 werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
   Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, 
um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.    Zusätzliche
 Daten  Fehlerwert: C0000185  Datenträgertyp: 3
 
Error - 27.Aug.2012 06:46:54 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 28.Aug.2012 08:22:59 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Safari.exe, Version: 5.34.55.3, Zeitstempel:
 0x4f6ba239  Name des fehlerhaften Moduls: Safari.dll, Version: 7534.55.3.3, Zeitstempel:
 0x4f6ba202  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00093503  ID des fehlerhaften Prozesses:
 0x10c8  Startzeit der fehlerhaften Anwendung: 0x01cd8517d1efdf20  Pfad der fehlerhaften
 Anwendung: E:\Program Files (x86)\Safari\Safari.exe  Pfad des fehlerhaften Moduls:
 E:\Program Files (x86)\Safari\Safari.dll  Berichtskennung: 1a3fb6e9-f10b-11e1-8407-206a8a24457b
 
Error - 30.Aug.2012 03:50:24 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Safari.exe, Version: 5.34.55.3, Zeitstempel:
 0x4f6ba239  Name des fehlerhaften Moduls: Safari.dll, Version: 7534.55.3.3, Zeitstempel:
 0x4f6ba202  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00093503  ID des fehlerhaften Prozesses:
 0xffc  Startzeit der fehlerhaften Anwendung: 0x01cd86841445a453  Pfad der fehlerhaften
 Anwendung: E:\Program Files (x86)\Safari\Safari.exe  Pfad des fehlerhaften Moduls:
 E:\Program Files (x86)\Safari\Safari.dll  Berichtskennung: 5b03b2aa-f277-11e1-b0fc-206a8a24457b
 
Error - 02.Sep.2012 13:00:02 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 09.Sep.2012 13:00:01 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 16.Sep.2012 13:00:02 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 23.Sep.2012 13:48:07 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 24.Sep.2012 14:31:17 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: DllHijackAuditor.exe, Version: 2.5.0.0,
 Zeitstempel: 0x4d3ff573  Name des fehlerhaften Moduls: DllHijackAuditor.exe, Version:
 2.5.0.0, Zeitstempel: 0x4d3ff573  Ausnahmecode: 0xc0000417  Fehleroffset: 0x00027936
ID
 des fehlerhaften Prozesses: 0xff8  Startzeit der fehlerhaften Anwendung: 0x01cd9a8282fde5a9
Pfad
 der fehlerhaften Anwendung: F:\Sicherheits-Stick-Programme\DllHijackAuditor.exe
Pfad
 des fehlerhaften Moduls: F:\Sicherheits-Stick-Programme\DllHijackAuditor.exe  Berichtskennung:
 06c0a899-0676-11e2-b9f3-206a8a24457b
 
 
Error encountered while reading event logs.
 
< End of report >
         

OTL logfile created on: 22.Okt.2012 19:43:32 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Karén\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MMM.yyyy
 
4,00 Gb Total Physical Memory | 1,58 Gb Available Physical Memory | 39,57% Memory free
9,99 Gb Paging File | 6,83 Gb Available in Paging File | 68,30% Paging File free
Paging file location(s): c:\pagefile.sys 6141 6141 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 156,52 Gb Total Space | 114,14 Gb Free Space | 72,92% Space Free | Partition Type: NTFS
Drive E: | 407,33 Gb Total Space | 199,40 Gb Free Space | 48,95% Space Free | Partition Type: NTFS
 
Computer Name: TIMCAMPYIII | User Name: Karén | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Karén\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Emsisoft GmbH)
PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)
PRC - E:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - E:\Program Files (x86)\GhostMouse\GhostMouse.exe ()
PRC - C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\pdf.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\libglesv2.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\libegl.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\avutil-51.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\avformat-54.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\avcodec-54.dll ()
MOD - E:\Program Files (x86)\GhostMouse\GhostMouse.exe ()
MOD - E:\Program Files (x86)\wLite\IPCameraRTSP.ax ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (WTService) -- C:\Windows\SysNative\atwtusb.exe ()
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vsmon) -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (a2AntiMalware) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)
SRV - (MBAMService) -- E:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- E:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (IswSvc) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (SbieSvc) -- E:\Program Files\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Live Updater Service) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe (Acer Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (wxpSvc) -- E:\Program Files (x86)\wLite\wService.exe (Moonware Studios)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (ePowerSvc) -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe (Acer Incorporated)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (GREGService) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SSScsiSV) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SSScsiSV.exe (Sony Corporation)
SRV - (SonicStage Back-End Service) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SsBeSvc.exe (Sony Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (HWiNFO32) -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS (REALiX(tm))
DRV:64bit: - (MotioninJoyXFilter) -- C:\Windows\SysNative\drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (pwdrvio) -- C:\Windows\SysNative\pwdrvio.sys ()
DRV:64bit: - (pwdspio) -- C:\Windows\SysNative\pwdspio.sys ()
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (ssudobex) -- C:\Windows\SysNative\drivers\ssudobex.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (mcdevice) -- C:\Windows\SysNative\drivers\mcdevice.sys (ShiningMorning Inc.)
DRV:64bit: - (Vsdatant) -- C:\Windows\SysNative\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (regi) -- C:\Windows\SysNative\drivers\regi.sys (InterVideo)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc)
DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (ss_bmdm) -- C:\Windows\SysNative\drivers\ss_bmdm.sys (MCCI Corporation)
DRV:64bit: - (ss_bbus) -- C:\Windows\SysNative\drivers\ss_bbus.sys (MCCI)
DRV:64bit: - (ss_bmdfl) -- C:\Windows\SysNative\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\drivers\walvhid.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (moufiltr) -- C:\Windows\SysNative\drivers\moufiltr.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\ManyCam_x64.sys (ManyCam LLC.)
DRV:64bit: - (SNPSTD3) -- C:\Windows\SysNative\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (DrvAgent64) -- C:\Windows\SysWOW64\drivers\DrvAgent64.SYS (Phoenix Technologies)
DRV - (ISWKL) -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (SbieDrv) -- E:\Program Files\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D)
DRV - (a2acc) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys (Emsisoft GmbH)
DRV - (a2injectiondriver) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys (Emsisoft GmbH)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (A2DDA) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys (Emsi Software GmbH)
DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc)
DRV - (a2util) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys (Emsi Software GmbH)
DRV - ({B154377D-700F-42cc-9474-23858FBDF4BD}) -- E:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9\000.fcl (CyberLink Corp.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (libusb0) -- C:\Windows\SysWOW64\drivers\libusb0.sys ()
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = hxxp://search.yahoo.com/search?fr=chr-panda&q={searchTerms}&ei=UTF-8&type=PCAFSI1190
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost; 127.0.0.1; <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledAddons: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.5.0.4
FF - prefs.js..network.proxy.http: "77.81.242.26"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.type: 1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: E:\Program Files (x86)\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files (x86)\java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Karén\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Karén\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll File not found
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2012.10.21 08:05:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2012.10.21 08:05:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: E:\Program Files (x86)\Mozilla Firefox\components [2012.10.22 19:09:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: E:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.22 19:09:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: E:\Program Files (x86)\Mozilla Firefox\components [2012.10.22 19:09:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: E:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.22 19:09:08 | 000,000,000 | ---D | M]
 
[2012.04.10 12:53:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karén\AppData\Roaming\mozilla\Extensions
[2012.08.20 00:07:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karén\AppData\Roaming\mozilla\Firefox\Profiles\7gq146r9.default\extensions
[2012.08.20 00:07:51 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Karén\AppData\Roaming\mozilla\Firefox\Profiles\7gq146r9.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2012.07.25 14:49:12 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Karén\AppData\Roaming\mozilla\firefox\profiles\7gq146r9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
File not found (No name found) -- C:\USERS\KARéN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7GQ146R9.DEFAULT\EXTENSIONS\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
 
========== Chrome  ==========
 
CHR - homepage: 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Uplay PC (Enabled) = C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Kar\u00E9n\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: DivX Web Player (Enabled) = E:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
CHR - plugin: Java(TM) Platform SE 7 U1 (Enabled) = E:\Program Files (x86)\java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Radio Player Live = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\boidnimkebefpfgbeekbjoponilnomle\2.1.7_0\
CHR - Extension: Proxy Switchy! = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\caehdcpeofiiigpdhbabniblemipncjj\1.6.3_0\
CHR - Extension: Google-Suche = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.45_0\
CHR - Extension: Google Mail = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.04.19 17:18:29 | 000,003,068 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 secure.tune-up.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 www.practivate.adobe.com
O1 - Hosts: 127.0.0.1 hxxp://practivate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 www.practivate.adobe.com
O1 - Hosts: 127.0.0.1 https://practivate.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 46 more lines...
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\java\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\java\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [MacroKeyManager] C:\Windows\SysNative\WTMKM.exe ()
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files (x86)\emsisoft anti-malware\a2guard.exe (Emsisoft GmbH)
O4 - HKLM..\Run: [VirtualCloneDrive] "E:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s                                                                                                                                                                                               File not found
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Karén\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [SandboxieControl] E:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Mit Mipony herunterladen - Reg Error: Value error. File not found
O8 - Extra context menu item: Mit Mipony herunterladen - Reg Error: Value error. File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1145ED73-48C0-443B-9FA7-496190E3DFE8}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F036A5BD-B337-4F22-AAAF-84533673F44A}: DhcpNameServer = 139.7.30.126 139.7.30.125
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\bejeweled 2 deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\build-a-lot 2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\chuzzle deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\deathonthenile-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\diner dash 2 restaurant rescue-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\drivegreen1-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\farm-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\fate-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\fileencrypt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\filesplitter.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\gameconsole-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\golf-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\helplauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\hpwucli.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\insaniquarium-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\integrator.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\jqsolitaire2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\kies.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\log viewer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\messenger plus! for skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mobileconnect.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mptools.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\omg2oma.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\omgbkup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\omgjbox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\penguins-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\photoshop elements 8.0.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\photoshopelementseditor.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\photoshopelementsorganizer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\plants vs. zombies-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\polar-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\provider.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\racing-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\setup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\steam.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\unins000.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\vcdprefs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\vcd-uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\virtual villagers - the tree of life-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\zuma deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\zumasrevenge-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\bejeweled 2 deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\build-a-lot 2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\chuzzle deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\deathonthenile-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\diner dash 2 restaurant rescue-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\drivegreen1-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\farm-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\fate-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\fileencrypt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\filesplitter.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\gameconsole-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\golf-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\helplauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\hpwucli.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\insaniquarium-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\integrator.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\jqsolitaire2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\kies.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\log viewer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\messenger plus! for skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mobileconnect.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mptools.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\omg2oma.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\omgbkup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\omgjbox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\penguins-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\photoshop elements 8.0.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\photoshopelementseditor.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\photoshopelementsorganizer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\plants vs. zombies-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\polar-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\provider.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\racing-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\setup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\steam.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\unins000.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\vcdprefs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\vcd-uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\virtual villagers - the tree of life-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\zuma deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\zumasrevenge-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{20ca4f1d-cd97-11e0-b449-206a8a24457b}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.22 20:00:38 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2012.10.22 19:42:44 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Karén\Desktop\OTL.exe
[2012.10.22 19:08:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.10.22 19:08:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2012.10.22 19:03:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2012.10.22 19:02:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012.10.22 18:51:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2012.10.22 18:49:23 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.22 18:49:23 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.22 18:49:02 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.22 18:49:02 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.22 18:49:02 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.22 18:45:24 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.10.22 18:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.10.21 08:07:25 | 000,011,864 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kl2.sys
[2012.10.21 08:07:24 | 000,460,888 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kl1.sys
[2012.10.21 08:07:20 | 000,485,680 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.10.21 08:06:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2012.10.21 08:05:38 | 000,000,000 | ---D | C] -- C:\Users\Karén\Documents\ForceField Shared Files
[2012.10.21 08:05:37 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\CheckPoint
[2012.10.21 08:04:15 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2012.10.21 08:01:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CheckPoint
[2012.10.21 08:01:25 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2012.10.18 17:24:51 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{46BE5FF4-4048-4834-A204-D09A1B533AB9}
[2012.10.18 16:36:02 | 000,000,000 | ---D | C] -- C:\Users\Karén\Documents\ArcSoft
[2012.10.17 22:35:07 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.10.17 22:35:07 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\MFAData
[2012.10.17 22:35:07 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012.10.17 22:35:07 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Avg2013
[2012.10.17 21:05:38 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\ElevatedDiagnostics
[2012.10.17 20:29:42 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{CB0CD61E-AE47-42D9-B7B8-8630773BAEEF}
[2012.10.17 19:39:57 | 002,672,744 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll
[2012.10.17 19:39:52 | 003,608,680 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll
[2012.10.17 19:39:50 | 001,261,160 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll
[2012.10.17 19:39:49 | 004,784,640 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoRes64.dat
[2012.10.17 19:39:49 | 000,103,528 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInstII64.dll
[2012.10.17 19:39:44 | 001,345,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek264.dll
[2012.10.17 19:39:41 | 001,015,640 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2012.10.17 19:39:39 | 002,533,952 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2012.10.16 19:23:07 | 000,090,112 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\AtihdW76.sys
[2012.10.16 19:16:16 | 000,109,568 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll
[2012.10.16 19:16:16 | 000,070,144 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst_9.001.dll
[2012.10.16 19:16:11 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2012.10.16 19:16:04 | 019,624,960 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atioglxx.dll
[2012.10.16 19:16:02 | 023,825,920 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atio6axx.dll
[2012.10.16 19:15:59 | 000,459,776 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys
[2012.10.16 19:15:59 | 000,056,832 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll
[2012.10.16 19:15:59 | 000,056,832 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll
[2012.10.16 19:15:59 | 000,056,320 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll
[2012.10.16 19:15:59 | 000,056,320 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll
[2012.10.16 19:15:59 | 000,021,504 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2012.10.16 19:15:58 | 010,695,168 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys
[2012.10.16 19:15:57 | 000,041,984 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll
[2012.10.16 19:15:57 | 000,033,280 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll
[2012.10.16 19:15:57 | 000,017,920 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll
[2012.10.16 19:15:57 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll
[2012.10.16 19:15:57 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiglpxx.dll
[2012.10.16 19:15:56 | 000,059,392 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll
[2012.10.16 19:15:55 | 006,477,824 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atidxx32.dll
[2012.10.16 19:15:54 | 001,120,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\aticfx64.dll
[2012.10.16 19:15:54 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atidemgy.dll
[2012.10.16 19:15:53 | 000,934,912 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\aticfx32.dll
[2012.10.16 19:15:53 | 000,051,200 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll
[2012.10.16 19:15:53 | 000,046,080 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll
[2012.10.16 19:15:52 | 016,082,432 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll
[2012.10.16 19:15:50 | 013,703,168 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll
[2012.10.16 19:15:49 | 000,163,840 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiapfxx.exe
[2012.10.16 19:15:49 | 000,044,544 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll
[2012.10.16 19:15:49 | 000,044,032 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll
[2012.10.16 19:15:48 | 000,405,504 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll
[2012.10.16 19:15:48 | 000,053,248 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll
[2012.10.16 19:15:48 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll
[2012.10.16 19:06:20 | 000,000,000 | ---D | C] -- C:\Users\Karén\Documents\My Drivers
[2012.10.16 18:37:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{7021FCDB-47B5-4386-BC3E-B11344759E86}
[2012.10.16 18:34:01 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Innovative Solutions
[2012.10.16 18:34:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax
[2012.10.16 18:12:22 | 000,696,760 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.16 18:12:22 | 000,073,656 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.15 20:44:08 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{F0CB52AE-B1DA-47B2-B9D2-D8F02EB0433F}
[2012.10.15 20:34:28 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Sun
[2012.10.14 19:50:53 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{DD2B6863-E057-4244-B968-F29990C51FBD}
[2012.10.14 09:44:16 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{909D5AB7-5E1E-4D23-8054-FDB106B84BBA}
[2012.10.14 01:30:50 | 000,000,000 | ---D | C] -- C:\Users\Karén\Desktop\uhg
[2012.10.13 21:22:21 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{DC28CA75-63AC-468B-B278-E1DBFA5E0C3F}
[2012.10.13 18:09:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Packard Bell
[2012.10.13 17:05:16 | 000,021,712 | ---- | C] (Phoenix Technologies) -- C:\Windows\SysWow64\drivers\DrvAgent64.SYS
[2012.10.13 17:05:16 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\eSupport.com
[2012.10.12 22:39:06 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\ArcSoft
[2012.10.12 22:21:53 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\ArcSoft
[2012.10.12 22:21:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ArcSoft
[2012.10.12 22:17:26 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Downloaded Installations
[2012.10.11 21:14:43 | 000,030,592 | ---- | C] (REALiX(tm)) -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS
[2012.10.11 21:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
[2012.10.11 18:42:29 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{9F1AB58F-8E5E-492E-8AB9-3C82A67BF22B}
[2012.10.10 16:56:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{E94AEFD4-FED8-40B6-8FFA-50752FC5B99C}
[2012.10.10 16:26:23 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 16:26:20 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.10 16:26:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 16:26:03 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 16:26:03 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 16:26:03 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 16:26:02 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 16:25:59 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 16:25:59 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 16:25:58 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 16:25:57 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 16:25:57 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 16:25:57 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 16:25:56 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 16:25:56 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 16:25:56 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 16:25:56 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 16:25:55 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 16:25:55 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 16:25:55 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 16:25:55 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 16:25:55 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 16:25:54 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 16:25:54 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 16:25:54 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 16:25:54 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 16:25:52 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 16:25:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 16:25:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 16:25:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 16:25:49 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 16:25:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 16:25:47 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 16:25:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 16:25:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 16:25:43 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 16:25:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 16:25:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 16:25:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 16:25:40 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 16:25:40 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 16:25:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 16:25:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 16:25:38 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 16:25:36 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 16:25:36 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 16:25:36 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 16:25:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 16:25:34 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 16:25:33 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 16:25:04 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 16:24:22 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 16:24:16 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.09 20:08:05 | 000,000,000 | R--D | C] -- C:\Sandbox
[2012.10.09 20:00:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
[2012.10.07 18:42:13 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{9184F5AD-CCCC-4A63-B0CE-E1123089A4BA}
[2012.10.07 11:49:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PopCap Games
[2012.10.05 15:07:30 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\MotioninJoy
[2012.10.05 15:07:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
[2012.10.05 15:07:29 | 000,121,416 | ---- | C] (MotioninJoy) -- C:\Windows\SysNative\drivers\MijXfilt.sys
[2012.10.05 14:24:14 | 000,046,592 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysWow64\libusb0.dll
[2012.10.05 14:23:49 | 000,000,000 | ---D | C] -- C:\Users\Karén\Desktop\ps3 treiber
[2012.10.05 14:00:23 | 000,328,712 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\MijFrc.dll
[2012.10.05 14:00:22 | 000,074,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\xusb21.sys
[2012.10.05 11:24:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2012.10.05 11:19:55 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Malwarebytes
[2012.10.05 11:19:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.05 11:19:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.05 11:19:38 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.04 16:43:49 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{26C1F9DF-10D7-4D73-92F9-C3B767CAAA8F}
[2012.10.03 18:42:02 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{675B1AA4-2B46-4CEB-B03E-884E720A468E}
[2012.10.03 17:40:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Veoh Networks
[2012.10.03 17:40:04 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\OpenCandy
[2012.10.02 16:17:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{A592CE45-3F52-42F5-A696-BF8983E04836}
[2012.10.01 18:56:14 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{4487C815-2166-41C7-9CF9-C17010500BBB}
[2012.09.30 22:58:40 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Facebook
[2012.09.30 20:00:03 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{D12C0C11-8616-430B-A90A-DB7CB7CFDF1D}
[2012.09.30 12:19:16 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kill-ID für Chrome
[2012.09.30 12:17:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.09.30 12:16:15 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Google
[2012.09.30 11:53:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.2
[2012.09.30 09:24:46 | 000,000,000 | ---D | C] -- C:\Windows\MiniDump
[2012.09.29 20:43:34 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{73E01E69-71A7-4DE3-A2B3-C45020375C8E}
[2012.09.28 20:40:30 | 000,000,000 | ---D | C] -- C:\Users\Karén\Desktop\SpeedCrunch-0.10.1
[2012.09.28 16:29:17 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{BF91662F-96D0-4DDB-B5EC-5B78932327AA}
[2012.09.27 20:10:55 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox
[2012.09.27 20:04:43 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\JonDo
[2012.09.27 19:25:10 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{059F688B-3F7B-419E-A733-E7790E74C430}
[2012.09.26 17:07:19 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.26 17:02:59 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{A5D961C2-8D97-44B1-9C0B-3A932850C7C0}
[2012.09.25 16:00:26 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{55228BAF-434C-437E-8D28-5815559E0DB3}
[2012.09.24 20:05:59 | 000,047,104 | ---- | C] (frozenlogic.org) -- C:\Windows\SummerProperties.dll
[2012.09.24 18:59:31 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{0D3019A6-4CE9-49C6-B58C-3302D1593A4D}
[2012.09.22 21:55:37 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 21:55:36 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 21:55:35 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 21:55:35 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 21:55:35 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 21:55:35 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 21:55:35 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 21:55:35 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 21:55:34 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 21:55:34 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 21:55:34 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 21:55:34 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 21:55:32 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 21:55:32 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.22 21:55:31 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.22 19:27:01 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000UA.job
[2012.10.22 19:22:24 | 000,025,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.22 19:22:24 | 000,025,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.22 18:48:47 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.22 18:48:43 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.22 18:48:43 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.22 18:48:43 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.22 18:48:42 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.22 18:48:42 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2012.10.22 16:21:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.21 23:08:22 | 000,415,877 | ---- | M] () -- C:\Windows\SysNative\drivers\vsconfig.xml
[2012.10.21 23:07:00 | 000,001,972 | ---- | M] () -- C:\Windows\Sandboxie.ini
[2012.10.21 08:06:54 | 000,000,762 | ---- | M] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2012.10.17 22:40:55 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Karén\Desktop\OTL.exe
[2012.10.16 19:10:51 | 000,002,562 | ---- | M] () -- C:\Windows\diagwrn.xml
[2012.10.16 19:10:51 | 000,001,908 | ---- | M] () -- C:\Windows\diagerr.xml
[2012.10.16 18:12:22 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.16 18:12:22 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.15 17:52:38 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.15 17:52:38 | 000,697,082 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.15 17:52:38 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.15 17:52:38 | 000,148,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.15 17:52:38 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.14 12:27:03 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000Core.job
[2012.10.13 17:05:16 | 000,021,712 | ---- | M] (Phoenix Technologies) -- C:\Windows\SysWow64\drivers\DrvAgent64.SYS
[2012.10.13 14:09:58 | 000,274,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.12 21:50:15 | 000,001,884 | ---- | M] () -- C:\Windows\wininit.ini
[2012.10.12 21:17:01 | 000,000,020 | ---- | M] () -- C:\Windows\8ùÛ
[2012.10.11 21:14:43 | 000,030,592 | ---- | M] (REALiX(tm)) -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS
[2012.10.07 22:20:14 | 005,287,936 | ---- | M] () -- C:\Users\Karén\Desktop\digimon world trainer.EXE
[2012.10.05 15:09:30 | 000,121,416 | ---- | M] (MotioninJoy) -- C:\Windows\SysNative\drivers\MijXfilt.sys
[2012.10.05 15:07:31 | 000,000,799 | ---- | M] () -- C:\Users\Public\Desktop\DS3 Tool.lnk
[2012.10.05 14:03:20 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2012.10.05 14:03:19 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_MijXfilt_01009.Wdf
[2012.10.05 11:24:45 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.10.05 11:19:40 | 000,000,806 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.03 16:25:16 | 000,533,031 | ---- | M] () -- C:\Users\Karén\Desktop\DSC00233.jpg
[2012.09.30 09:56:36 | 002,883,584 | ---- | M] () -- C:\Users\Karén\ntuser.rbt
[2012.09.29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.24 20:05:59 | 000,001,085 | ---- | M] () -- C:\Windows\unins000.dat
[2012.09.24 20:05:53 | 000,692,505 | ---- | M] () -- C:\Windows\unins000.exe
 
========== Files Created - No Company Name ==========
 
[2012.10.22 19:02:46 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012.10.22 18:28:46 | 000,000,886 | ---- | C] () -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
[2012.10.21 08:07:29 | 000,415,877 | ---- | C] () -- C:\Windows\SysNative\drivers\vsconfig.xml
[2012.10.21 08:06:54 | 000,000,762 | ---- | C] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2012.10.17 19:39:50 | 000,274,061 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2012.10.16 19:16:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.10.16 19:16:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysNative\ativvsvl.dat
[2012.10.16 19:16:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.10.16 19:16:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysNative\ativvsva.dat
[2012.10.16 19:16:15 | 002,915,680 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap
[2012.10.16 19:16:13 | 002,886,016 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap
[2012.10.16 19:16:10 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012.10.16 19:16:10 | 000,003,917 | ---- | C] () -- C:\Windows\SysNative\atipblag.dat
[2012.10.16 19:16:03 | 000,038,204 | ---- | C] () -- C:\Windows\atiogl.xml
[2012.10.16 19:15:57 | 000,632,252 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat
[2012.10.16 19:15:48 | 000,300,864 | ---- | C] () -- C:\Windows\SysWow64\atiapfxx.blb
[2012.10.16 19:15:48 | 000,300,864 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb
[2012.10.16 19:10:37 | 000,002,562 | ---- | C] () -- C:\Windows\diagwrn.xml
[2012.10.16 19:10:37 | 000,001,908 | ---- | C] () -- C:\Windows\diagerr.xml
[2012.10.12 21:17:01 | 000,000,020 | ---- | C] () -- C:\Windows\8ùÛ
[2012.10.09 20:06:04 | 000,001,972 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2012.10.07 22:29:29 | 005,287,936 | ---- | C] () -- C:\Users\Karén\Desktop\digimon world trainer.EXE
[2012.10.05 15:07:31 | 000,000,799 | ---- | C] () -- C:\Users\Public\Desktop\DS3 Tool.lnk
[2012.10.05 14:24:14 | 000,033,792 | ---- | C] () -- C:\Windows\SysWow64\drivers\libusb0.sys
[2012.10.05 14:03:20 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2012.10.05 14:03:19 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_MijXfilt_01009.Wdf
[2012.10.05 11:24:45 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.10.05 11:19:40 | 000,000,806 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.03 16:25:02 | 000,533,031 | ---- | C] () -- C:\Users\Karén\Desktop\DSC00233.jpg
[2012.09.30 12:16:17 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000UA.job
[2012.09.30 12:16:16 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000Core.job
[2012.09.24 20:05:59 | 000,692,505 | ---- | C] () -- C:\Windows\unins000.exe
[2012.09.24 20:05:59 | 000,001,085 | ---- | C] () -- C:\Windows\unins000.dat
[2012.09.24 16:23:18 | 000,922,579 | ---- | C] () -- C:\Users\Karén\Desktop\Abitur Karen Rodloff.pdf
[2012.07.29 16:19:01 | 000,000,220 | ---- | C] () -- C:\Users\Karén\AppData\Roaming\sqlite3Explorer.xml
[2012.07.11 18:52:08 | 000,000,116 | ---- | C] () -- C:\Users\Karén\SciTE.session
[2012.07.01 09:40:58 | 000,001,884 | ---- | C] () -- C:\Windows\wininit.ini
[2012.01.31 19:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.01.31 19:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.01.31 19:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.01.31 19:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.01.31 19:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.01.27 00:16:00 | 000,000,859 | ---- | C] () -- C:\Users\Karén\.recently-used.xbel
[2012.01.26 22:42:58 | 000,008,229 | ---- | C] () -- C:\Windows\aiptbl.ini
[2012.01.15 16:59:22 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2012.01.11 09:51:54 | 000,001,232 | ---- | C] () -- C:\Windows\SplitCam.INI
[2012.01.08 18:14:22 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011.10.06 23:54:47 | 000,532,480 | ---- | C] () -- C:\Windows\SysWow64\CddbPlaylist2Sony.dll
[2011.08.31 15:29:00 | 004,023,808 | ---- | C] () -- C:\Windows\SysWow64\x264vfw.dll
[2011.08.23 22:14:14 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2011.08.23 22:14:14 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2011.07.13 14:31:25 | 000,056,880 | ---- | C] () -- C:\Windows\SysWow64\scvideo.dll
[2011.07.12 17:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011.07.04 22:50:18 | 000,001,890 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2011.07.04 22:50:18 | 000,000,088 | RHS- | C] () -- C:\ProgramData\32C8CE64B1.sys
[2011.07.04 22:39:01 | 000,000,056 | RHS- | C] () -- C:\Windows\SysWow64\07418D9D2A.sys
[2011.07.04 22:38:58 | 000,001,890 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2011.07.03 20:48:42 | 000,147,456 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2011.06.27 17:07:27 | 001,367,040 | ---- | C] () -- C:\Windows\SysWow64\VitaminCtrl.dll
[2011.06.17 07:26:10 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.06.17 07:17:28 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.04.13 11:22:21 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.11 08:31:46 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.04.11 07:40:36 | 002,883,584 | ---- | C] () -- C:\Users\Karén\ntuser.rbt
[2011.03.21 19:56:22 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.01.04 15:28:18 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.12.08 11:15:32 | 000,000,267 | ---- | C] () -- C:\Windows\LaunApp.ini
[2010.12.08 11:08:30 | 000,001,550 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2010.12.08 02:42:51 | 000,206,208 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2010.12.08 02:42:51 | 000,000,302 | ---- | C] () -- C:\Windows\PidList_C.ini
[2010.12.08 02:35:57 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
         

Die Firma dankt

O1 - Hosts: 127.0.0.1 secure.tune-up.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 www.practivate.adobe.com
O1 - Hosts: 127.0.0.1 hxxp://practivate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 www.practivate.adobe.com
O1 - Hosts: 127.0.0.1 https://practivate.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 Registration
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

nicht schön. Adobe Software gecracked?

nein eigentlich nicht das ich wüsste o.O hab mir mal wegen nem spiel oder sowas ne hosts datei aus dem internet runtergeladen und eine automatische Verbindung zu unterbinden. War irgend so ein Strategie spiel was man einzelspieler aber auch im internet spielen konnte, und da hat auch bei einzelspieler immer mit dem internet verbunden und daten an einen server gesendet. da wird das dann wohl dabei gewesen sein.

Ehm...naja

Deinstalliere alles von Zone-Alarm und alle alten Java Versionen. Du brauchst Zone Alarm nicht, du hast ja Emsisoft drauf.

Fixen mit OTL

• Starte die OTL.exe.
• Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
• Kopiere folgendes Skript:

:Commands
[resethosts]
[emptytemp]
         

• und füge es hier ein:
• Schließe alle Programme.
• Klicke auf den Fix Button.
• Klick auf .
• OTL verlangt einen Neustart. Bitte zulassen.
• Nach dem Neustart findest Du ein Textdokument.

POste nun einf risches OTL logfile.

ich weiss hört sich komisch an, aber mir war das damals suspekt und ich wollte es unterbinden^^

zonealarm ist mein antiviren programm mit aktivem guard. emsisoft ist nur die gratis version als zusätzlichen scanner daher brauche ich zonealarm. deinstalliere jetzt alle alten java versionen (hatte mal irgendwo gelesen man soll altes java und net framework auf keinen fall deinstallieren) und versuche dann den fix mit OTL. melde mich dann sofort zurück, danke schonmal ich hoffe es klappt.

All processes killed
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Karén
->Temp folder emptied: 23882797 bytes
->Temporary Internet Files folder emptied: 2333674 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 78523151 bytes
->Google Chrome cache emptied: 373015179 bytes
->Apple Safari cache emptied: 37888 bytes
->Flash cache emptied: 1047 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2529276 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 551 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 458,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 10232012_171446

Files\Folders moved on Reboot...
C:\Users\Karén\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

edit: hab jetzt ne weile gewartet, und der trojaner kommt auf jedenfall immernoch wieder.

Dann deinstalliere Emsisoft, das is auch aktiv.

Frisches OTL Logfile bitte.

emsisoft wird bei mir nicht mit windows gestartet, es wird nur ab und zu zum scannen verwendet^^

OTL logfile created on: 23.Okt.2012 20:58:31 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Karén\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MMM.yyyy
 
4,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 34,99% Memory free
9,99 Gb Paging File | 6,62 Gb Available in Paging File | 66,29% Paging File free
Paging file location(s): c:\pagefile.sys 6141 6141 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 156,52 Gb Total Space | 111,74 Gb Free Space | 71,39% Space Free | Partition Type: NTFS
Drive E: | 407,33 Gb Total Space | 239,08 Gb Free Space | 58,69% Space Free | Partition Type: NTFS
Drive G: | 232,88 Gb Total Space | 93,76 Gb Free Space | 40,26% Space Free | Partition Type: NTFS
 
Computer Name: TIMCAMPYIII | User Name: Karén | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Karén\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Emsisoft GmbH)
PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)
PRC - E:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - E:\Program Files (x86)\GhostMouse\GhostMouse.exe ()
PRC - C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoUpdateCheck.exe (TuneUp Software)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\pdf.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\libglesv2.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\libegl.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\avutil-51.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\avformat-54.dll ()
MOD - C:\Users\Karén\AppData\Local\Google\Chrome\Application\22.0.1229.94\avcodec-54.dll ()
MOD - C:\Program Files (x86)\Windows Live\Writer\de\WindowsLive.Writer.Localization.resources.dll ()
MOD - C:\Program Files (x86)\Windows Live\Writer\en\WindowsLive.Writer.Localization.resources.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - E:\Program Files (x86)\GhostMouse\GhostMouse.exe ()
MOD - E:\Program Files (x86)\wLite\IPCameraRTSP.ax ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (WTService) -- C:\Windows\SysNative\atwtusb.exe ()
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vsmon) -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (a2AntiMalware) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)
SRV - (MBAMService) -- E:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- E:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (IswSvc) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (SbieSvc) -- E:\Program Files\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Live Updater Service) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe (Acer Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (wxpSvc) -- E:\Program Files (x86)\wLite\wService.exe (Moonware Studios)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (rpcapd) -- C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (ePowerSvc) -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe (Acer Incorporated)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (GREGService) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SSScsiSV) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SSScsiSV.exe (Sony Corporation)
SRV - (SonicStage Back-End Service) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SsBeSvc.exe (Sony Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files (x86)\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (HWiNFO32) -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS (REALiX(tm))
DRV:64bit: - (MotioninJoyXFilter) -- C:\Windows\SysNative\drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (pwdrvio) -- C:\Windows\SysNative\pwdrvio.sys ()
DRV:64bit: - (pwdspio) -- C:\Windows\SysNative\pwdspio.sys ()
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (ssudobex) -- C:\Windows\SysNative\drivers\ssudobex.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (mcdevice) -- C:\Windows\SysNative\drivers\mcdevice.sys (ShiningMorning Inc.)
DRV:64bit: - (Vsdatant) -- C:\Windows\SysNative\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (regi) -- C:\Windows\SysNative\drivers\regi.sys (InterVideo)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc)
DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (ss_bmdm) -- C:\Windows\SysNative\drivers\ss_bmdm.sys (MCCI Corporation)
DRV:64bit: - (ss_bbus) -- C:\Windows\SysNative\drivers\ss_bbus.sys (MCCI)
DRV:64bit: - (ss_bmdfl) -- C:\Windows\SysNative\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\drivers\walvhid.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (moufiltr) -- C:\Windows\SysNative\drivers\moufiltr.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\ManyCam_x64.sys (ManyCam LLC.)
DRV:64bit: - (SNPSTD3) -- C:\Windows\SysNative\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (DrvAgent64) -- C:\Windows\SysWOW64\drivers\DrvAgent64.SYS (Phoenix Technologies)
DRV - (ISWKL) -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (SbieDrv) -- E:\Program Files\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D)
DRV - (a2acc) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys (Emsisoft GmbH)
DRV - (a2injectiondriver) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys (Emsisoft GmbH)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (A2DDA) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys (Emsi Software GmbH)
DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc)
DRV - (a2util) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys (Emsi Software GmbH)
DRV - ({B154377D-700F-42cc-9474-23858FBDF4BD}) -- E:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9\000.fcl (CyberLink Corp.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (libusb0) -- C:\Windows\SysWOW64\drivers\libusb0.sys ()
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = hxxp://search.yahoo.com/search?fr=chr-panda&q={searchTerms}&ei=UTF-8&type=PCAFSI1190
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost; 127.0.0.1; <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledAddons: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.5.0.4
FF - prefs.js..network.proxy.http: "77.81.242.26"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.type: 1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: E:\Program Files (x86)\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Karén\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Karén\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll File not found
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2012.10.21 08:05:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2012.10.21 08:05:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: E:\Program Files (x86)\Mozilla Firefox\components [2012.10.22 19:09:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: E:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.23 16:59:38 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: E:\Program Files (x86)\Mozilla Firefox\components [2012.10.22 19:09:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: E:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.23 16:59:38 | 000,000,000 | ---D | M]
 
[2012.04.10 12:53:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karén\AppData\Roaming\mozilla\Extensions
[2012.08.20 00:07:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karén\AppData\Roaming\mozilla\Firefox\Profiles\7gq146r9.default\extensions
[2012.08.20 00:07:51 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Karén\AppData\Roaming\mozilla\Firefox\Profiles\7gq146r9.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2012.07.25 14:49:12 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Karén\AppData\Roaming\mozilla\firefox\profiles\7gq146r9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
File not found (No name found) -- C:\USERS\KARéN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7GQ146R9.DEFAULT\EXTENSIONS\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
 
========== Chrome  ==========
 
CHR - homepage: 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Uplay PC (Enabled) = C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Kar\u00E9n\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Kar\u00E9n\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: DivX Web Player (Enabled) = E:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
CHR - plugin: Java(TM) Platform SE 7 U1 (Enabled) = E:\Program Files (x86)\java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Radio Player Live = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\boidnimkebefpfgbeekbjoponilnomle\2.1.7_0\
CHR - Extension: Proxy Switchy! = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\caehdcpeofiiigpdhbabniblemipncjj\1.6.3_0\
CHR - Extension: Google-Suche = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.45_0\
CHR - Extension: Google Mail = C:\Users\Karén\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.10.23 17:14:46 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\java\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\java\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [MacroKeyManager] C:\Windows\SysNative\WTMKM.exe ()
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files (x86)\emsisoft anti-malware\a2guard.exe (Emsisoft GmbH)
O4 - HKLM..\Run: [VirtualCloneDrive] "E:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s                                                                                                                                                                                               File not found
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Karén\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [SandboxieControl] E:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Mit Mipony herunterladen - Reg Error: Value error. File not found
O8 - Extra context menu item: Mit Mipony herunterladen - Reg Error: Value error. File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1145ED73-48C0-443B-9FA7-496190E3DFE8}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F036A5BD-B337-4F22-AAAF-84533673F44A}: DhcpNameServer = 139.7.30.126 139.7.30.125
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\bejeweled 2 deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\build-a-lot 2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\chuzzle deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\deathonthenile-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\diner dash 2 restaurant rescue-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\drivegreen1-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\farm-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\fate-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\fileencrypt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\filesplitter.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\gameconsole-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\golf-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\helplauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\hpwucli.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\insaniquarium-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\integrator.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\jqsolitaire2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\kies.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\log viewer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\messenger plus! for skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mobileconnect.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mptools.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\omg2oma.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\omgbkup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\omgjbox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\penguins-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\photoshop elements 8.0.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\photoshopelementseditor.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\photoshopelementsorganizer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\plants vs. zombies-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\polar-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\provider.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\racing-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\setup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\steam.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\unins000.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\vcdprefs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\vcd-uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\virtual villagers - the tree of life-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\zuma deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\zumasrevenge-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\bejeweled 2 deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\build-a-lot 2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\chuzzle deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\deathonthenile-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\diner dash 2 restaurant rescue-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\drivegreen1-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\farm-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\fate-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\fileencrypt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\filesplitter.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\gameconsole-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\golf-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\helplauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\hpwucli.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\insaniquarium-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\integrator.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\jqsolitaire2-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\kies.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\log viewer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\messenger plus! for skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mobileconnect.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mptools.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\omg2oma.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\omgbkup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\omgjbox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\penguins-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\photoshop elements 8.0.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\photoshopelementseditor.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\photoshopelementsorganizer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\plants vs. zombies-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\polar-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\provider.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\racing-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\setup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\steam.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\unins000.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\vcdprefs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\vcd-uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\virtual villagers - the tree of life-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\zuma deluxe-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\zumasrevenge-wt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{20ca4f1d-cd97-11e0-b449-206a8a24457b}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.23 17:14:46 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.10.22 22:09:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2012.10.22 22:09:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinPcap
[2012.10.22 22:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.10.22 22:06:07 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.10.22 20:07:26 | 000,000,000 | ---D | C] -- C:\Windows\en
[2012.10.22 20:06:21 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2012.10.22 20:06:01 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012.10.22 20:04:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2012.10.22 20:00:38 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2012.10.22 19:42:44 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Karén\Desktop\OTL.exe
[2012.10.22 19:08:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.10.22 19:08:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2012.10.22 19:03:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2012.10.22 19:02:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012.10.22 18:51:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2012.10.22 18:49:23 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.22 18:49:23 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.22 18:49:02 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.22 18:49:02 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.22 18:49:02 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.22 18:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.10.21 08:07:25 | 000,011,864 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kl2.sys
[2012.10.21 08:07:24 | 000,460,888 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kl1.sys
[2012.10.21 08:07:20 | 000,485,680 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.10.21 08:06:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2012.10.21 08:05:38 | 000,000,000 | ---D | C] -- C:\Users\Karén\Documents\ForceField Shared Files
[2012.10.21 08:05:37 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\CheckPoint
[2012.10.21 08:04:15 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2012.10.21 08:01:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CheckPoint
[2012.10.21 08:01:25 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2012.10.18 17:24:51 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{46BE5FF4-4048-4834-A204-D09A1B533AB9}
[2012.10.18 16:36:02 | 000,000,000 | ---D | C] -- C:\Users\Karén\Documents\ArcSoft
[2012.10.17 22:35:07 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.10.17 22:35:07 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\MFAData
[2012.10.17 22:35:07 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012.10.17 22:35:07 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Avg2013
[2012.10.17 21:05:38 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\ElevatedDiagnostics
[2012.10.17 20:29:42 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{CB0CD61E-AE47-42D9-B7B8-8630773BAEEF}
[2012.10.17 19:39:57 | 002,672,744 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll
[2012.10.17 19:39:52 | 003,608,680 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll
[2012.10.17 19:39:50 | 001,261,160 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll
[2012.10.17 19:39:49 | 004,784,640 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoRes64.dat
[2012.10.17 19:39:49 | 000,103,528 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInstII64.dll
[2012.10.17 19:39:44 | 001,345,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek264.dll
[2012.10.17 19:39:41 | 001,015,640 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2012.10.17 19:39:39 | 002,533,952 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2012.10.16 19:23:07 | 000,090,112 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\AtihdW76.sys
[2012.10.16 19:16:16 | 000,109,568 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll
[2012.10.16 19:16:16 | 000,070,144 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst_9.001.dll
[2012.10.16 19:16:11 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2012.10.16 19:16:04 | 019,624,960 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atioglxx.dll
[2012.10.16 19:16:02 | 023,825,920 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atio6axx.dll
[2012.10.16 19:15:59 | 000,459,776 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys
[2012.10.16 19:15:59 | 000,056,832 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll
[2012.10.16 19:15:59 | 000,056,832 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll
[2012.10.16 19:15:59 | 000,056,320 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll
[2012.10.16 19:15:59 | 000,056,320 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll
[2012.10.16 19:15:59 | 000,021,504 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2012.10.16 19:15:58 | 010,695,168 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys
[2012.10.16 19:15:57 | 000,041,984 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll
[2012.10.16 19:15:57 | 000,033,280 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll
[2012.10.16 19:15:57 | 000,017,920 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll
[2012.10.16 19:15:57 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll
[2012.10.16 19:15:57 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiglpxx.dll
[2012.10.16 19:15:56 | 000,059,392 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll
[2012.10.16 19:15:55 | 006,477,824 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atidxx32.dll
[2012.10.16 19:15:54 | 001,120,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\aticfx64.dll
[2012.10.16 19:15:54 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atidemgy.dll
[2012.10.16 19:15:53 | 000,934,912 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\aticfx32.dll
[2012.10.16 19:15:53 | 000,051,200 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll
[2012.10.16 19:15:53 | 000,046,080 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll
[2012.10.16 19:15:52 | 016,082,432 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll
[2012.10.16 19:15:50 | 013,703,168 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll
[2012.10.16 19:15:49 | 000,163,840 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiapfxx.exe
[2012.10.16 19:15:49 | 000,044,544 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll
[2012.10.16 19:15:49 | 000,044,032 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll
[2012.10.16 19:15:48 | 000,405,504 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll
[2012.10.16 19:15:48 | 000,053,248 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll
[2012.10.16 19:15:48 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll
[2012.10.16 19:06:20 | 000,000,000 | ---D | C] -- C:\Users\Karén\Documents\My Drivers
[2012.10.16 18:37:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{7021FCDB-47B5-4386-BC3E-B11344759E86}
[2012.10.16 18:34:01 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Innovative Solutions
[2012.10.16 18:34:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax
[2012.10.16 18:12:22 | 000,696,760 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.16 18:12:22 | 000,073,656 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.15 20:44:08 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{F0CB52AE-B1DA-47B2-B9D2-D8F02EB0433F}
[2012.10.15 20:34:28 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Sun
[2012.10.14 19:50:53 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{DD2B6863-E057-4244-B968-F29990C51FBD}
[2012.10.14 09:44:16 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{909D5AB7-5E1E-4D23-8054-FDB106B84BBA}
[2012.10.14 01:30:50 | 000,000,000 | ---D | C] -- C:\Users\Karén\Desktop\uhg
[2012.10.13 21:22:21 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{DC28CA75-63AC-468B-B278-E1DBFA5E0C3F}
[2012.10.13 18:09:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Packard Bell
[2012.10.13 17:05:16 | 000,021,712 | ---- | C] (Phoenix Technologies) -- C:\Windows\SysWow64\drivers\DrvAgent64.SYS
[2012.10.13 17:05:16 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\eSupport.com
[2012.10.12 22:39:06 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\ArcSoft
[2012.10.12 22:21:53 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\ArcSoft
[2012.10.12 22:21:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ArcSoft
[2012.10.12 22:17:26 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Downloaded Installations
[2012.10.11 21:14:43 | 000,030,592 | ---- | C] (REALiX(tm)) -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS
[2012.10.11 21:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
[2012.10.11 18:42:29 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{9F1AB58F-8E5E-492E-8AB9-3C82A67BF22B}
[2012.10.10 16:56:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{E94AEFD4-FED8-40B6-8FFA-50752FC5B99C}
[2012.10.10 16:26:23 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 16:26:20 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.10 16:26:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 16:26:03 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 16:26:03 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 16:26:03 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 16:26:02 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 16:25:59 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 16:25:59 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 16:25:58 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 16:25:57 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 16:25:57 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 16:25:57 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 16:25:56 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 16:25:56 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 16:25:56 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 16:25:56 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 16:25:55 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 16:25:55 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 16:25:55 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 16:25:55 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 16:25:55 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 16:25:54 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 16:25:54 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 16:25:54 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 16:25:54 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 16:25:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 16:25:52 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 16:25:52 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 16:25:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 16:25:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 16:25:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 16:25:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 16:25:49 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 16:25:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 16:25:47 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 16:25:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 16:25:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 16:25:43 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 16:25:41 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 16:25:41 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 16:25:41 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 16:25:40 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 16:25:40 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 16:25:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 16:25:40 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 16:25:39 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 16:25:38 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 16:25:38 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 16:25:36 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 16:25:36 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 16:25:36 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 16:25:35 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 16:25:34 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 16:25:33 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 16:25:04 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 16:24:22 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 16:24:16 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.09 20:08:05 | 000,000,000 | R--D | C] -- C:\Sandbox
[2012.10.09 20:00:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
[2012.10.07 18:42:13 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{9184F5AD-CCCC-4A63-B0CE-E1123089A4BA}
[2012.10.07 11:49:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PopCap Games
[2012.10.05 15:07:30 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\MotioninJoy
[2012.10.05 15:07:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
[2012.10.05 15:07:29 | 000,121,416 | ---- | C] (MotioninJoy) -- C:\Windows\SysNative\drivers\MijXfilt.sys
[2012.10.05 14:24:14 | 000,046,592 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysWow64\libusb0.dll
[2012.10.05 14:23:49 | 000,000,000 | ---D | C] -- C:\Users\Karén\Desktop\ps3 treiber
[2012.10.05 14:00:23 | 000,328,712 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\MijFrc.dll
[2012.10.05 14:00:22 | 000,074,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\xusb21.sys
[2012.10.05 11:24:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2012.10.05 11:19:55 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Malwarebytes
[2012.10.05 11:19:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.05 11:19:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.05 11:19:38 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.04 16:43:49 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{26C1F9DF-10D7-4D73-92F9-C3B767CAAA8F}
[2012.10.03 18:42:02 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{675B1AA4-2B46-4CEB-B03E-884E720A468E}
[2012.10.03 17:40:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Veoh Networks
[2012.10.03 17:40:04 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\OpenCandy
[2012.10.02 16:17:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{A592CE45-3F52-42F5-A696-BF8983E04836}
[2012.10.01 18:56:14 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{4487C815-2166-41C7-9CF9-C17010500BBB}
[2012.09.30 22:58:40 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Facebook
[2012.09.30 20:00:03 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{D12C0C11-8616-430B-A90A-DB7CB7CFDF1D}
[2012.09.30 12:19:16 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kill-ID für Chrome
[2012.09.30 12:17:12 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.09.30 12:16:15 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\Google
[2012.09.30 11:53:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.2
[2012.09.30 09:24:46 | 000,000,000 | ---D | C] -- C:\Windows\MiniDump
[2012.09.29 20:43:34 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{73E01E69-71A7-4DE3-A2B3-C45020375C8E}
[2012.09.28 20:40:30 | 000,000,000 | ---D | C] -- C:\Users\Karén\Desktop\SpeedCrunch-0.10.1
[2012.09.28 16:29:17 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{BF91662F-96D0-4DDB-B5EC-5B78932327AA}
[2012.09.27 20:10:55 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox
[2012.09.27 20:04:43 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Roaming\JonDo
[2012.09.27 19:25:10 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{059F688B-3F7B-419E-A733-E7790E74C430}
[2012.09.26 17:07:19 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.26 17:02:59 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{A5D961C2-8D97-44B1-9C0B-3A932850C7C0}
[2012.09.25 16:00:26 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{55228BAF-434C-437E-8D28-5815559E0DB3}
[2012.09.24 20:05:59 | 000,047,104 | ---- | C] (frozenlogic.org) -- C:\Windows\SummerProperties.dll
[2012.09.24 18:59:31 | 000,000,000 | ---D | C] -- C:\Users\Karén\AppData\Local\{0D3019A6-4CE9-49C6-B58C-3302D1593A4D}
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.23 20:27:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000UA.job
[2012.10.23 18:05:47 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.23 18:05:47 | 000,697,082 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.23 18:05:47 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.23 18:05:47 | 000,148,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.23 18:05:47 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.23 17:45:42 | 000,044,052 | ---- | M] () -- C:\Users\Karén\Desktop\bookmarks_23.10.12.html
[2012.10.23 17:41:58 | 000,002,562 | ---- | M] () -- C:\Windows\diagwrn.xml
[2012.10.23 17:41:58 | 000,001,908 | ---- | M] () -- C:\Windows\diagerr.xml
[2012.10.23 17:24:14 | 000,025,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.23 17:24:13 | 000,025,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.23 17:16:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.23 17:14:46 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2012.10.23 17:14:36 | 000,002,062 | ---- | M] () -- C:\Windows\Sandboxie.ini
[2012.10.22 18:48:47 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.22 18:48:43 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.22 18:48:43 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.22 18:48:43 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.22 18:48:42 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.22 18:48:42 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2012.10.21 23:08:22 | 000,415,877 | ---- | M] () -- C:\Windows\SysNative\drivers\vsconfig.xml
[2012.10.21 08:06:54 | 000,000,762 | ---- | M] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2012.10.17 22:40:55 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Karén\Desktop\OTL.exe
[2012.10.16 18:12:22 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.16 18:12:22 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.14 12:27:03 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000Core.job
[2012.10.13 17:05:16 | 000,021,712 | ---- | M] (Phoenix Technologies) -- C:\Windows\SysWow64\drivers\DrvAgent64.SYS
[2012.10.13 14:09:58 | 000,274,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.12 21:50:15 | 000,001,884 | ---- | M] () -- C:\Windows\wininit.ini
[2012.10.12 21:17:01 | 000,000,020 | ---- | M] () -- C:\Windows\8ùÛ
[2012.10.11 21:14:43 | 000,030,592 | ---- | M] (REALiX(tm)) -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS
[2012.10.07 22:20:14 | 005,287,936 | ---- | M] () -- C:\Users\Karén\Desktop\digimon world trainer.EXE
[2012.10.05 15:09:30 | 000,121,416 | ---- | M] (MotioninJoy) -- C:\Windows\SysNative\drivers\MijXfilt.sys
[2012.10.05 15:07:31 | 000,000,799 | ---- | M] () -- C:\Users\Public\Desktop\DS3 Tool.lnk
[2012.10.05 14:03:20 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2012.10.05 14:03:19 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_MijXfilt_01009.Wdf
[2012.10.05 11:24:45 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.10.05 11:19:40 | 000,000,806 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.03 16:25:16 | 000,533,031 | ---- | M] () -- C:\Users\Karén\Desktop\DSC00233.jpg
[2012.09.30 09:56:36 | 002,883,584 | ---- | M] () -- C:\Users\Karén\ntuser.rbt
[2012.09.29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.24 20:05:59 | 000,001,085 | ---- | M] () -- C:\Windows\unins000.dat
[2012.09.24 20:05:53 | 000,692,505 | ---- | M] () -- C:\Windows\unins000.exe
 
========== Files Created - No Company Name ==========
 
[2012.10.23 17:45:42 | 000,044,052 | ---- | C] () -- C:\Users\Karén\Desktop\bookmarks_23.10.12.html
[2012.10.22 20:05:46 | 000,001,277 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
[2012.10.22 20:05:12 | 000,001,346 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
[2012.10.22 19:02:46 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012.10.22 18:28:46 | 000,000,886 | ---- | C] () -- C:\Users\Karén\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
[2012.10.21 08:07:29 | 000,415,877 | ---- | C] () -- C:\Windows\SysNative\drivers\vsconfig.xml
[2012.10.21 08:06:54 | 000,000,762 | ---- | C] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2012.10.17 19:39:50 | 000,274,061 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2012.10.16 19:16:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.10.16 19:16:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysNative\ativvsvl.dat
[2012.10.16 19:16:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.10.16 19:16:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysNative\ativvsva.dat
[2012.10.16 19:16:15 | 002,915,680 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap
[2012.10.16 19:16:13 | 002,886,016 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap
[2012.10.16 19:16:10 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012.10.16 19:16:10 | 000,003,917 | ---- | C] () -- C:\Windows\SysNative\atipblag.dat
[2012.10.16 19:16:03 | 000,038,204 | ---- | C] () -- C:\Windows\atiogl.xml
[2012.10.16 19:15:57 | 000,632,252 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat
[2012.10.16 19:15:48 | 000,300,864 | ---- | C] () -- C:\Windows\SysWow64\atiapfxx.blb
[2012.10.16 19:15:48 | 000,300,864 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb
[2012.10.16 19:10:37 | 000,002,562 | ---- | C] () -- C:\Windows\diagwrn.xml
[2012.10.16 19:10:37 | 000,001,908 | ---- | C] () -- C:\Windows\diagerr.xml
[2012.10.12 21:17:01 | 000,000,020 | ---- | C] () -- C:\Windows\8ùÛ
[2012.10.09 20:06:04 | 000,002,062 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2012.10.07 22:29:29 | 005,287,936 | ---- | C] () -- C:\Users\Karén\Desktop\digimon world trainer.EXE
[2012.10.05 15:07:31 | 000,000,799 | ---- | C] () -- C:\Users\Public\Desktop\DS3 Tool.lnk
[2012.10.05 14:24:14 | 000,033,792 | ---- | C] () -- C:\Windows\SysWow64\drivers\libusb0.sys
[2012.10.05 14:03:20 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2012.10.05 14:03:19 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_MijXfilt_01009.Wdf
[2012.10.05 11:24:45 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.10.05 11:19:40 | 000,000,806 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.03 16:25:02 | 000,533,031 | ---- | C] () -- C:\Users\Karén\Desktop\DSC00233.jpg
[2012.09.30 12:16:17 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000UA.job
[2012.09.30 12:16:16 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1262013316-4077628313-1536609303-1000Core.job
[2012.09.24 20:05:59 | 000,692,505 | ---- | C] () -- C:\Windows\unins000.exe
[2012.09.24 20:05:59 | 000,001,085 | ---- | C] () -- C:\Windows\unins000.dat
[2012.07.29 16:19:01 | 000,000,220 | ---- | C] () -- C:\Users\Karén\AppData\Roaming\sqlite3Explorer.xml
[2012.07.11 18:52:08 | 000,000,116 | ---- | C] () -- C:\Users\Karén\SciTE.session
[2012.07.01 09:40:58 | 000,001,884 | ---- | C] () -- C:\Windows\wininit.ini
[2012.01.31 19:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.01.31 19:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.01.31 19:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.01.31 19:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.01.31 19:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.01.27 00:16:00 | 000,000,859 | ---- | C] () -- C:\Users\Karén\.recently-used.xbel
[2012.01.26 22:42:58 | 000,008,229 | ---- | C] () -- C:\Windows\aiptbl.ini
[2012.01.15 16:59:22 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2012.01.11 09:51:54 | 000,001,232 | ---- | C] () -- C:\Windows\SplitCam.INI
[2012.01.08 18:14:22 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011.10.06 23:54:47 | 000,532,480 | ---- | C] () -- C:\Windows\SysWow64\CddbPlaylist2Sony.dll
[2011.08.31 15:29:00 | 004,023,808 | ---- | C] () -- C:\Windows\SysWow64\x264vfw.dll
[2011.08.23 22:14:14 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2011.08.23 22:14:14 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2011.07.13 14:31:25 | 000,056,880 | ---- | C] () -- C:\Windows\SysWow64\scvideo.dll
[2011.07.12 17:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011.07.04 22:50:18 | 000,001,890 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2011.07.04 22:50:18 | 000,000,088 | RHS- | C] () -- C:\ProgramData\32C8CE64B1.sys
[2011.07.04 22:39:01 | 000,000,056 | RHS- | C] () -- C:\Windows\SysWow64\07418D9D2A.sys
[2011.07.04 22:38:58 | 000,001,890 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2011.07.03 20:48:42 | 000,147,456 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2011.06.27 17:07:27 | 001,367,040 | ---- | C] () -- C:\Windows\SysWow64\VitaminCtrl.dll
[2011.06.17 07:26:10 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.06.17 07:17:28 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.04.13 11:22:21 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.11 08:31:46 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.04.11 07:40:36 | 002,883,584 | ---- | C] () -- C:\Users\Karén\ntuser.rbt
[2011.03.21 19:56:22 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.01.04 15:28:18 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.12.08 11:15:32 | 000,000,267 | ---- | C] () -- C:\Windows\LaunApp.ini
[2010.12.08 11:08:30 | 000,001,550 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2010.12.08 02:42:51 | 000,206,208 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2010.12.08 02:42:51 | 000,000,302 | ---- | C] () -- C:\Windows\PidList_C.ini
[2010.12.08 02:35:57 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
         

OTL Extras logfile created on: 23.Okt.2012 20:58:31 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Karén\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MMM.yyyy
 
4,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 34,99% Memory free
9,99 Gb Paging File | 6,62 Gb Available in Paging File | 66,29% Paging File free
Paging file location(s): c:\pagefile.sys 6141 6141 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 156,52 Gb Total Space | 111,74 Gb Free Space | 71,39% Space Free | Partition Type: NTFS
Drive E: | 407,33 Gb Total Space | 239,08 Gb Free Space | 58,69% Space Free | Partition Type: NTFS
Drive G: | 232,88 Gb Total Space | 93,76 Gb Free Space | 40,26% Space Free | Partition Type: NTFS
 
Computer Name: TIMCAMPYIII | User Name: Karén | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 1
"DefaultInboundAction" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe:*:Enabled:Spybot-S&D 2 Firewall service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe:*:Enabled:Spybot-S&D 2 On-Access monitor service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe:*:Enabled:Spybot-S&D 2 Scan On Demand service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe:*:Enabled:Spybot-S&D 2 Firewall service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe:*:Enabled:Spybot-S&D 2 On-Access monitor service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDSODSvc.exe:*:Enabled:Spybot-S&D 2 Scan On Demand service
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater
"E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = E:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05D725FA-6A1A-4F2A-B00D-6A98A34092D4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{0D68334A-02BA-4CE0-9724-97921C7A2F65}" = rport=445 | protocol=6 | dir=out | app=system | 
"{0EA1FA3E-C0FE-4CD8-BCEF-9FD70A3C27A1}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{10E97E26-94FF-4E44-B86D-334865D69FDE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{13DDA003-0B88-451D-A4C2-5063260E67D1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1CB502F2-5F2F-412B-8302-421520D23CD2}" = rport=139 | protocol=6 | dir=out | app=system | 
"{2A37D83F-82B3-4770-8D61-05F3FCB9412D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{3271DFF3-5F1C-4BAB-9B29-85C0A5BE90E6}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{35F3181A-4395-4447-8D86-0430D17F7DC9}" = lport=80 | protocol=6 | dir=in | name=http | 
"{375E081F-DB91-492E-B5C2-D5288F8380DA}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{3F81900F-E894-42A8-86E5-AEC11DB35FA6}" = lport=445 | protocol=6 | dir=in | app=system | 
"{4DA5D67C-9DE9-44FE-A33B-CC0515237B68}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{503742D6-F022-4C7F-BFB0-4FCD2D69A93C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{5B4F7888-A41F-4874-BA51-E470FCEB7B03}" = lport=1034 | protocol=6 | dir=in | name=akamai netsession interface | 
"{6DC52A7A-66BC-47C0-9A5D-D4EA1B37CAAB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{75B47968-CB51-4CFD-BCA5-BD2AB4DA72F3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{785160F6-64F6-434C-8966-F2467E025FC1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{81EA5664-9C84-48C7-8AC3-AC82D347023D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8447D85C-C80D-4844-AE4E-47E29B1C6F4C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{84BD9024-C86E-4173-B6B5-5827FFBE93B8}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{86207B32-9D72-4794-A5A3-1385F7E7ACEE}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{8B1B646B-8D57-4C85-9933-FD9603D65DE0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{93BEC3A4-5DBD-4952-AE88-DCD9EDD93447}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{9722B570-4F2D-4985-8DCA-A25E8651F805}" = lport=138 | protocol=17 | dir=in | app=system | 
"{AC1E02BB-6999-47F8-9445-FF4E81D687FA}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{AD3C4A1C-902E-4020-9757-7D4234589825}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B5297963-E51E-4130-AB32-646222D75C20}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{C5914EA9-E813-4EA3-A771-C50639D3D93A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D170404D-09D8-497C-AB2E-347E085ED0B8}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{D9A84746-E88C-49B2-8D83-A7BFE297A246}" = rport=138 | protocol=17 | dir=out | app=system | 
"{E10383C6-A8B0-4121-99E7-224EF88021D0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E5667488-A19F-4308-9057-F28E8B9A5B3E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E5FBE0E9-027E-41EC-BB0E-4DC5D62968E6}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E813604C-6124-423A-9FDB-33045F99B6EC}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{F355E97C-2F2C-43C0-9961-8DE0C760FF7F}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{FB650CD0-43A1-4965-B094-0BEF30A921BF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{FC428F36-E4C2-484C-9781-AE54EE93BCD6}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B2C13C9-E5FD-412C-91B3-A07B2021B0C6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{14AC8E2E-FEDF-470D-B22E-AFB9A81CEFE6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{177EC101-AAB4-46BE-8F7F-B4B54A62A1FF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{18FC673C-E7E5-4224-8E2C-6E339DEA7C78}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{1A410D00-D3B6-4144-8040-ACCCCFA2A704}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{243DBFED-4079-4668-9413-30755C3FDD1B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{24DE5529-2D2F-470A-8F84-785587DCDCAF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{25E358E4-0186-44E5-B048-25E7873487F4}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steam.exe | 
"{274073A9-7BFB-4821-B671-1260DD3836B2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{2836A397-408F-4212-A481-A4B8E2FB71C3}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{2B2E09D5-79B0-453A-8F8F-6005A29AAF63}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3E1862D4-29AC-4065-A6C8-805B2EFC05B3}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe | 
"{4B76CFE7-DD21-48B3-935E-C58DC4CCF221}" = protocol=6 | dir=in | app=e:\program files (x86)\utorrent\utorrent.exe | 
"{4EEDAD19-7D74-48E3-9E64-87E8A14AAFE7}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{4FA29913-5F2B-4ECC-AD36-50C50E27B694}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{513561E8-4C39-402B-B697-E4C472F3040C}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd9\powerdvd9\powerdvd9.exe | 
"{5CAED36A-96C3-4030-AA24-9662D867B245}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5D421EDA-86C3-4DE4-B2AC-89180BBB3E5F}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{5EC6B3D9-D4B9-49E1-8432-9660F4964BCF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{62E0A3CC-AE38-4225-9855-6C599926ABE9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{6D334245-EE04-4E9D-A0A0-008AFBBBE471}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{76F9B7CC-3381-4853-A29D-8BE75AEB0303}" = dir=out | app=%programfiles% (x86)\tuneup utilities 2012\updatewizard.exe | 
"{818449F9-C757-4871-8866-1450F5D60E7F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8259D1CD-7250-4665-AF9E-F365A9FC1D6D}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{82F98093-BA14-455A-8EC9-245B32517721}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{8AB1ACC6-C912-4CC5-A93F-D99208894BF8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{904DE0E9-1107-40BF-8B20-452C58969C1A}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{910D56AE-D4B3-4190-BA07-567CAA76F33A}" = protocol=17 | dir=in | app=e:\program files (x86)\utorrent\utorrent.exe | 
"{9197C95C-E018-4E2D-8C06-EE06D559A564}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{9646F270-AB76-4FFC-873F-6DC03241069F}" = protocol=17 | dir=in | app=e:\program files (x86)\wlite\wlite.exe | 
"{972090BA-CD35-4F86-B679-D4AECF9CCC9E}" = dir=out | app=%programfiles% (x86)\tuneup utilities 2012\silentupdater.exe | 
"{988CBD04-0C31-4B6D-B311-AD9FDFE57263}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{9B5DB2E7-88C1-4544-9A03-AF0CE1E0AD24}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steam.exe | 
"{9FD72E23-CD98-436F-9A8B-7ECD0D2BFD08}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{A260E773-EF50-4960-9FA4-E5FFC5B6D81D}" = protocol=6 | dir=out | app=system | 
"{A2E9B114-7B1D-415D-A85F-589A8FB5549C}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe | 
"{BA38728A-9095-4B1E-8858-3FA511978554}" = protocol=6 | dir=in | app=e:\program files (x86)\wlite\wservice.exe | 
"{BBFDAC9D-3A9D-4560-8A9D-733A020C4688}" = dir=out | app=%programfiles% (x86)\tuneup utilities 2012\integrator.exe | 
"{D1314A37-0E20-421D-AE76-9CAF2C9A4DD8}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D2775DBB-6A68-46C5-ABF3-2D7643F238E1}" = protocol=6 | dir=in | app=e:\program files (x86)\wlite\wlite.exe | 
"{D35E6831-8A74-40E0-BFAF-15D95040E716}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{D566EF6A-BE88-4D33-90AC-421218555761}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) | 
"{DBAD7293-95DE-4CB9-B78F-8C8C7FCB8BB9}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{DC9ABC53-EBA4-48FB-B800-84A231F61BA4}" = protocol=17 | dir=in | app=e:\program files (x86)\wlite\wservice.exe | 
"{E971843F-1C40-4BE0-BBB9-1801197D4F78}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{EBFA4F35-A6DB-448A-AF84-6ADE5755BA99}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{FC355C75-5CF5-4DB3-BA5E-79B3D84F6A3A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{FD05D387-6E10-4332-B603-7DB1BACFACD4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{76845C56-8E22-4658-A146-923813849EBA}E:\program files\java64\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files\java64\bin\javaw.exe | 
"TCP Query User{943740F7-0706-4DA4-86AA-145AF4D75AA1}E:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{ABCD6C0F-1066-4E79-86CC-31769485813E}E:\downloads\utorrentportable\app\utorrent\utorrent.exe" = protocol=6 | dir=in | app=e:\downloads\utorrentportable\app\utorrent\utorrent.exe | 
"TCP Query User{B7E59611-6A00-49EB-BA9F-07712D3F9499}E:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=e:\program files (x86)\java\jre7\bin\java.exe | 
"TCP Query User{BC376C28-BA6D-4330-B942-BF5EE7FF6BCC}C:\users\karén\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\karén\appdata\local\akamai\netsession_win.exe | 
"TCP Query User{C38D1BD3-63E4-4C2E-9D73-559277653A40}E:\downloads\emulatoren\dolphin 3.0\dolphin.exe" = protocol=6 | dir=in | app=e:\downloads\emulatoren\dolphin 3.0\dolphin.exe | 
"TCP Query User{DC4B456E-94B0-4F74-9544-155B6C3D8D19}E:\program files (x86)\java\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\java\bin\javaw.exe | 
"UDP Query User{02F426E2-05B8-4DE4-B586-E7D80E8855C3}E:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=e:\program files (x86)\java\jre7\bin\java.exe | 
"UDP Query User{0B73DE28-FB78-4096-8B5A-F2BC2ED6172D}E:\downloads\emulatoren\dolphin 3.0\dolphin.exe" = protocol=17 | dir=in | app=e:\downloads\emulatoren\dolphin 3.0\dolphin.exe | 
"UDP Query User{2D81BBD2-368B-41AC-A575-3D017900C69B}E:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{90FECAB7-D42F-46FA-A5E9-FAF62A647B01}E:\program files\java64\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files\java64\bin\javaw.exe | 
"UDP Query User{A2CACECF-13C4-4219-B986-DA2221254326}E:\program files (x86)\java\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\java\bin\javaw.exe | 
"UDP Query User{BE6A42B5-55C3-4040-A346-B2D37881C284}E:\downloads\utorrentportable\app\utorrent\utorrent.exe" = protocol=17 | dir=in | app=e:\downloads\utorrentportable\app\utorrent\utorrent.exe | 
"UDP Query User{EBE7522C-4B37-4695-8CAC-1DE06AD4CB16}C:\users\karén\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\karén\appdata\local\akamai\netsession_win.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B1D5174-634F-DAB2-EC67-EAC51F7F0F99}" = AMD Fuel
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{23B01E31-9CBC-53FD-72F4-5CF437DA676F}" = ccc-utility64
"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.6.0003
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{541D3A3F-1FFC-9EB6-6C77-75809AAB87AE}" = ATI Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{66A4349A-AA55-43E5-A781-62867A701A90}" = MacroKey Manager
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{C263ED32-78DB-40EB-8B12-2925C8213E28}" = HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6822EFD-3F7D-4B35-8845-757A26AEC8E2}" = Windows Live MIME IFilter
"97149975-b4b1-4d2b-b9fe-7ba413d0efeb_is1" = SummerProperties 1.2
"CCleaner" = CCleaner
"DriverAgent.exe" = DriverAgent by eSupport.com
"HashTab" = HashTab 4.0.0.2
"HWiNFO64_is1" = HWiNFO64 Version 4.06
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Registry First Aid_is1" = Registry First Aid
"Sandboxie" = Sandboxie 3.74 (64-bit)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.20 (64-bit)
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{006D931C-AD2E-A65F-51E2-AE3FB83CB235}" = CCC Help Hungarian
"{03CC9D58-B132-4CC0-A521-4F3660AA43C7}" = Movie Maker
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1" = MiniTool Partition Wizard Home Edition 7.6
"{075A7877-02CA-4B15-8534-1211712A8E79}" = ZoneAlarm Firewall
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{15EB20D6-5F13-41D0-BEF9-C9C44D6AC620}" = SDFormatter
"{15F3A6F5-06AE-4332-AE3E-21CD0416827A}" = Windows Live Mail
"{18272881-CFC0-434D-A975-E5BE44206AA0}" = Windows Live UX Platform Language Pack
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{1BD9E24B-DB16-491C-8092-F158664BB9F6}" = ZoneAlarm Security
"{1EA7C505-E6DA-4B85-9432-EBD3C70D510D}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23A3E560-069F-4CFC-8F6C-1B526EC735FC}" = Windows Live Writer Resources
"{291447FE-2099-FBAF-CD15-43B98191B097}" = CCC Help English
"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3C3DCD2B-6FC7-41BF-BB80-40A936E1A785}" = Windows Live Writer
"{3CBD94C1-BA15-488C-888B-D8DD296CC6DC}" = Fotogalerie
"{3CFB128F-2E73-7CB3-A2B4-6DE6C70BF1E6}" = Catalyst Control Center InstallProxy
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell Power Management
"{400C31E4-796F-4E86-8FDC-C3C4FACC6847}" = Junk Mail filter update
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4FD0B0CE-BEEE-C3B6-A3B7-6D0A72CA8A6A}" = CCC Help Greek
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}" = RGSS-RTP Standard
"{5B100086-71B6-10B4-0F46-9E637828AFCD}" = CCC Help Portuguese
"{5BABDA39-61CF-41EE-992D-4054B6649A9B}" = Movie Maker
"{5F7CCC36-9B1A-888D-03EE-4EED0D194505}" = Catalyst Control Center Graphics Previews Common
"{690F5BA3-5DEB-42CD-962B-F687EE59FAA7}" = Windows Live Essentials
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{6D172D0A-B9F1-4046-AFAB-8599288545BF}" = Safari
"{70854FE6-3BF1-4C69-94D0-BEB821102E34}" = Windows Live Mail
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B56E98-B4F8-D665-D451-2CB8CFB8AF2C}" = AMD VISION Engine Control Center
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}" = HP Deskjet 2050 J510 series Hilfe
"{7E210E1C-52A1-40E3-817B-D504E9F64DFA}_is1" = Flyff
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management
"{86C40513-B5A4-476E-9EAB-EC118DCF4502}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8913AC02-67B8-4B52-91B2-BBA7B9C265B5}" = Windows Live Writer Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{924C77DE-4C69-FC11-1835-8BD7E65FE2B5}" = CCC Help Polish
"{9532F6E0-ED0A-41A4-87F9-49478E44E8C1}" = ZoneAlarm Antivirus
"{97C79BEC-43F7-4BD8-A6A7-85C0257E488A}" = Windows Live Writer
"{98722C60-1CA9-BE00-D1A6-BEF7F09E4B0F}" = CCC Help Italian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E3301DE-169A-E81D-04DE-38F150AF4A8E}" = Catalyst Control Center Localization All
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.3
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AE364ACC-B9DF-466B-B4EA-AEECD0CD581E}" = Windows Live Messenger
"{B727564C-47D3-473A-AC9E-F4BE7B1BD5D3}" = Windows Live UX Platform Language Pack
"{B80D3EA9-A252-4AE5-AC51-81729F5C586F}" = Windows Live Mail
"{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1" = Emsisoft Anti-Malware
"{C034A6F9-6569-491B-B3BF-F5D15221A708}" = Windows Live Essentials
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C7461496-595D-E1F0-D0BF-549B0AAE00A7}" = CCC Help French
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2C146B1-948D-47EF-8387-5D1C6B980F7C}" = Windows Live Writer
"{D888F114-7537-4D48-AF03-5DA9C82D7540}" = Photo Common
"{DD89CE29-BC88-40C6-A845-E2548682C5D6}" = Alcor Micro USB Card Reader
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1203F8C-FF34-4968-A4A5-B4F1F8533DAB}" = Photo Common
"{E6170043-7909-2B51-919E-CCD74C3A06DA}" = CCC Help Spanish
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Packard Bell Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F51288D5-3735-1DC9-2277-2FC062860216}" = CCC Help German
"{FC6C7107-7D72-41A1-A031-3CE751159BAB}" = Photo Gallery
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CDisplayEx_is1" = CDisplayEx 1.8
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"DMX5_is1" = DriverMax 6
"DRAGON" = DRAGON 1.7
"FileHippo.com" = FileHippo.com Update Checker
"GhostMouse_is1" = GhostMouse
"Glary Utilities_is1" = Glary Utilities 2.32.0.1126
"ImgBurn" = ImgBurn
"InstallShield_{66A4349A-AA55-43E5-A781-62867A701A90}" = MacroKey Manager
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Packard Bell MyBackup
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"InstallShield_{DD89CE29-BC88-40C6-A845-E2548682C5D6}" = Alcor Micro USB Card Reader
"Kill-ID für Chrome_is1" = Kill-ID 1.2.4.0 für Chrome
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Messenger Plus!" = Messenger Plus! 5
"MiniTool Power Data Recovery_is1" = MiniTool Power Data Recovery
"Mozilla Firefox 16.0.1 (x86 de)" = Mozilla Firefox 16.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Packard Bell Registration" = Packard Bell Registration
"PS3 Media Server" = PS3 Media Server
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPGAdvocates_RTP_1.0" = Common RTP 1.0
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"Wireshark" = Wireshark 1.8.3 (64-bit)
"ZoneAlarm Free Antivirus + Firewall" = ZoneAlarm Free Antivirus + Firewall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.Aug.2012 23:38:35 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 19.Aug.2012 10:19:29 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: snes9x.exe, Version: 1.5.2.0, Zeitstempel:
 0x4b51ef5e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00033ab3  ID des fehlerhaften Prozesses:
 0x1228  Startzeit der fehlerhaften Anwendung: 0x01cd7e151781b13f  Pfad der fehlerhaften
 Anwendung: E:\downloads\emulatoren\snes9x-1.52-win32.fix4\snes9x.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: e3229203-ea08-11e1-889f-206a8a24457b
 
Error - 19.Aug.2012 13:00:01 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 20.Aug.2012 03:34:17 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe_Winmgmt, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: wmisvc.dll, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5be102  Ausnahmecode: 0xc0000006  Fehleroffset: 0x000000000000b0b7
ID
 des fehlerhaften Prozesses: 0x1ec  Startzeit der fehlerhaften Anwendung: 0x01cd7ea554fd350d
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften
 Moduls: c:\windows\system32\wbem\wmisvc.dll  Berichtskennung: 7222f4ca-ea99-11e1-ad51-206a8a24457b
 
Error - 20.Aug.2012 03:34:33 | Computer Name = TimcampyIII | Source = Application Error | ID = 1005
Description = Aus einem der folgenden Gründe kann nicht auf die Datei "C:\Windows\System32\wbem\WMIsvc.dll"
 zugegriffen werden:  Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger
 mit der gespeicherten Datei bzw. den auf dem Computer installierten  Speichertreibern,
 oder der Datenträger fehlt.  Das Programm Hostprozess für Windows-Dienste wurde wegen
 dieses Fehlers geschlossen.    Programm: Hostprozess für Windows-Dienste  Datei: C:\Windows\System32\wbem\WMIsvc.dll

Der
 Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.  Benutzeraktion  1. 
Öffnen Sie die Datei erneut.  Diese Situation ist eventuell ein temporäres Problem,
 das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.  2.  Wenn
 Sie weiterhin nicht auf die Datei zugreifen können und   - diese sich im Netzwerk 
befindet,   dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem
 besteht und dass eine Verbindung mit dem Server hergestellt werden kann.   - diese
 sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet,
 überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.  3. Überprüfen
 und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu
 im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben
 Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4.
 Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin
 besteht.  5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet
 werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
   Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, 
um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.    Zusätzliche
 Daten  Fehlerwert: C0000185  Datenträgertyp: 3
 
Error - 27.Aug.2012 06:46:54 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 28.Aug.2012 08:22:59 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Safari.exe, Version: 5.34.55.3, Zeitstempel:
 0x4f6ba239  Name des fehlerhaften Moduls: Safari.dll, Version: 7534.55.3.3, Zeitstempel:
 0x4f6ba202  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00093503  ID des fehlerhaften Prozesses:
 0x10c8  Startzeit der fehlerhaften Anwendung: 0x01cd8517d1efdf20  Pfad der fehlerhaften
 Anwendung: E:\Program Files (x86)\Safari\Safari.exe  Pfad des fehlerhaften Moduls:
 E:\Program Files (x86)\Safari\Safari.dll  Berichtskennung: 1a3fb6e9-f10b-11e1-8407-206a8a24457b
 
Error - 30.Aug.2012 03:50:24 | Computer Name = TimcampyIII | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Safari.exe, Version: 5.34.55.3, Zeitstempel:
 0x4f6ba239  Name des fehlerhaften Moduls: Safari.dll, Version: 7534.55.3.3, Zeitstempel:
 0x4f6ba202  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00093503  ID des fehlerhaften Prozesses:
 0xffc  Startzeit der fehlerhaften Anwendung: 0x01cd86841445a453  Pfad der fehlerhaften
 Anwendung: E:\Program Files (x86)\Safari\Safari.exe  Pfad des fehlerhaften Moduls:
 E:\Program Files (x86)\Safari\Safari.dll  Berichtskennung: 5b03b2aa-f277-11e1-b0fc-206a8a24457b
 
Error - 02.Sep.2012 13:00:02 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 09.Sep.2012 13:00:01 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 16.Sep.2012 13:00:02 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
Error - 23.Sep.2012 13:48:07 | Computer Name = TimcampyIII | Source = Windows Backup | ID = 4103
Description = 
 
 
Error encountered while reading event logs.
 
< End of report >
         

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 12-10-24.01 - Karén 4.Okt.2012  17:19:02.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4094.2434 [GMT 2:00]
ausgeführt von:: c:\users\Karén\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AV: ZoneAlarm Antivirus *Disabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
FW: ZoneAlarm Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: ZoneAlarm Anti-Spyware *Disabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\32C8CE64B1.sys
c:\programdata\Config
c:\programdata\Config\AVWIN.INI
c:\windows\ServiceProfiles\LocalService\NTUSER.tmp
c:\windows\ServiceProfiles\NetworkService\NTUSER.tmp
c:\windows\system32\config\systemprofile\ntuser.tmp
c:\windows\SysWow64\System32\MASetupCleaner.exe
c:\windows\SysWow64\System32\muzapp.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-09-24 bis 2012-10-24  ))))))))))))))))))))))))))))))
.
.
2012-10-24 15:29 . 2012-10-24 15:29	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-10-23 15:14 . 2012-10-23 15:14	--------	d-----w-	C:\_OTL
2012-10-23 14:33 . 2012-10-12 07:19	9291768	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{5060B271-5976-4011-863F-F9013B38C290}\mpengine.dll
2012-10-22 20:09 . 2012-10-22 20:09	--------	d-----w-	c:\program files (x86)\WinPcap
2012-10-22 18:07 . 2012-10-22 18:07	--------	d-----w-	c:\windows\en
2012-10-22 18:06 . 2012-10-22 18:06	--------	d-----w-	c:\windows\de
2012-10-22 18:04 . 2012-10-22 18:04	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-10-22 18:00 . 2012-10-22 18:00	--------	d-----w-	c:\program files\Windows Live
2012-10-22 17:49 . 2012-10-22 17:49	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\9ccdaa6a1cdb07d04\DSETUP.dll
2012-10-22 17:49 . 2012-10-22 17:49	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\9ccdaa6a1cdb07d04\DXSETUP.exe
2012-10-22 17:49 . 2012-10-22 17:49	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\9ccdaa6a1cdb07d04\dsetup32.dll
2012-10-22 17:49 . 2012-10-22 17:49	525656	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\9185ed621cdb07d03\DXSETUP.exe
2012-10-22 17:49 . 2012-10-22 17:49	1691480	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\9185ed621cdb07d03\dsetup32.dll
2012-10-22 17:49 . 2012-10-22 17:49	94040	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\9185ed621cdb07d03\DSETUP.dll
2012-10-22 17:49 . 2012-10-22 17:49	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\899927bd1cdb07d01\DSETUP.dll
2012-10-22 17:49 . 2012-10-22 17:49	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\899927bd1cdb07d01\DXSETUP.exe
2012-10-22 17:49 . 2012-10-22 17:49	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\899927bd1cdb07d01\dsetup32.dll
2012-10-22 17:08 . 2012-10-22 17:09	--------	d-----w-	c:\program files (x86)\QuickTime
2012-10-22 17:03 . 2012-10-22 17:03	--------	d-----w-	c:\program files (x86)\Common Files\Apple
2012-10-22 17:02 . 2012-10-22 17:02	--------	d-----w-	c:\program files (x86)\Apple Software Update
2012-10-22 16:49 . 2012-10-22 16:48	289768	----a-w-	c:\windows\system32\javaws.exe
2012-10-22 16:49 . 2012-10-22 16:48	1034216	----a-w-	c:\windows\system32\npDeployJava1.dll
2012-10-22 16:49 . 2012-10-22 16:48	108008	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2012-10-22 16:49 . 2012-10-22 16:48	189416	----a-w-	c:\windows\system32\javaw.exe
2012-10-22 16:49 . 2012-10-22 16:48	188904	----a-w-	c:\windows\system32\java.exe
2012-10-22 16:45 . 2012-10-22 16:45	--------	d-----w-	c:\program files\Java
2012-10-21 06:07 . 2012-01-09 16:59	11864	----a-w-	c:\windows\system32\drivers\kl2.sys
2012-10-21 06:07 . 2012-01-09 16:59	460888	----a-w-	c:\windows\system32\drivers\kl1.sys
2012-10-21 06:07 . 2012-01-09 16:59	485680	----a-w-	c:\windows\system32\drivers\klif.sys
2012-10-21 06:05 . 2012-10-21 06:05	--------	d-----w-	c:\users\Karén\AppData\Roaming\CheckPoint
2012-10-21 06:04 . 2012-10-21 06:04	--------	d-----w-	c:\program files\CheckPoint
2012-10-21 06:01 . 2012-10-21 06:06	--------	d-----w-	c:\program files (x86)\CheckPoint
2012-10-21 06:01 . 2012-10-21 06:01	--------	d-----w-	c:\programdata\CheckPoint
2012-10-18 15:24 . 2012-10-18 15:25	--------	d-----w-	c:\users\Karén\AppData\Local\{46BE5FF4-4048-4834-A204-D09A1B533AB9}
2012-10-17 20:35 . 2012-10-21 06:11	--------	d-----w-	c:\programdata\MFAData
2012-10-17 20:35 . 2012-10-21 06:05	--------	d-----w-	c:\users\Karén\AppData\Local\Avg2013
2012-10-17 20:35 . 2012-10-17 20:35	--------	d--h--w-	c:\programdata\Common Files
2012-10-17 20:35 . 2012-10-17 20:35	--------	d-----w-	c:\users\Karén\AppData\Local\MFAData
2012-10-17 19:05 . 2012-10-17 19:05	--------	d-----w-	c:\users\Karén\AppData\Local\ElevatedDiagnostics
2012-10-17 18:29 . 2012-10-17 18:30	--------	d-----w-	c:\users\Karén\AppData\Local\{CB0CD61E-AE47-42D9-B7B8-8630773BAEEF}
2012-10-17 17:39 . 2012-04-17 15:21	2672744	----a-w-	c:\windows\system32\RtPgEx64.dll
2012-10-17 17:39 . 2012-04-24 17:48	4028520	----a-w-	c:\windows\system32\drivers\RTKVHD64.sys
2012-10-17 17:39 . 2012-04-20 14:46	3608680	----a-w-	c:\windows\system32\RtkAPO64.dll
2012-10-17 17:39 . 2012-04-23 13:01	1261160	----a-w-	c:\windows\system32\RTCOM64.dll
2012-10-17 17:39 . 2012-04-24 14:43	4784640	----a-w-	c:\windows\system32\RCoRes64.dat
2012-10-17 17:39 . 2012-04-13 13:51	103528	----a-w-	c:\windows\system32\RCoInstII64.dll
2012-10-17 17:39 . 2012-04-03 16:42	1345368	----a-w-	c:\windows\system32\MaxxAudioRealtek264.dll
2012-10-17 17:39 . 2012-04-03 16:42	1015640	----a-w-	c:\windows\system32\MaxxAudioAPOShell64.dll
2012-10-17 17:39 . 2012-04-10 12:40	2533952	----a-w-	c:\windows\system32\FMAPO64.dll
2012-10-16 17:23 . 2012-07-27 20:12	90112	----a-w-	c:\windows\system32\drivers\AtihdW76.sys
2012-10-16 17:16 . 2012-09-13 15:46	70144	----a-w-	c:\windows\system32\coinst_9.001.dll
2012-10-16 17:16 . 2012-09-13 14:54	109568	----a-w-	c:\windows\SysWow64\atiuxpag.dll
2012-10-16 17:16 . 2012-09-13 15:17	120320	----a-w-	c:\windows\system32\atitmm64.dll
2012-10-16 17:16 . 2012-09-13 15:27	19624960	----a-w-	c:\windows\SysWow64\atioglxx.dll
2012-10-16 17:16 . 2012-09-13 15:46	23825920	----a-w-	c:\windows\system32\atio6axx.dll
2012-10-16 16:37 . 2012-10-16 16:37	--------	d-----w-	c:\users\Karén\AppData\Local\{7021FCDB-47B5-4386-BC3E-B11344759E86}
2012-10-16 16:34 . 2012-10-16 16:34	--------	d-----w-	c:\users\Karén\AppData\Local\Innovative Solutions
2012-10-16 16:12 . 2012-10-16 16:12	73656	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-16 16:12 . 2012-10-16 16:12	696760	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-15 18:44 . 2012-10-15 18:44	--------	d-----w-	c:\users\Karén\AppData\Local\{F0CB52AE-B1DA-47B2-B9D2-D8F02EB0433F}
2012-10-15 18:34 . 2012-10-15 18:34	--------	d-----w-	c:\users\Karén\AppData\Roaming\Sun
2012-10-14 17:50 . 2012-10-14 17:51	--------	d-----w-	c:\users\Karén\AppData\Local\{DD2B6863-E057-4244-B968-F29990C51FBD}
2012-10-14 07:44 . 2012-10-14 07:44	--------	d-----w-	c:\users\Karén\AppData\Local\{909D5AB7-5E1E-4D23-8054-FDB106B84BBA}
2012-10-13 19:22 . 2012-10-13 19:22	--------	d-----w-	c:\users\Karén\AppData\Local\{DC28CA75-63AC-468B-B278-E1DBFA5E0C3F}
2012-10-13 16:09 . 2012-10-13 16:09	--------	d-----w-	c:\programdata\Packard Bell
2012-10-13 15:05 . 2012-10-13 15:05	21712	----a-w-	c:\windows\SysWow64\drivers\DrvAgent64.SYS
2012-10-13 15:05 . 2012-10-13 15:05	--------	d-----w-	c:\users\Karén\AppData\Local\eSupport.com
2012-10-12 20:39 . 2012-10-18 14:44	--------	d-----w-	c:\users\Karén\AppData\Roaming\ArcSoft
2012-10-12 20:21 . 2012-10-12 20:21	--------	d-----w-	c:\users\Karén\AppData\Local\ArcSoft
2012-10-12 20:21 . 2012-10-18 14:44	--------	d-----w-	c:\programdata\ArcSoft
2012-10-12 20:17 . 2012-10-12 20:17	--------	d-----w-	c:\users\Karén\AppData\Local\Downloaded Installations
2012-10-11 19:14 . 2012-10-11 19:14	30592	----a-w-	c:\windows\system32\drivers\HWiNFO64A.SYS
2012-10-11 16:42 . 2012-10-11 16:42	--------	d-----w-	c:\users\Karén\AppData\Local\{9F1AB58F-8E5E-492E-8AB9-3C82A67BF22B}
2012-10-10 14:56 . 2012-10-10 14:56	--------	d-----w-	c:\users\Karén\AppData\Local\{E94AEFD4-FED8-40B6-8FFA-50752FC5B99C}
2012-10-10 14:26 . 2012-08-31 18:19	1659760	----a-w-	c:\windows\system32\drivers\ntfs.sys
2012-10-10 14:26 . 2012-08-30 18:03	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-10-10 14:26 . 2012-08-30 17:12	3968880	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-10-10 14:26 . 2012-08-30 17:12	3914096	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-10-10 14:26 . 2012-08-20 18:48	215040	----a-w-	c:\windows\system32\winsrv.dll
2012-10-10 14:26 . 2012-08-20 18:48	424448	----a-w-	c:\windows\system32\KernelBase.dll
2012-10-10 14:26 . 2012-08-20 18:48	1162240	----a-w-	c:\windows\system32\kernel32.dll
2012-10-10 14:26 . 2012-08-20 18:46	338432	----a-w-	c:\windows\system32\conhost.exe
2012-10-10 14:26 . 2012-08-20 17:37	274944	----a-w-	c:\windows\SysWow64\KernelBase.dll
2012-10-10 14:24 . 2012-09-14 19:19	2048	----a-w-	c:\windows\system32\tzres.dll
2012-10-10 14:24 . 2012-09-14 18:28	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-10-10 14:24 . 2012-08-11 00:56	715776	----a-w-	c:\windows\system32\kerberos.dll
2012-10-10 14:24 . 2012-08-10 23:56	542208	----a-w-	c:\windows\SysWow64\kerberos.dll
2012-10-10 14:24 . 2012-06-02 05:41	1464320	----a-w-	c:\windows\system32\crypt32.dll
2012-10-10 14:24 . 2012-06-02 04:36	1159680	----a-w-	c:\windows\SysWow64\crypt32.dll
2012-10-10 14:24 . 2012-06-02 05:41	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2012-10-10 14:24 . 2012-06-02 05:41	140288	----a-w-	c:\windows\system32\cryptnet.dll
2012-10-10 14:24 . 2012-06-02 04:36	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2012-10-10 14:24 . 2012-06-02 04:36	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2012-10-09 18:08 . 2012-10-09 18:08	--------	d-----r-	C:\Sandbox
2012-10-07 16:42 . 2012-10-07 16:42	--------	d-----w-	c:\users\Karén\AppData\Local\{9184F5AD-CCCC-4A63-B0CE-E1123089A4BA}
2012-10-05 13:07 . 2012-10-05 13:07	--------	d-----w-	c:\users\Karén\AppData\Roaming\MotioninJoy
2012-10-05 13:07 . 2012-10-05 13:09	121416	----a-w-	c:\windows\system32\drivers\MijXfilt.sys
2012-10-05 12:24 . 2005-03-09 18:50	33792	----a-w-	c:\windows\SysWow64\drivers\libusb0.sys
2012-10-05 12:24 . 2005-03-09 18:50	46592	----a-w-	c:\windows\SysWow64\libusb0.dll
2012-10-05 12:00 . 2010-05-03 14:12	328712	----a-w-	c:\windows\system32\MijFrc.dll
2012-10-05 12:00 . 2011-12-07 17:42	74960	----a-w-	c:\windows\system32\drivers\xusb21.sys
2012-10-05 09:19 . 2012-10-05 09:19	--------	d-----w-	c:\users\Karén\AppData\Roaming\Malwarebytes
2012-10-05 09:19 . 2012-10-05 09:19	--------	d-----w-	c:\programdata\Malwarebytes
2012-10-05 09:19 . 2012-09-29 17:54	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-10-04 14:43 . 2012-10-04 14:44	--------	d-----w-	c:\users\Karén\AppData\Local\{26C1F9DF-10D7-4D73-92F9-C3B767CAAA8F}
2012-10-03 16:42 . 2012-10-03 16:42	--------	d-----w-	c:\users\Karén\AppData\Local\{675B1AA4-2B46-4CEB-B03E-884E720A468E}
2012-10-03 15:40 . 2012-10-03 15:40	--------	d-----w-	c:\users\Karén\AppData\Roaming\OpenCandy
2012-10-03 15:40 . 2012-10-03 15:40	--------	d-----w-	c:\program files (x86)\Veoh Networks
2012-10-02 14:17 . 2012-10-02 14:17	--------	d-----w-	c:\users\Karén\AppData\Local\{A592CE45-3F52-42F5-A696-BF8983E04836}
2012-10-01 16:56 . 2012-10-01 16:56	--------	d-----w-	c:\users\Karén\AppData\Local\{4487C815-2166-41C7-9CF9-C17010500BBB}
2012-09-30 20:58 . 2012-09-30 20:58	--------	d-----w-	c:\users\Karén\AppData\Local\Facebook
2012-09-30 18:00 . 2012-09-30 18:00	--------	d-----w-	c:\users\Karén\AppData\Local\{D12C0C11-8616-430B-A90A-DB7CB7CFDF1D}
2012-09-30 10:16 . 2012-09-30 10:17	--------	d-----w-	c:\users\Karén\AppData\Local\Google
2012-09-29 18:43 . 2012-09-29 18:43	--------	d-----w-	c:\users\Karén\AppData\Local\{73E01E69-71A7-4DE3-A2B3-C45020375C8E}
2012-09-28 14:29 . 2012-09-28 14:29	--------	d-----w-	c:\users\Karén\AppData\Local\{BF91662F-96D0-4DDB-B5EC-5B78932327AA}
2012-09-27 18:04 . 2012-09-27 18:05	--------	d-----w-	c:\users\Karén\AppData\Roaming\JonDo
2012-09-27 17:25 . 2012-09-27 17:25	--------	d-----w-	c:\users\Karén\AppData\Local\{059F688B-3F7B-419E-A733-E7790E74C430}
2012-09-26 15:07 . 2012-08-21 21:01	245760	----a-w-	c:\windows\system32\OxpsConverter.exe
2012-09-26 15:02 . 2012-09-26 15:03	--------	d-----w-	c:\users\Karén\AppData\Local\{A5D961C2-8D97-44B1-9C0B-3A932850C7C0}
2012-09-25 14:00 . 2012-09-25 14:00	--------	d-----w-	c:\users\Karén\AppData\Local\{55228BAF-434C-437E-8D28-5815559E0DB3}
2012-09-24 18:05 . 2012-09-24 18:05	692505	----a-w-	c:\windows\unins000.exe
2012-09-24 18:05 . 2007-10-16 08:01	47104	----a-w-	c:\windows\SummerProperties.dll
2012-09-24 16:59 . 2012-09-24 16:59	--------	d-----w-	c:\users\Karén\AppData\Local\{0D3019A6-4CE9-49C6-B58C-3302D1593A4D}
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-22 16:48 . 2011-10-05 11:52	916456	----a-w-	c:\windows\system32\deployJava1.dll
2012-10-10 22:23 . 2011-04-16 07:07	65309168	----a-w-	c:\windows\system32\MRT.exe
2012-09-13 16:03 . 2010-12-08 09:09	5557416	----a-w-	c:\windows\SysWow64\atiumdag.dll
2012-09-13 15:19 . 2010-12-08 09:09	536064	----a-w-	c:\windows\system32\atieclxx.exe
2012-09-13 15:18 . 2010-12-08 09:09	239616	----a-w-	c:\windows\system32\atiesrxx.exe
2012-09-13 15:13 . 2010-12-08 09:09	3127296	----a-w-	c:\windows\system32\atiumd6a.dll
2012-09-13 15:08 . 2010-12-08 09:09	7107072	----a-w-	c:\windows\system32\atidxx64.dll
2012-09-13 15:06 . 2010-12-08 09:09	6704128	----a-w-	c:\windows\system32\atiumd64.dll
2012-09-13 15:05 . 2010-12-08 09:09	2691584	----a-w-	c:\windows\SysWow64\atiumdva.dll
2012-09-13 14:56 . 2010-12-08 09:09	595456	----a-w-	c:\windows\system32\atiadlxx.dll
2012-09-13 14:54 . 2010-12-08 09:09	129536	----a-w-	c:\windows\system32\atiuxp64.dll
2012-09-13 14:54 . 2010-12-08 09:09	103424	----a-w-	c:\windows\system32\atiu9p64.dll
2012-09-13 14:53 . 2010-12-08 09:09	82944	----a-w-	c:\windows\SysWow64\atiu9pag.dll
2012-09-12 14:07 . 2012-09-12 14:07	58368	----a-w-	c:\windows\SysWow64\sirenacm.dll
2012-09-12 13:57 . 2012-09-12 13:57	322048	----a-w-	c:\windows\WLXPGSS.SCR
2012-08-24 11:15 . 2012-09-22 19:55	17810944	----a-w-	c:\windows\system32\mshtml.dll
2012-08-24 10:39 . 2012-09-22 19:55	10925568	----a-w-	c:\windows\system32\ieframe.dll
2012-08-24 10:31 . 2012-09-22 19:55	2312704	----a-w-	c:\windows\system32\jscript9.dll
2012-08-24 10:22 . 2012-09-22 19:55	1346048	----a-w-	c:\windows\system32\urlmon.dll
2012-08-24 10:21 . 2012-09-22 19:55	1392128	----a-w-	c:\windows\system32\wininet.dll
2012-08-24 10:20 . 2012-09-22 19:55	1494528	----a-w-	c:\windows\system32\inetcpl.cpl
2012-08-24 10:18 . 2012-09-22 19:55	237056	----a-w-	c:\windows\system32\url.dll
2012-08-24 10:17 . 2012-09-22 19:55	85504	----a-w-	c:\windows\system32\jsproxy.dll
2012-08-24 10:14 . 2012-09-22 19:55	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-08-24 10:14 . 2012-09-22 19:55	816640	----a-w-	c:\windows\system32\jscript.dll
2012-08-24 10:13 . 2012-09-22 19:55	599040	----a-w-	c:\windows\system32\vbscript.dll
2012-08-24 10:12 . 2012-09-22 19:55	2144768	----a-w-	c:\windows\system32\iertutil.dll
2012-08-24 10:11 . 2012-09-22 19:55	729088	----a-w-	c:\windows\system32\msfeeds.dll
2012-08-24 10:10 . 2012-09-22 19:55	96768	----a-w-	c:\windows\system32\mshtmled.dll
2012-08-24 10:09 . 2012-09-22 19:55	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-08-24 10:04 . 2012-09-22 19:55	248320	----a-w-	c:\windows\system32\ieui.dll
2012-08-24 06:59 . 2012-09-22 19:55	1800704	----a-w-	c:\windows\SysWow64\jscript9.dll
2012-08-24 06:51 . 2012-09-22 19:55	1129472	----a-w-	c:\windows\SysWow64\wininet.dll
2012-08-24 06:51 . 2012-09-22 19:55	1427968	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 19:55	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 19:55	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-08-24 06:43 . 2012-09-22 19:55	2382848	----a-w-	c:\windows\SysWow64\mshtml.tlb
2012-08-22 18:12 . 2012-09-12 16:04	1913200	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-08-22 18:12 . 2012-09-12 16:04	950128	----a-w-	c:\windows\system32\drivers\ndis.sys
2012-08-22 18:12 . 2012-09-12 16:04	376688	----a-w-	c:\windows\system32\drivers\netio.sys
2012-08-22 18:12 . 2012-09-12 16:04	288624	----a-w-	c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-20 17:38 . 2012-10-10 14:25	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2012-08-20 12:48 . 2012-09-06 03:46	19032	------w-	c:\windows\system32\pwdrvio.sys
2012-08-20 12:48 . 2012-09-06 03:46	2966720	----a-w-	c:\windows\system32\pwNative.exe
2012-08-20 12:48 . 2012-09-06 03:46	12384	------w-	c:\windows\system32\pwdspio.sys
2012-08-02 17:58 . 2012-09-12 16:04	574464	----a-w-	c:\windows\system32\d3d10level9.dll
2012-08-02 16:57 . 2012-09-12 16:04	490496	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2012-07-26 17:08 . 2012-07-26 17:08	862664	----a-w-	c:\windows\SysWow64\msvcr110.dll
2012-07-26 17:08 . 2012-07-26 17:08	534480	----a-w-	c:\windows\SysWow64\msvcp110.dll
2012-07-26 17:08 . 2012-07-26 17:08	251864	----a-w-	c:\windows\SysWow64\vccorlib110.dll
2012-07-26 17:08 . 2012-07-26 17:08	153536	----a-w-	c:\windows\SysWow64\atl110.dll
2012-07-26 17:08 . 2012-07-26 17:08	115656	----a-w-	c:\windows\SysWow64\vcomp110.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Karén\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760]
"SandboxieControl"="e:\program files\Sandboxie\SbieCtrl.exe" [2012-08-25 765200]
"DriverMax"="e:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2012-09-03 11325376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="e:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2012-10-17 3364264]
"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2012-10-09 73392]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R1 ArcSec;ArcSec;c:\windows\system32\drivers\ArcSec.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;e:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2010-06-10 40448]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2012-10-13 21712]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-06-29 132608]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-06-29 116096]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [x]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]
R3 mcdevice;mcdevice;c:\windows\system32\DRIVERS\mcdevice.sys [2011-05-19 334400]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2012-10-05 121416]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-11 115168]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;e:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;e:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2012-08-20 19032]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2012-08-20 12384]
R3 RTCore64;RTCore64;e:\program files (x86)\RMClock\RTCore64.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2010-04-27 127488]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 18944]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2010-04-27 161280]
R3 ssudobex;SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudobex.sys [2012-06-04 203320]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WinRing0_1_2_0;WinRing0_1_2_0;e:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [x]
R3 wxpSvc;webcamXP Service;e:\program files (x86)\wLite\wService.exe [2011-07-04 4995072]
R4 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-11 321104]
R4 ePowerSvc;Acer ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2010-06-11 868896]
R4 GREGService;GREGService;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe [2010-01-08 23584]
R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2010-06-28 255744]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2011-05-19 23208]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2012-04-30 44688]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2010-05-05 14720]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 27760]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\system32\drivers\HWiNFO64A.SYS [2012-10-11 30592]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2012-01-09 11864]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2011/04/11 12:04];e:\program files (x86)\CyberLink\PowerDVD9\PowerDVD9\000.fcl [2010-03-19 13:15 146928]
S2 a2AntiMalware;Emsisoft Anti-Malware 6.6 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2012-10-07 3084176]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-13 239616]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-07 365568]
S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2012-08-30 33712]
S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2012-08-30 827560]
S2 Live Updater Service;Live Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2012-04-05 255376]
S2 MBAMScheduler;MBAMScheduler;e:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2010-11-15 15672]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-14 2072896]
S2 WTService;WTService;c:\windows\System32\atwtusb.exe [2010-06-14 907496]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2012-04-30 66320]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-09-13 10695168]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-09-13 459776]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-07-27 90112]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-06-04 99384]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2010-06-08 406056]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]
S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-06-04 203320]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-13 11856]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-04-29 38528]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-15 c:\windows\Tasks\GlaryInitialize.job
- e:\program files (x86)\Glary Utilities\initialize.exe [2011-04-12 09:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer ePower Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2010-06-11 861216]
"MacroKeyManager"="WTMKM.exe" [2010-06-14 6446312]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-04-24 12480616]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://packardbell.msn.com
mStart Page = hxxp://packardbell.msn.com
uInternet Settings,ProxyOverride = localhost; 127.0.0.1; <local>
IE: Mit Mipony herunterladen
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Karén\AppData\Roaming\Mozilla\Firefox\Profiles\7gq146r9.default\
FF - prefs.js: browser.startup.homepage - google.de
FF - prefs.js: network.proxy.http - 77.81.242.26
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 1
FF - ExtSQL: 2012-10-21 08:05; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\CheckPoint\ZAForceField\WOW64\TrustChecker
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-{338B4DFE-2E2C-4338-9E41-E176D497299E} - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-ISW - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wxpSvc]
"ImagePath"="e:\program files (x86)\wLite\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\e:\program files (x86)\CyberLink\PowerDVD9\PowerDVD9\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1262013316-4077628313-1536609303-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (S-1-5-21-1262013316-4077628313-1536609303-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.UXJCRLFEICR5TFZUJXTK437WWY"
.
[HKEY_USERS\S-1-5-21-1262013316-4077628313-1536609303-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (S-1-5-21-1262013316-4077628313-1536609303-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.UXJCRLFEICR5TFZUJXTK437WWY"
.
[HKEY_USERS\S-1-5-21-1262013316-4077628313-1536609303-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (S-1-5-21-1262013316-4077628313-1536609303-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.UXJCRLFEICR5TFZUJXTK437WWY"
.
[HKEY_USERS\S-1-5-21-1262013316-4077628313-1536609303-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (S-1-5-21-1262013316-4077628313-1536609303-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.UXJCRLFEICR5TFZUJXTK437WWY"
.
[HKEY_USERS\S-1-5-21-1262013316-4077628313-1536609303-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (S-1-5-21-1262013316-4077628313-1536609303-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.UXJCRLFEICR5TFZUJXTK437WWY"
.
[HKEY_USERS\S-1-5-21-1262013316-4077628313-1536609303-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-24  17:34:25
ComboFix-quarantined-files.txt  2012-10-24 15:34
.
Vor Suchlauf: 18 Verzeichnis(se), 120.012.087.296 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 119.393.783.808 Bytes frei
.
- - End Of File - - ABFAF5C5629D1D36A5AC713960C9F693
         

ein neustart erfolgte dannach nicht.

Hi,

Hinweis für Mitleser:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm vom folgenden Download-Spiegel neu herunter:

BleepingComputer.com

und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Firefox::
FF - ProfilePath - c:\users\Karén\AppData\Roaming\Mozilla\Firefox\Profiles\7gq146r9.default\
FF - prefs.js: browser.startup.homepage - google.de
FF - prefs.js: network.proxy.http - 77.81.242.26
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 1
         

Speichere dies als CFScript.txt auf Deinem Desktop.

Wichtig:

• Stelle deine Anti Viren Software temprär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
  Danach wieder anstellen nicht vergessen!
• Bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein.
  Dies kann dazu führen, dass ComboFix sich aufhängt.
• Schließe alle laufenden Programme. Gehe sicher das ComboFix ungehindert arbeiten kann.
• Mache nichts am PC solange ComboFix läuft.

• In Bezug auf obiges Bild, ziehe CFScript.txt in die ComboFix.exe
• Wenn ComboFix fertig ist, wird es ein Log erstellen, C:\ComboFix.txt. Bitte füge es hier als Antwort ein.

Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.



Malwarebytes updaten, Quick Scan, Funde löschen, Log posten.




ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Poste bitte noch ein frisches OTL logfile. Wie läuft der Rechner?

hi schrauber,

vielen dank für deine Hilfe und all deine mühen, das programm funktioniert auf einmal nicht mehr (exe hat ein problem festgestellt und musste beendet werden) dieses tritt immer wieder auf, auch nach mehreren neustarts. dieses problem hatte ich schon mit mehreren programmen die vorher tadellos liefen. deshalb habe ich jetzt entschieden mein Laptop am besten komplett zu formatieren und neu zu installieren. dann ist dieser trojaner garantiert weg, und mögliche andere versteckten viren etc. gleich mit. Ich bedanke dich trotzdem für deinen support und für all deine mühen, bessere hilfe kann man sich nicht wünschen.

mfg bensh