| |
| |||||||
Log-Analyse und Auswertung: GVU Trojaner 05.12.2012Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.12.2012, 11:45
| #1 |
| |  GVU Trojaner 05.12.2012 Hallo TB-Team, habe mir vor ca. 1h den GVU Trojaner eingehandelt ! Wie hier beschrieben http://www.trojaner-board.de/127821-...tml#post968067 habe ich einen Quickscan durchgeführt. Bitte dringend um Hilfe! Herzlichen Dank, Tobi Nachfolgend der Inhalt aus meinen OTL.txt und Extra.txt. OTL.txt OTL logfile created on: 05.12.2012 11:22:28 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\tobi\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 3,21 Gb Available Physical Memory | 83,14% Memory free 7,71 Gb Paging File | 7,10 Gb Available in Paging File | 92,01% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 275,42 Gb Free Space | 59,14% Space Free | Partition Type: NTFS Drive E: | 232,88 Gb Total Space | 214,11 Gb Free Space | 91,94% Space Free | Partition Type: NTFS Computer Name: TBMOBIL | User Name: tobi | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.05 11:15:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\tobi\Downloads\OTL.exe ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV:64bit: - [2010.02.26 18:13:20 | 000,202,752 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012.11.22 09:35:03 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\_tb\misc\system\skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.03.19 12:38:46 | 002,666,880 | ---- | M] (TeamViewer GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7) SRV - [2011.06.01 13:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2010.11.27 19:17:50 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS) SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC) SRV - [2010.11.20 13:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2010.11.05 10:28:14 | 000,083,248 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe -- (Lexware_Datenbank_Plus) SRV - [2010.08.16 20:00:47 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService) SRV - [2010.07.03 12:38:07 | 001,436,424 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64) SRV - [2010.05.21 12:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) [On_Demand | Stopped] -- C:\Programme\_tb\misc\system\teamviewer\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.09.11 06:33:20 | 000,023,296 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Programme\_tb\misc\secure\nod32\EHttpSrv.exe -- (EhttpSrv) SRV - [2009.09.11 06:24:32 | 000,735,960 | ---- | M] (ESET) [Auto | Stopped] -- C:\Programme\_tb\misc\secure\nod32\x86\ekrn.exe -- (ekrn) SRV - [2009.06.18 14:19:30 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2003.05.29 10:00:00 | 000,106,496 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\_tb\misc\system\pcanywhere\awhost32.exe -- (awhost32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.08.21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012.07.09 12:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.05.17 16:44:46 | 000,044,480 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.07.24 12:01:22 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd) DRV:64bit: - [2010.03.19 12:25:26 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs) DRV:64bit: - [2010.02.26 18:13:54 | 006,106,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2010.02.26 10:36:04 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2010.02.25 16:07:46 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2010.01.14 15:54:44 | 000,093,696 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci) DRV:64bit: - [2010.01.14 15:29:26 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009.12.22 14:06:34 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP) DRV:64bit: - [2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.09.11 06:27:16 | 000,123,200 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr) DRV:64bit: - [2009.09.11 06:23:52 | 000,136,584 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv) DRV:64bit: - [2009.09.11 06:17:20 | 000,144,824 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\eamon.sys -- (eamon) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2010.06.15 07:20:00 | 000,009,856 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\pfc.sys -- (pfc) DRV - [2010.06.13 17:39:08 | 000,073,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\SYMEVENT.SYS -- (SymEvent) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.03.30 16:53:56 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/07/10 15:35:16] [Kernel | Auto | Stopped] -- C:\Program Files (x86)\_tb\media\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD}) DRV - [2003.05.05 15:43:34 | 000,024,365 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\AW_HOST5.sys -- (AW_HOST) DRV - [2003.04.21 13:08:44 | 000,010,901 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\AWLEGACY.sys -- (awlegacy) DRV - [2003.04.21 12:00:32 | 000,013,898 | ---- | M] (Symantec Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysWow64\drivers\GERNUWA.sys -- (Gernuwa) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 45 20 A5 C1 F7 CB 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {81452B8C-C0A8-4488-8F57-03ACA2790BD1} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{81452B8C-C0A8-4488-8F57-03ACA2790BD1}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\..\SearchScopes\{8F7BE742-BE9D-4644-864B-5354FD784799}: "URL" = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\_tb\media\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\_tb\office\office7\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\tobi\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\tobi\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\_tb\office\sunbird\components [2011.01.01 12:40:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\_tb\office\sunbird\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Program Files\_tb\office\thunderbird\components [2012.11.22 09:34:55 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Plugins: C:\Program Files\_tb\office\thunderbird\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\_tb\misc\secure\nod32\Mozilla Thunderbird [2010.06.13 15:50:15 | 000,000,000 | ---D | M] [2010.06.13 20:57:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\tobi\AppData\Roaming\Mozilla\Extensions [2010.06.13 20:28:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\tobi\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.06.13 20:57:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\tobi\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28} [2012.12.05 09:47:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\tobi\AppData\Roaming\Mozilla\Sunbird\Profiles\xqngorzq.default\extensions [2010.10.30 20:26:38 | 000,000,000 | ---D | M] (Provider for Google Calendar) -- C:\Users\tobi\AppData\Roaming\Mozilla\Sunbird\Profiles\xqngorzq.default\extensions\{a62ef8ec-5fdc-40c2-873c-223b8a6925cc} ========== Chrome ========== CHR - homepage: hxxp://www.google.de/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}sourceid=chrome&ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}, CHR - homepage: hxxp://www.google.de/ CHR - plugin: Shockwave Flash (Enabled) = C:\Users\tobi\AppData\Local\Google\Chrome\Application\23.0.1271.95\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\_tb\misc\system\java\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\_tb\misc\system\java\bin\new_plugin\npjp2.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\_tb\office\office7\Office14\NPAUTHZ.DLL CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\tobi\AppData\Local\Google\Chrome\Application\23.0.1271.95\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\tobi\AppData\Local\Google\Chrome\Application\23.0.1271.95\pdf.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\_tb\media\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Google Update (Enabled) = C:\Users\tobi\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O4:64bit: - HKLM..\Run: [egui] C:\Program Files\_tb\misc\secure\nod32\egui.exe (ESET) O4 - HKLM..\Run: [Dimension4] C:\Program Files (x86)\_tb\misc\system\clock\D4.exe (Thinking Man Software) O4 - Startup: C:\Users\tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sunbird.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Download with mediAvatar iPad Softwarepaket Pro - C:\Programme\_tb\media\iPad video\upod_link.HTM () O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Program Files (x86)\_tb\office\office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files (x86)\_tb\office\office7\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Download with mediAvatar iPad Softwarepaket Pro - C:\Programme\_tb\media\iPad video\upod_link.HTM () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Program Files (x86)\_tb\office\office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files (x86)\_tb\office\office7\Office12\EXCEL.EXE (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Reg Error: Key error.) O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 10.9.2) O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.7.0_09) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.111 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{839C5B78-FE57-49F1-B051-01617F011445}: DhcpNameServer = 192.168.2.111 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8E06EF57-C0FD-4A9D-ADDA-DF3F17637092}: DhcpNameServer = 192.168.2.111 O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\PCANotify: DllName - (PCANotify.dll) - C:\Windows\SysWow64\PCANotify.dll (Symantec Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) CREATERESTOREPOINT Unable to start System Restore Service. Error code 1084 ========== Files/Folders - Created Within 30 Days ========== [2012.12.05 10:39:22 | 000,405,376 | ---- | C] (Microsoft Corporation) -- C:\Users\tobi\wgsdgsdgdsgsd.exe [2012.12.02 13:51:18 | 000,844,288 | ---- | C] (Genesis Financial Data Services) -- C:\Windows\SysWow64\G32_GD.dll [2012.11.20 14:27:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012.11.12 11:51:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sybase [2012.11.08 22:10:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Garmin GPS Plugin [2012.11.08 22:10:36 | 000,000,000 | ---D | C] -- C:\Program Files\Garmin GPS Plugin [2012.11.08 21:16:26 | 000,000,000 | ---D | C] -- C:\Users\tobi\AppData\Local\ZoneFiveSoftware [2012.11.08 21:15:44 | 000,000,000 | ---D | C] -- C:\ProgramData\ZoneFiveSoftware [2012.11.08 21:11:03 | 000,000,000 | ---D | C] -- C:\Users\tobi\AppData\Roaming\Garmin [2012.11.08 21:08:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Ant [2012.11.08 21:06:40 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX [2012.11.08 21:06:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Garmin [2012.11.07 19:05:08 | 000,000,000 | ---D | C] -- C:\Log [2012.11.07 12:06:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2 [2012.11.07 11:43:03 | 000,331,776 | ---- | C] (AMYUNI Consultants hxxp://www.amyuni.com) -- C:\Windows\SysWow64\cdintf.dll [2012.11.07 11:42:40 | 000,069,632 | ---- | C] (Stingray Software Inc.) -- C:\Windows\SysWow64\LVC61as.dll [2012.11.07 11:42:39 | 001,884,160 | ---- | C] (Stingray Software Inc.) -- C:\Windows\SysWow64\LTP602as.dll [2012.11.07 11:42:39 | 000,404,480 | ---- | C] (Lexware GmbH & Co. KG, Freiburg) -- C:\Windows\SysWow64\mvter32.dll [2012.11.07 11:42:39 | 000,249,856 | ---- | C] (RogueWave Software) -- C:\Windows\SysWow64\LE60as.dll [2012.11.07 11:42:39 | 000,176,128 | ---- | C] (Stingray Software Inc.) -- C:\Windows\SysWow64\LSC61as.dll [2012.11.07 11:42:39 | 000,155,706 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LxDBAL11.dll [2012.11.07 11:42:39 | 000,077,824 | ---- | C] (Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\lxdao11.dll [2012.11.07 11:42:38 | 000,569,402 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LXTool30.dll [2012.11.07 11:42:38 | 000,491,578 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LXTool20.dll [2012.11.07 11:42:38 | 000,328,704 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3sfm101.dll [2012.11.07 11:42:38 | 000,278,528 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LxXtreme.dll [2012.11.07 11:42:38 | 000,200,758 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LXBtr10.dll [2012.11.07 11:42:38 | 000,163,898 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LxBasics.dll [2012.11.07 11:42:38 | 000,135,168 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\Wdbuui32.dll [2012.11.07 11:42:38 | 000,122,938 | ---- | C] (Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxMail20.dll [2012.11.07 11:42:38 | 000,098,816 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3sif101.dll [2012.11.07 11:42:38 | 000,086,016 | ---- | C] (Lexware GmbH & Co.KG) -- C:\Windows\SysWow64\LxDtv30.dll [2012.11.07 11:42:38 | 000,068,096 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\WBTRV32.DLL [2012.11.07 11:42:38 | 000,058,880 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3sqlv7.dll [2012.11.07 11:42:38 | 000,049,152 | ---- | C] (Lexware GmbH & Co KG) -- C:\Windows\SysWow64\LXCurr12.dll [2012.11.07 11:42:38 | 000,038,400 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3src101.dll [2012.11.07 11:42:38 | 000,004,192 | ---- | C] (Btrieve Technologies, Inc.) -- C:\Windows\SysWow64\WBTRVRES.DLL [2012.11.07 11:42:37 | 000,784,081 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3sce101.exe [2012.11.07 11:42:37 | 000,382,464 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W32btint.dll [2012.11.07 11:42:37 | 000,250,368 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3dif101.dll [2012.11.07 11:42:37 | 000,125,440 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3mif103.dll [2012.11.07 11:42:37 | 000,124,928 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3aif103.dll [2012.11.07 11:42:37 | 000,110,592 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3nsl103.dll [2012.11.07 11:42:37 | 000,073,216 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3crs101.dll [2012.11.07 11:42:37 | 000,073,216 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3bif103.dll [2012.11.07 11:42:37 | 000,067,584 | ---- | C] (Btrieve Technologies Inc.) -- C:\Windows\SysWow64\W32MKSET.DLL [2012.11.07 11:42:37 | 000,044,544 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3dbnv7.dll [2012.11.07 11:42:37 | 000,042,496 | ---- | C] (Pervasive Software Inc.) -- C:\Windows\SysWow64\W3scmv7.dll [2012.11.07 11:41:41 | 000,000,000 | ---D | C] -- C:\lexware [2012.11.07 11:05:32 | 000,000,000 | ---D | C] -- C:\Users\tobi\AppData\Roaming\Lexware [2012.11.07 11:00:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Lexware [2012.11.07 10:58:46 | 001,929,216 | ---- | C] (Amyuni Technologies hxxp://www.amyuni.com) -- C:\Windows\SysWow64\cdintf250.dll [2012.11.07 10:58:06 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.11.07 10:58:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft WSE [2012.11.07 10:51:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Lexware [2012.11.07 10:51:20 | 000,000,000 | ---D | C] -- C:\Users\tobi\AppData\Local\Lexware [2012.11.07 07:05:47 | 000,422,848 | ---- | C] (VideoSoft) -- C:\Windows\SysWow64\vsflex7L.ocx [2012.11.07 07:05:46 | 000,335,872 | ---- | C] (Gigasoft, Inc.) -- C:\Windows\SysWow64\Pepco32a.ocx [2012.11.07 07:05:45 | 000,376,832 | ---- | C] (Gigasoft, Inc.) -- C:\Windows\SysWow64\Pe3do32a.ocx [2012.11.07 07:05:39 | 000,286,720 | ---- | C] (Genesis Financial Data Services) -- C:\Windows\SysWow64\G32_zip.dll [2010.06.15 21:24:02 | 010,355,024 | ---- | C] (Microsoft Corporation) -- C:\Program Files\3.EXE ========== Files - Modified Within 30 Days ========== [2012.12.05 11:09:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.05 11:09:16 | 3106,480,128 | -HS- | M] () -- C:\hiberfil.sys [2012.12.05 11:07:55 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.12.05 10:59:05 | 000,020,576 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.05 10:59:05 | 000,020,576 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.05 10:39:24 | 000,001,049 | ---- | M] () -- C:\Users\tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012.12.04 15:32:18 | 001,766,796 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.12.04 15:32:18 | 000,759,704 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.12.04 15:32:18 | 000,703,574 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.12.04 15:32:18 | 000,169,290 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.12.04 15:32:18 | 000,137,722 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.12.02 15:04:15 | 000,000,073 | ---- | M] () -- C:\Windows\NavWin.INI [2012.11.23 16:16:28 | 003,032,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.11.22 18:13:15 | 000,060,304 | ---- | M] () -- C:\Users\tobi\g2mdlhlpx.exe [2012.11.12 15:54:11 | 000,000,081 | ---- | M] () -- C:\Windows\loge.dat [2012.11.12 11:55:26 | 000,000,525 | ---- | M] () -- C:\Windows\ODBC.INI [2012.11.08 06:50:20 | 000,000,060 | ---- | M] () -- C:\Windows\ib.ini [2012.11.07 19:05:08 | 000,000,017 | ---- | M] () -- C:\Windows\spwdrpga.INI [2012.11.07 11:42:59 | 000,000,198 | ---- | M] () -- C:\Windows\ODBCINST.ini ========== Files Created - No Company Name ========== [2012.12.05 10:39:24 | 000,001,049 | ---- | C] () -- C:\Users\tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012.12.05 10:39:23 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.11.23 15:38:14 | 000,002,092 | ---- | C] () -- C:\Users\tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sunbird.lnk [2012.11.14 09:20:42 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.14 09:10:10 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.11.12 15:54:11 | 000,000,081 | ---- | C] () -- C:\Windows\loge.dat [2012.11.07 19:05:08 | 000,000,017 | ---- | C] () -- C:\Windows\spwdrpga.INI [2012.11.07 11:42:59 | 000,000,198 | ---- | C] () -- C:\Windows\ODBCINST.ini [2012.11.07 11:42:38 | 000,237,623 | ---- | C] () -- C:\Windows\SysWow64\dnt26.dll [2012.11.07 11:42:38 | 000,229,431 | ---- | C] () -- C:\Windows\SysWow64\dnt23.dll [2012.11.07 11:42:38 | 000,192,592 | ---- | C] () -- C:\Windows\SysWow64\LxImport30.dll [2012.11.07 11:42:38 | 000,094,266 | ---- | C] () -- C:\Windows\SysWow64\LXDasi10.dll [2012.11.07 11:42:38 | 000,077,882 | ---- | C] () -- C:\Windows\SysWow64\dntvmc26.dll [2012.11.07 11:42:38 | 000,073,786 | ---- | C] () -- C:\Windows\SysWow64\dntvmc23.dll [2012.11.07 11:42:38 | 000,073,785 | ---- | C] () -- C:\Windows\SysWow64\dntvm26.dll [2012.11.07 11:42:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\PXTTool.dll [2012.11.07 11:42:38 | 000,061,497 | ---- | C] () -- C:\Windows\SysWow64\dntvm23.dll [2012.11.07 11:42:38 | 000,015,627 | ---- | C] () -- C:\Windows\SysWow64\WBROLLRS.DLL [2012.11.07 11:42:37 | 000,320,512 | ---- | C] () -- C:\Windows\SysWow64\W32MKDE.EXE [2012.11.07 11:42:37 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\W32MKRC.DLL [2012.11.07 11:42:37 | 000,041,472 | ---- | C] () -- C:\Windows\SysWow64\W32btstp.dll [2012.11.07 11:42:37 | 000,025,088 | ---- | C] () -- C:\Windows\SysWow64\W32btxlt.dll [2012.11.07 07:05:39 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\G32_rkey.dll [2012.11.07 07:05:39 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\free_res.exe [2012.09.22 09:07:21 | 001,808,004 | ---- | C] () -- C:\Users\tobi\Localizable.strings [2012.08.31 17:03:19 | 000,006,144 | ---- | C] () -- C:\Users\tobi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.12.03 19:21:57 | 000,166,404 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2010.08.07 16:51:43 | 000,060,304 | ---- | C] () -- C:\Users\tobi\g2mdlhlpx.exe [2010.06.16 19:30:50 | 000,000,008 | RH-- | C] () -- C:\Users\tobi\hwid [2010.04.22 17:43:21 | 000,000,414 | ---- | C] () -- C:\Program Files (x86)\Secure Digital-Speichergerät (E) - Verknüpfung.lnk ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2010.06.15 07:24:58 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\ACD Systems [2010.07.03 12:53:34 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Autodesk [2012.11.07 13:55:13 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\FileZilla [2010.06.13 22:06:59 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Foxit [2010.08.04 06:41:06 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Foxit Software [2012.11.08 22:10:27 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Garmin [2010.06.15 08:08:28 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\InterVideo [2012.11.12 14:58:09 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Lexware [2012.09.01 12:13:28 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\mediAvatar [2010.06.13 16:05:16 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\PasswordSafe [2012.11.11 19:41:25 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Synchronizer [2012.08.27 09:30:33 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\TeamViewer [2010.06.13 20:28:20 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Thunderbird [2010.06.15 09:29:46 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\TippKönigin [2010.07.24 11:46:33 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\Uniblue [2010.06.13 17:56:13 | 000,000,000 | ---D | M] -- C:\Users\tobi\AppData\Roaming\WinFAQ ========== Purity Check ========== ========== Custom Scans ========== < %systemroot%\*. /mp /s > < C:\Windows\system32\*.tsp > [2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp [2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp [2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp [2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp [2010.11.20 13:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp [2009.07.14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2009.07.14 06:08:49 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT < MD5 for: AGP440.SYS > [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: IASTOR.SYS > [2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) MD5=073A606333B6F7BBF20AA856DF7F0997 -- C:\Windows\SysNative\drivers\iaStor.sys < MD5 for: IASTORV.SYS > [2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2012.11.22 18:13:15 | 000,060,304 | ---- | M] () -- C:\Users\tobi\g2mdlhlpx.exe [2010.06.16 19:30:50 | 000,000,008 | RH-- | M] () -- C:\Users\tobi\hwid [2012.06.07 18:51:10 | 001,808,004 | ---- | M] () -- C:\Users\tobi\Localizable.strings [2012.12.05 11:20:09 | 002,883,584 | -HS- | M] () -- C:\Users\tobi\NTUSER.DAT [2012.12.05 11:20:09 | 000,262,144 | -HS- | M] () -- C:\Users\tobi\ntuser.dat.LOG1 [2010.03.14 12:31:20 | 000,000,000 | -HS- | M] () -- C:\Users\tobi\ntuser.dat.LOG2 [2010.03.14 12:44:00 | 000,065,536 | -HS- | M] () -- C:\Users\tobi\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2010.03.14 12:44:00 | 000,524,288 | -HS- | M] () -- C:\Users\tobi\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2010.03.14 12:44:00 | 000,524,288 | -HS- | M] () -- C:\Users\tobi\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2010.03.14 12:31:20 | 000,000,020 | -HS- | M] () -- C:\Users\tobi\ntuser.ini [2012.12.05 10:39:22 | 000,405,376 | ---- | M] (Microsoft Corporation) -- C:\Users\tobi\wgsdgsdgdsgsd.exe < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 ========== Alternate Data Streams ========== @Alternate Data Stream - 164 bytes -> C:\ProgramData\Temp  5FBE8F9< End of report > Extra.txt OTL Extras logfile created on: 05.12.2012 11:22:28 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\tobi\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 3,21 Gb Available Physical Memory | 83,14% Memory free 7,71 Gb Paging File | 7,10 Gb Available in Paging File | 92,01% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 275,42 Gb Free Space | 59,14% Space Free | Partition Type: NTFS Drive E: | 232,88 Gb Total Space | 214,11 Gb Free Space | 91,94% Space Free | Partition Type: NTFS Computer Name: TBMOBIL | User Name: tobi | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "C:\Program Files (x86)\_tb\office\office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files (x86)\_tb\office\office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "C:\Program Files (x86)\_tb\office\office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files (x86)\_tb\office\office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{013A84BF-AEB7-47BB-B8EA-160F7B8FBF34}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{0350A275-0F4F-4E7C-8C32-1976B8F947E2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{062CBF89-598C-4706-8D0B-2BEED3E84A77}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{16C6C8E3-E949-45DB-AC3E-7064E436578F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{1C16043F-BEA9-4D26-B9E2-E8E3A7ADC1F5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{27A09F88-0B28-45BD-9003-3E281E7ACEF1}" = lport=138 | protocol=17 | dir=in | app=system | "{29916C05-EA36-47CF-9ECA-BF1DC48D2507}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{3344F4EA-EE66-4D8A-AF89-7BE8B784E533}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{38D78C73-36DE-4EE3-A9D6-A648CA29AD30}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{3BECE28A-F134-4E15-8C67-39D017315886}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{3DE13810-36F1-4452-9F2A-0126A4F3E388}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{3E0BD8BA-27B2-4833-A3A0-468205BF6D85}" = rport=139 | protocol=6 | dir=out | app=system | "{3EE3356C-8B8D-4100-B127-489E73C0864F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{4DF6CAFC-4EEB-40AF-9EAA-BDAB6C9D8581}" = lport=10243 | protocol=6 | dir=in | app=system | "{505C1571-6D1B-42C4-B727-1CF9BE52F3AB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{56E4BB73-FC58-41E6-B96D-C1F8D84C6AF3}" = lport=2869 | protocol=6 | dir=in | app=system | "{6012EFBE-7EA2-4FAF-9D2C-DFF9ED699A47}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{6C89C8FA-C0CF-43D2-B706-F3A11EB3BBD5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{89922039-E24A-43A6-8FA2-F45A270CD55D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{8A9C1E42-A501-4065-8058-CB0E5393AE43}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{8FC7326F-1913-4785-B6CB-03C7207F5FF5}" = rport=10243 | protocol=6 | dir=out | app=system | "{90C79499-8BF9-47BC-95D6-BF4990B78F54}" = lport=445 | protocol=6 | dir=in | app=system | "{92C3BF25-1E56-49A2-946E-3C5947AD16F5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{A12F585F-F591-40FD-AA83-1CD3DC581F7C}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{A297E042-7EE5-4A1A-8305-57BDA0F4889B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{A328566D-CCF4-44E0-9705-A4A5DD4A45E5}" = rport=138 | protocol=17 | dir=out | app=system | "{B51D5343-619E-4529-8ABD-4C89D1517D18}" = lport=139 | protocol=6 | dir=in | app=system | "{C9BA17D3-5D0B-4CF0-9182-5B520F03E716}" = rport=445 | protocol=6 | dir=out | app=system | "{E1F94FE3-C992-479C-A52E-F463506B72C4}" = rport=137 | protocol=17 | dir=out | app=system | "{ED84134F-B7C7-4F6B-B9E0-97AE53D4D6FF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{FC8D76BE-53C1-4F48-9FA9-9E75F7380FBC}" = lport=137 | protocol=17 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{011C76D7-92D0-44C6-8B9C-6A8839CEE5F3}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{066DA65E-1F48-4BBD-BFD0-9CE13FEFD83E}" = protocol=6 | dir=out | app=c:\program files (x86)\rosetta stone\rosetta stone version 3\rosettastoneversion3.exe | "{0AA40442-E843-483C-9E5C-D85008DCE1F3}" = dir=in | app=c:\program files (x86)\_tb\media\powerdvd9\powerdvd9.exe | "{14AC7421-D859-47F6-96D1-57C70D1DADA9}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{17CF3CB0-60AA-4CF4-A174-B10BFE367854}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{185C6A16-CC69-4834-8EA6-4A41B3D55FFB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{18A8B056-6AF7-4072-B456-8AEF9706920B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{1B02063E-69AA-4324-9DFE-72591ADF71DA}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{1C484190-097F-489C-884C-414AF567114D}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{2015FDED-2710-4DA5-A9D9-C055FA943BF7}" = dir=in | app=c:\program files\_tb\media\itunes\itunes.exe | "{20BD3EB4-2B91-4116-9443-ECF5112AAA87}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{22BC68BC-BFEB-4E9C-9B76-47BCD72F673B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{25D3232A-E1FE-4545-B691-D29050CDCC57}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{27BFEDD4-E694-40A4-A35E-518117C81AE6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{2980F2AA-6966-4D72-B9B2-247AFA3C4E80}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{30578215-43BC-443C-9BEF-40D18375D808}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe | "{3331C575-E36A-4238-887D-59FD8EF8B8CB}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | "{340580B4-3A15-45F2-ADA9-9C426DAC3560}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{38F4A4AA-115B-4510-B8AA-5210C074202C}" = dir=in | app=c:\program files (x86)\rosetta stone\rosetta stone version 3\support\bin\win\rosettastoneltdservices.exe | "{3A5A0F79-9916-488E-BE29-96F3CE7C0EAD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{3BF86B00-C2BF-4685-A0F6-60368542B23D}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{3C6672BB-AFB7-4B9F-B03F-D40F197F70A0}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{43D3FAB8-47FD-4F8B-B394-FECB57DD83B6}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{4C0BE20E-4E16-4249-A8CB-B4BBB95F1903}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | "{5A319575-231B-4143-BC54-9C24D2DB7D6B}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{60316BB4-9C92-44D1-BF13-D05B1B102C5B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{63414FE9-858C-4C1A-AA34-4D3993E2CB9C}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{64BA1FCB-C9A2-4A7D-9F42-E7540F8ACCB3}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{6623576E-6C53-4AD1-8C7A-8CFC11266199}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{67D9719E-5325-497A-B9A4-8200DEFF8C3B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{6C7F548C-E11E-42C7-B332-1FEC76143960}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{7252ECE5-972F-43AE-A7B6-277610E715C7}" = protocol=6 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe | "{72A2F6CF-6D6F-4DF6-8457-F5BF2B855B1E}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{767BD636-FF4F-4A9B-929B-D7E5FD68665B}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{778EC9F3-567E-42D7-B08B-C876AA838F3B}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | "{7F5C68C6-312E-4F54-84CE-35F95523DA05}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{8282067C-FCBF-4FE0-9789-174306193059}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{90D412F3-000F-43C7-9D20-EE7F9CC98C28}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{94DEFAAB-FC02-4014-8EC2-FFE52C751FD5}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{95C93F37-74CA-4D10-AA15-9F5F8408D7A4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{981EF7E7-AF75-4A37-BCE3-B2882000CE94}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{992923C3-1AD0-4698-B23D-6A1910F82E55}" = protocol=17 | dir=in | app=c:\program files\_tb\misc\system\teamviewer\teamviewer.exe | "{9B976E27-92C2-40A0-9230-8802EE9B10B1}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{9BBBE70D-C04A-4EA0-AAED-C1EBA6A3E75D}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{9BF24571-067F-4E65-A873-9F057699BD41}" = protocol=17 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe | "{9C51044E-E726-45D1-93C0-3048412461C3}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{9E428D33-9BBB-4358-8F3A-8F817AC5523C}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{9F67040E-943E-49D0-B8B1-4D55D5F90692}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{9F9DAAB5-6F55-4467-855C-DD024EE17E10}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{A283DCD7-3FCC-4966-A816-5D3884D88EA2}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{A507059E-8BAE-4779-B98F-A9401338A5DB}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{AA189EE4-86B6-4B88-99DB-CD293FFAAEE7}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe | "{AD1EA84F-CA64-47ED-9F9D-C5EA33CF3DD1}" = dir=in | app=c:\program files (x86)\_tb\media\powerdvd9\powerdvd cinema\powerdvdcinema.exe | "{B00CD833-B33A-4285-AD9C-CE32E406309D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{B41A3870-394F-4B38-B995-195501F47369}" = protocol=6 | dir=in | app=c:\program files\_tb\misc\system\teamviewer\teamviewer.exe | "{BF3EC6C9-D3F0-425C-866C-EFB3CC8A2ED9}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{C0E734DB-0BFC-4D67-966D-CA1CEC9D4CAF}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{C3596BC9-6B8A-4D2F-BDB1-2C6C84CB471D}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{C5EE68DA-DECC-4EE3-A027-AF959FFAC8DB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{CF522527-81AD-4131-879B-6D3EA1514B51}" = protocol=6 | dir=out | app=c:\program files (x86)\rosetta stone\rosetta stone version 3\support\bin\win\rosettastoneltdservices.exe | "{D0F4C469-C807-4151-885B-29D76FA28EA0}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe | "{D583D9A3-85F2-46DD-8658-A50934E9CA58}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe | "{D664EBFC-9FA4-4E2C-B299-467F7B87106E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{D6C445FF-2737-441D-9743-5FAF93A6E090}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{DAE36C81-256F-4CA0-8A27-C4D25ADA0838}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{DCF90490-AB23-4AF5-B4EF-0071C0CE9AE0}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{DF416E77-E5DB-4D9F-8FC0-E4CA56F4CEA1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | "{E15E1226-49E0-4A20-B0F2-DE98EDAD38E6}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{E4C507E7-B795-4E7B-9738-F9F35EEB6608}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{E5BA06CA-1401-4094-9B59-DA6076819425}" = protocol=6 | dir=out | app=system | "{EBC05FB5-256F-49D7-BDA1-82A20EF50DD5}" = dir=in | app=c:\program files (x86)\rosetta stone\rosetta stone version 3\rosettastoneversion3.exe | "{F06D4FA2-699E-4A16-9B48-2B98CADACCA0}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{F0B53296-DD26-45F3-9F8A-0F9966FDE87C}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{F5B7B40F-4891-4AF1-9FB8-A0C49EA0E478}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{FB92A20E-C280-433D-9A0B-39BFF295C862}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{FB92FACD-852B-4067-8B63-716B39A3978C}" = dir=in | app=c:\program files (x86)\_tb\misc\system\skype\phone\skype.exe | "{FE70EB90-7327-4614-9F4F-31B704BACDDF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{FFEF511F-73A6-4BD4-B1B3-2A6C5A95ADDA}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "TCP Query User{001A555C-EB6F-4BD9-97BE-5DC68602806D}C:\windows\syswow64\javaw.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\javaw.exe | "TCP Query User{3BACF071-C60C-44C5-97A4-4FF00F2BA36A}C:\program files (x86)\_tb\misc\system\clock\d4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\_tb\misc\system\clock\d4.exe | "TCP Query User{D2D4CE70-D02E-49E7-8DC5-29CF6C2BBACA}C:\program files\_tb\trade\tn\navigator suite\navsuite.exe" = protocol=6 | dir=in | app=c:\program files\_tb\trade\tn\navigator suite\navsuite.exe | "UDP Query User{8DC113FF-4738-47FD-891D-4E8CF0FD714F}C:\program files (x86)\_tb\misc\system\clock\d4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\_tb\misc\system\clock\d4.exe | "UDP Query User{B2A8CB85-A0DB-4EBA-9A05-8E75B5F94E6B}C:\windows\syswow64\javaw.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\javaw.exe | "UDP Query User{C22992D4-2452-4CA3-BD51-60EF02E04CB5}C:\program files\_tb\trade\tn\navigator suite\navsuite.exe" = protocol=17 | dir=in | app=c:\program files\_tb\trade\tn\navigator suite\navsuite.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0611B3CC-B5DB-4B93-ACE4-97B8F938E6B7}" = 64 Bit HP CIO Components Installer "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{110ED870-1DF3-4574-A679-E2C4A8163211}_is1" = Registry System Wizard.NET "{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes "{26A24AE4-039D-4CA4-87B4-2F86416013FF}" = Java(TM) 6 Update 13 (64-bit) "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{5783F2D7-9001-0407-0102-0060B0CE6BBA}" = AutoCAD 2011 - Deutsch "{5783F2D7-9001-0407-1102-0060B0CE6BBA}" = AutoCAD 2011 Language Pack - Deutsch "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{70C9548E-F28F-4BA1-A17F-B4B6B7360783}" = Foxit PDF IFilter "{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support "{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007 "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010 "{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010 "{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{D2012A37-E263-4B94-BAF7-BD290CE4D697}" = ESET NOD32 Antivirus "{D2DB454C-645C-448A-A0B9-B6F6C1D75BA8}" = Garmin Communicator Plugin x64 "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "24DA573F901348FFDFF7717497830D45BE0C362E" = Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) "49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) "AutoCAD 2011 - Deutsch" = AutoCAD 2011 - Deutsch "CCleaner" = CCleaner "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Redirection Port Monitor" = RedMon - Redirection Port Monitor [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{086A7D8C-0A38-4C7F-819A-620275550D5C}" = Nero Burning ROM Help "{0AA86CEE-2C8C-4ABB-8F95-B8D8E852C62C}" = SportTracks 3.1 "{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1 "{15B2BC56-D179-4450-84B9-7A8D7F4CE1B9}" = Lexware Info Service "{1A20BC22-8F21-4A2A-9F4A-E31FC0E5C7E3}" = ACDSee 6.0 PowerPack "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help "{26A24AE4-039D-4CA4-87B4-2F83216037FF}" = Java(TM) 6 Update 37 "{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9 "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform "{37BC8FCE-15B1-456E-A62C-EEB175B71340}" = Lexware reisekosten plus 2011 "{384A95F1-EDDA-4BBE-BC6B-7FAA886380F6}" = Trade Navigator "{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{53FA9A9F-3C19-4D43-AD6B-DEF365D469BA}" = Camtasia Studio 7 "{54971F17-9D16-4D43-95D6-3A86E3D20EDB}" = Office-Bibliothek 4.0 "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime "{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress "{5B48A8D9-D1AD-4424-BD4D-E462737099DF}" = SportTracks 3.0 "{5d6e4e47-fa21-444f-ac5e-7fd4dde3f8ca}" = Nero 9 "{5D9BE3C1-8BA4-4E7E-82FD-9F74FA6815D1}" = Nero Vision Help "{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner "{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{757469A9-396B-45E7-B069-67297D08470E}" = Lexware financial office 2011 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart "{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit "{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{87102B45-8762-4A34-BED3-8D1C21F9F1A6}" = Hoadley Options Strategy Evaluation Tool "{8AEF92D2-4E2C-44CD-ABDC-800E0BB8EDEE}" = Password Safe and Repository 5.5.0.1802 "{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update "{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) "{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3) "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 "{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPRO_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 "{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPRO_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010 "{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PRJPRO_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002A-0000-1000-0000000FF1CE}_Office14.PRJPRO_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002A-0409-1000-0000000FF1CE}_Office14.PRJPRO_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010 "{90140000-002C-0409-0000-0000000FF1CE}_Office14.PRJPRO_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2010 "{90140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPRO_{8A8F117F-8EDB-440D-B679-F08909D729F7}" = Microsoft Project 2010 Service Pack 1 (SP1) "{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010 "{90140000-006E-0409-0000-0000000FF1CE}_Office14.PRJPRO_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-00B4-0409-0000-0000000FF1CE}" = Microsoft Office Project MUI (English) 2010 "{90140000-00B4-0409-0000-0000000FF1CE}_Office14.PRJPRO_{18A0C151-8F8A-4B68-A960-60C464B94329}" = Microsoft Project 2010 Service Pack 1 (SP1) "{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010 "{90140000-0115-0409-0000-0000000FF1CE}_Office14.PRJPRO_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-0116-0409-1000-0000000FF1CE}_Office14.PRJPRO_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{935FF092-EEBA-4E97-8C1B-CD2364F392A4}" = Dimension 4 v5.0 "{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58 "{98420797-89A5-4387-833F-E306F38E4E35}" = Foxit PDF IFilter "{98A67610-A3B5-4098-A423-3708040026D3}" = "Nero SoundTrax Help "{99011A6E-5200-11DE-BDB8-7ACD56D89593}" = Rosetta Stone Version 3 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9DEABCB6-B759-4D52-92F8-51B34A2B4D40}" = Autodesk Material Library 2011 "{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor "{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9 "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{A900E37C-AAE3-44FB-8EE7-7E61F7087CE7}" = SnagIt 8 "{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2009-09-09 "{AD6BC5CC-2EF0-49C4-B33D-CDC8B2C4DC80}" = Nero Recode Help "{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles "{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center "{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit "{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax "{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update "{C8E00BC8-D619-4081-813A-6B5BCC846534}" = Lexware Elster "{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials "{CB5F6422-502E-477C-B31D-25ECE8F829E6}" = Garmin ANT Agent "{CD1E078C-A6B9-47DA-B035-6365C85C7832}" = Autodesk Material Library 2011 Base Image library "{CD95F661-A5C4-44F5-A6AA-ECDD91C240BB}" = WinZip 14.0 "{CE96F5A5-584D-4F8F-AA3E-9BAED413DB72}" = Nero CoverDesigner Help "{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM "{D34A78EB-78F2-48ab-8CAE-5D4DC255A491}" = Lexware reisekosten plus 2011 "{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver "{DAF15921-FA90-4427-82A2-1852A9BAC99A}" = Lexware Datenbank plus 2011 "{E05E8183-866A-11D3-97DF-0000F8D8F2E9}" = Symantec pcAnywhere "{E2AD695E-B537-41FD-9652-B9138EEAAC3C}" = Lexware anlagenverwaltung 4 "{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime "{E883466C-77EC-44AC-8EC8-417A4A16AB3F}" = Garmin Communicator Plugin "{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer "{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0 "{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "AnalyzerXL Package_is1" = AnalyzerXL Package 6.1.39 "eChat" = eChat "ENTERPRISE" = Microsoft Office Enterprise 2007 "Foxit PDF Editor" = Foxit PDF Editor "Foxit Reader" = Foxit Reader "FreePDF_XP" = FreePDF (Remove only) "GPL Ghostscript 8.70" = GPL Ghostscript 8.70 "IBXL_is1" = IBXL 1.0.8 "InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9 "LiveReg" = LiveReg (Symantec Corporation) "LiveUpdate" = LiveUpdate 1.80 (Symantec Corporation) "MacroX" = MacroX 3.1 "Mozilla Thunderbird 17.0 (x86 de)" = Mozilla Thunderbird 17.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "Office14.PRJPRO" = Microsoft Project Professional 2010 "Synchronizer_is1" = Synchronizer "TeamViewer 5" = TeamViewer 5 "TeamViewer 6" = TeamViewer 6 "TeamViewer 7" = TeamViewer 7 "The Rosetta Stone" = The Rosetta Stone "TippKönigin_is1" = TippKönigin 5.5 "Trader Workstation 4.0" = Trader Workstation 4.0 "TWS Interoperability Components" = TWS Interoperability Components "VLC media player" = VLC media player 1.0.5 "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR archiver ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "FileZilla Client" = FileZilla Client 3.5.3 "Google Chrome" = Google Chrome "GoToMeeting" = GoToMeeting 5.3.0.978 "mediAvatar iPad Softwarepaket Pro" = mediAvatar iPad Softwarepaket Pro "Trader Workstation" = Trader Workstation ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 01.12.2012 10:46:15 | Computer Name = tbmobil | Source = ESENT | ID = 455 Description = Windows (3048) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00246.log. Error - 01.12.2012 10:46:16 | Computer Name = tbmobil | Source = Windows Search Service | ID = 9000 Description = Error - 01.12.2012 10:46:16 | Computer Name = tbmobil | Source = Windows Search Service | ID = 7040 Description = Error - 01.12.2012 10:46:16 | Computer Name = tbmobil | Source = Windows Search Service | ID = 7042 Description = Error - 01.12.2012 10:46:16 | Computer Name = tbmobil | Source = Windows Search Service | ID = 9002 Description = Error - 01.12.2012 10:46:16 | Computer Name = tbmobil | Source = Windows Search Service | ID = 3029 Description = Error - 01.12.2012 10:46:17 | Computer Name = tbmobil | Source = Windows Search Service | ID = 3029 Description = Error - 01.12.2012 10:46:17 | Computer Name = tbmobil | Source = Windows Search Service | ID = 3028 Description = Error - 01.12.2012 10:46:17 | Computer Name = tbmobil | Source = Windows Search Service | ID = 3058 Description = Error - 01.12.2012 10:46:17 | Computer Name = tbmobil | Source = Windows Search Service | ID = 7010 Description = [ OSession Events ] Error - 16.06.2011 01:54:33 | Computer Name = tbmobil | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 282 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 05.12.2012 06:09:48 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:48 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:48 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:48 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:49 | Computer Name = tbmobil | Source = DCOM | ID = 10005 Description = Error - 05.12.2012 06:09:49 | Computer Name = tbmobil | Source = DCOM | ID = 10005 Description = Error - 05.12.2012 06:09:50 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:50 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:50 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 05.12.2012 06:09:50 | Computer Name = tbmobil | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 < End of report > |
| Themen zu GVU Trojaner 05.12.2012 |
| adobe, anlage, bonjour, dringend, error, eset nod32, excel, fehler, firefox, flash player, format, genesis, home, homepage, install.exe, libusb0.sys, logfile, mozilla, object, office 2007, photoshop, plug-in, realtek, registry, required, rundll, software, svchost.exe, symantec, trojaner, udp, windows |
Baum-Darstellung