ja mahlzeit,

ich war grade nen bisslim netz unterwegs und die musik hat im hintergrund gedudelt.

plötzlich wurde mein bildschirm weiß, die musik lief aber weiter und mein mauszeiger war auch zu sehen und zu benutzen. meine erste reaktion war strg-alt-entf und dann bekam ich auch wieder was zu sehen und war erstmal beruhigt... erst hab ich den task manager geöffnet... weißer bildschirm, keine reaktion... erste panik... nochmal den affengriff, benutzer abmelden, kurz mein lustiges hintergrundbild gesehen, abgemeldet, neu angemeldet, aktionsspielraum von 5 sek, danach wieder weißer bildschirm. neustart ect. brachte nichts.

google hat mich zu euch geführt, euer board hat mir gesagt ich soll die füße still halten und ein thread öffnen. hab also noch keinerlei maßnahmen ergriffen. hab windows 7, kein 2. benutzerkonto...

vielen dank schonma : )

Grüße, Schnitzel

Hi,

ist dein Windows 7 ein 32-bit oder 64-bit?
Funktioniert noch einer der abgesicherten Modi (auch derjenige "mit Eingabeaufforderung")?

hallo : )

win müsste 32-bit sein...

normaler abgesicherter modus und der mit netzwerktreiber starten sch sofort neu..

abgesicherter modus mit eingabeaufforderng funktioniert, hab so'n altes fenster auf mit C:\Windows\system32> als erste zeile

Hey,

dann versuch mal das:


Schritt 1

Lade dir auf einem Zweitrechner bitte OTL (von Oldtimer) herunter und speichere es auf einen USB-Stick (nicht in einen Unterordner!).

• Schliesse diesen USB-Stick nun an den infizierten Rechner an.
• Starte den infizierten Computer in den abgesicherten Modus mit Eingabeaufforderung. (Anleitung)
• In der Kommandozeile gib nun notepad ein und drücke Enter.
  • Es öffnet sich ein Textdokument. Klicke auf Datei -> Speichern unter und wähle Arbeitsplatz.
  • Lese hier nun den Laufwerksbuchstaben deines USB Sticks (z.B. e:\) ab.
  • Schliesse Notepad wieder.
• Gib nun bitte folgenden Befehl in die Kommandozeile ein und drücke Enter:

  e:\OTL.exe

  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Wenn es bei dir ein anderer Buchstabe ist, dann passe den Befehl entsprechend an.
  Es sollte sich nun das Fenster von OTL öffnen.
• Unter Extra Registry, wähle bitte Use SafeList.
• Setze den Haken bei Scan all Users.
• Klicke nun auf Run Scan.
• Wenn der Scan beendet ist, werden 2 Logfiles (OTL.txt und Extras.txt) angezeigt und auf den USB-Stick gespeichert.
• Poste bitte auf dem Zweitrechner den Inhalt dieser Logfiles hier in den Thread.

Bitte poste in deiner nächsten Antwort:

• Logs von OTL

war alles kein problem bis zum ende des scans... da sagt der mir, dass kein datenträger vorhanden ist - ich soll einen einlegen im laufwerk - \Device\Harddisk2\DR2

hab auch nochmal geschaut, wurde nichts gespeichert, habs mit ner anderen usb buchse probiert, da hat sich jeweils die 2 in eine 3 geändert aber ich soll immer noch einen datenträger einlegen

paar mal abbrechen, dann gings... hier die logs

extrasOTL Logfile:

OTL logfile created on: 17.03.2013 00:21:44 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = f:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,93 Gb Total Physical Memory | 3,45 Gb Available Physical Memory | 87,90% Memory free
7,86 Gb Paging File | 7,39 Gb Available in Paging File | 94,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,87 Gb Total Space | 92,66 Gb Free Space | 20,19% Space Free | Partition Type: NTFS
Drive D: | 458,87 Gb Total Space | 75,60 Gb Free Space | 16,47% Space Free | Partition Type: NTFS
Drive F: | 7,44 Gb Total Space | 7,44 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.17 00:05:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- f:\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.09.15 09:42:12 | 000,119,632 | ---- | M] (Devguru Co., Ltd.) [Auto | Stopped] -- C:\Windows\SysNative\dgdersvc.exe -- (dgdersvc)
SRV:64bit: - [2010.02.25 11:07:54 | 000,202,752 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Stopped] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2013.03.16 11:13:33 | 000,115,608 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.07 13:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.01.04 23:27:20 | 000,107,832 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.12.29 14:41:39 | 000,066,872 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.12.10 17:29:46 | 002,465,712 | ---- | M] (LogMeIn Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.09.19 12:10:58 | 002,365,792 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012.08.13 12:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.09 04:03:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 04:03:51 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.03.16 20:34:32 | 000,489,256 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.11.20 13:21:36 | 000,351,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2010.09.15 09:37:40 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Stopped] -- C:\Windows\SysWOW64\dgdersvc.exe -- (dgdersvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 22:08:38 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Disabled | Stopped] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.12 11:31:00 | 000,121,416 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV:64bit: - [2012.05.09 04:03:51 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 04:03:51 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.07 18:42:28 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.28 09:45:51 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.04.28 09:45:51 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.03 12:08:42 | 001,918,976 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.09.15 09:42:12 | 000,020,552 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.08.26 11:16:33 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.03.04 14:43:00 | 000,346,144 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.02.25 11:22:38 | 006,369,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.02.25 10:12:10 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.02.24 11:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2010.01.28 02:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.12.09 10:39:52 | 000,537,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.10.30 13:44:40 | 000,460,864 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2u.sys -- (RL_DJIFIE2_USB)
DRV:64bit: - [2009.10.30 13:44:38 | 000,049,728 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2a.sys -- (RL_DJIFIE2_WDM)
DRV:64bit: - [2009.10.30 13:44:38 | 000,036,416 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2m.sys -- (RL_DJIFIE2_MIDI)
DRV:64bit: - [2009.10.20 10:03:16 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2009.09.19 06:30:14 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2009.09.19 06:30:14 | 000,128,000 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bserd.sys -- (ss_bserd)
DRV:64bit: - [2009.09.19 06:30:14 | 000,127,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bbus.sys -- (ss_bbus)
DRV:64bit: - [2009.09.19 06:30:14 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 03:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 03:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 03:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.04.29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2009.04.10 11:58:52 | 000,014,720 | ---- | M] (ROCCAT Development, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ValoFltr.sys -- (ValFltr)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2007.09.12 08:56:50 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2007.08.13 07:01:26 | 000,034,432 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiU04E5.sys -- (SaiU04E5)
DRV - [2012.09.18 16:02:02 | 000,011,880 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.09.15 09:37:40 | 000,018,120 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.04.08 11:06:08 | 000,070,400 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004.04.08 09:46:50 | 000,054,272 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06)
DRV - [2003.12.01 16:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003.09.06 13:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prosync1.sys -- (prosync1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{769FB394-A1BE-4A29-9393-9F7D84C9BA30}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=685749&p={searchTerms}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=685749"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://google.de/"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130129
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.9.2
FF - prefs.js..extensions.enabledAddons: firegestures%40xuldev.org:1.6.20
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.5
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Maik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.16 11:13:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.21 18:46:08 | 000,000,000 | ---D | M]
 
[2010.09.02 18:23:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Extensions
[2013.03.16 13:53:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\firefox@ghostery.com
[2013.03.16 13:53:56 | 000,141,008 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\firegestures@xuldev.org.xpi
[2012.12.11 20:16:07 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.03.12 04:42:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.31 23:32:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.03.16 11:13:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.02.21 18:46:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.23 11:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2011.10.03 10:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2013.03.16 11:13:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.03.16 11:13:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.16 11:13:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.03.16 11:13:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.03.16 11:13:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.03.16 11:13:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E62AE45-5AE7-48BA-9B03-8898A35CD37B}: NameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (C:\Users\Maik\AppData\Roaming\skype.dat) - C:\Users\Maik\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\groove.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\hamachi-2-ui.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\infopath.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\misc.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mspub.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\oaa.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\ois.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\outlook.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\Winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\groove.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\hamachi-2-ui.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\infopath.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\misc.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mspub.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\oaa.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\ois.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\outlook.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\Winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O29:64bit: - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 0
O33 - MountPoints2\{29a2e83e-b0ed-11df-ac91-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{29a2e83e-b0ed-11df-ac91-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{29a2e844-b0ed-11df-ac91-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{29a2e844-b0ed-11df-ac91-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7268-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7268-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{32ce726b-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce726b-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7270-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7270-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{32ce7273-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7273-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7280-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7280-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7284-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7284-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{32ce7287-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7287-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{39961901-bfa5-11e0-9316-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{39961901-bfa5-11e0-9316-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{3996191a-bfa5-11e0-9316-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{3996191a-bfa5-11e0-9316-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe
O33 - MountPoints2\{62c42ece-caf3-11df-b1d4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{62c42ece-caf3-11df-b1d4-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a6e1f054-c444-11e0-9271-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a6e1f054-c444-11e0-9271-806e6f6e6963}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a6e1f07a-c444-11e0-9271-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{a6e1f07a-c444-11e0-9271-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{abca770d-caee-11df-b598-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{abca770d-caee-11df-b598-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{abca770f-caee-11df-b598-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{abca770f-caee-11df-b598-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b0f7d295-c5d5-11e0-bcf4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b0f7d295-c5d5-11e0-bcf4-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b13cb40d-e152-11e0-a082-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b13cb40d-e152-11e0-a082-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b13cb410-e152-11e0-a082-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b13cb410-e152-11e0-a082-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{faf4cb51-772e-11dc-8a1a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{faf4cb51-772e-11dc-8a1a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.16 20:42:00 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2013.03.15 20:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.03.15 20:40:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.03.14 15:01:48 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.03.14 15:01:48 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.03.14 15:01:48 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.03.14 15:01:47 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.03.14 15:01:47 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.03.14 15:01:47 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.03.14 15:01:47 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.03.14 15:01:47 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.03.14 15:01:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.03.14 15:01:47 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.03.14 15:01:47 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.03.14 15:01:46 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.03.14 15:01:45 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.03.14 15:01:45 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.03.14 15:01:45 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.03.14 15:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.03.12 14:55:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2013.03.12 14:41:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\THQ
[2013.03.11 21:38:27 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Company of Heroes
[2013.03.11 20:34:33 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE
[2013.03.11 20:04:10 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\HeiMfgDeLu2013
[2013.02.28 15:00:33 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.02.28 15:00:33 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.02.28 15:00:33 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.02.28 15:00:33 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.02.28 15:00:31 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.02.28 15:00:31 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.02.28 15:00:30 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.02.28 15:00:30 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.02.28 15:00:30 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.02.28 15:00:30 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.02.28 15:00:30 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.28 15:00:30 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.28 15:00:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.28 15:00:30 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.28 15:00:29 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.02.28 15:00:29 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.02.28 15:00:29 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.02.28 15:00:29 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.02.28 15:00:29 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.02.28 15:00:29 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.02.28 15:00:29 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.02.28 15:00:29 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.02.28 15:00:29 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.02.28 15:00:29 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.02.28 15:00:28 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.02.28 15:00:28 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.02.28 15:00:28 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.02.21 18:46:41 | 000,000,000 | ---D | C] -- C:\My E-Books
[2013.02.21 18:46:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Martview
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MartView
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MartView
[2013.02.21 18:46:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.02.21 18:46:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.02.21 18:46:08 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2013.02.21 18:46:08 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2013.02.21 18:46:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2013.02.21 18:46:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2013.02.21 18:46:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.02.21 18:38:37 | 030,628,240 | ---- | C] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[2013.02.19 15:12:21 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Bewerbung
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.17 00:25:50 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.17 00:25:50 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.17 00:25:50 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.17 00:25:50 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.17 00:25:50 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.17 00:19:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.16 23:53:14 | 000,196,608 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.16 23:43:52 | 000,000,004 | ---- | M] () -- C:\Users\Maik\AppData\Roaming\skype.ini
[2013.03.16 23:43:27 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.16 20:57:32 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.16 20:57:32 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.16 20:45:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.16 20:40:51 | 007,487,854 | ---- | M] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:32 | 007,635,474 | ---- | M] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:05 | 004,273,684 | ---- | M] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:44 | 004,269,916 | ---- | M] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | M] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.11 22:03:28 | 011,130,317 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:47 | 007,729,559 | ---- | M] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | M] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | M] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | M] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | M] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:52 | 008,165,818 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | M] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:27:38 | 142,195,184 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:25:13 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:21:29 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:03:51 | 112,550,331 | ---- | M] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:30:42 | 007,083,135 | ---- | M] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:29:57 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.02.21 18:46:30 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:46:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2013.02.21 18:46:03 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2013.02.21 18:46:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2013.02.21 18:46:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2013.02.21 18:44:56 | 072,188,980 | ---- | M] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.02.21 18:39:01 | 030,628,240 | ---- | M] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.16 20:47:30 | 000,000,004 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\skype.ini
[2013.03.16 20:40:22 | 007,487,854 | ---- | C] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:29 | 007,635,474 | ---- | C] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:02 | 004,273,684 | ---- | C] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:41 | 004,269,916 | ---- | C] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | C] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.15 20:40:27 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.15 20:40:26 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.11 22:03:24 | 011,130,317 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:42 | 007,729,559 | ---- | C] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | C] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | C] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | C] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | C] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:48 | 008,165,818 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | C] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:25:19 | 142,195,184 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:22:14 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:17:08 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:02:48 | 112,550,331 | ---- | C] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:22:21 | 007,083,135 | ---- | C] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:02:48 | 012,627,694 | ---- | C] () -- C:\Users\Maik\Desktop\Avengers #1.cbr
[2013.02.21 19:02:47 | 012,654,114 | ---- | C] () -- C:\Users\Maik\Desktop\New Avengers #1.cbr
[2013.02.21 18:46:30 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:27:59 | 072,188,980 | ---- | C] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.01.05 00:13:39 | 000,000,275 | ---- | C] () -- C:\Windows\game.ini
[2012.12.29 14:41:55 | 000,107,832 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.12.29 14:41:39 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.06.21 20:42:51 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.04.22 17:02:39 | 000,002,286 | ---- | C] () -- C:\Users\Maik\.swfinfo
[2012.04.13 16:39:19 | 000,000,367 | ---- | C] () -- C:\Users\Maik\Heimnetzgruppe - Verknüpfung.lnk
[2012.01.11 08:29:19 | 000,084,992 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\skype.dat
[2011.08.22 14:46:44 | 000,012,885 | ---- | C] () -- C:\Windows\scunin.dat
[2011.08.14 02:36:27 | 000,064,452 | ---- | C] () -- C:\Users\Maik\DefaultProfile3.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile2.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile.xml
[2011.07.11 23:39:00 | 000,000,734 | ---- | C] () -- C:\Windows\EF2.INI
[2011.06.12 12:27:26 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\FXStudioDLL.dll
[2011.06.12 12:27:25 | 000,360,448 | ---- | C] () -- C:\Windows\SysWow64\pxd32d5.dll
[2011.06.12 12:27:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\fxstudio.dll
[2011.06.12 12:27:25 | 000,235,532 | ---- | C] () -- C:\Windows\SysWow64\loadimage.dll
[2011.06.12 12:27:25 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\lttls13n.dll
[2011.06.12 12:27:25 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\RapBoxDSP.dll
[2011.06.12 12:27:25 | 000,126,976 | ---- | C] () -- C:\Windows\SysWow64\NewWaveAnzeige.dll
[2011.06.12 12:27:25 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\eJ_Tool.dll
[2011.06.12 12:27:25 | 000,075,976 | ---- | C] () -- C:\Windows\SysWow64\Bassdec.dll
[2011.06.12 12:27:25 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\fader.dll
[2011.06.12 12:27:25 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\WndRgn.dll
[2011.06.12 12:27:25 | 000,029,696 | ---- | C] () -- C:\Windows\SysWow64\pthread.dll
[2011.06.12 12:27:24 | 000,796,672 | ---- | C] () -- C:\Windows\SysWow64\LTRTN13n.DLL
[2011.06.12 12:27:24 | 000,708,608 | ---- | C] () -- C:\Windows\SysWow64\ltcry13n.dll
[2011.06.12 12:27:23 | 000,338,944 | ---- | C] () -- C:\Windows\SysWow64\lffpx7.dll
[2011.06.12 12:27:23 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\lfkodak.dll
[2011.06.12 12:27:23 | 000,031,744 | ---- | C] () -- C:\Windows\SysWow64\lfvec13n.dll
[2011.05.28 16:03:17 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2011.05.26 15:14:06 | 000,000,340 | ---- | C] () -- C:\Windows\BeatBox.INI
[2011.05.26 15:09:08 | 000,000,271 | ---- | C] () -- C:\Windows\musicmaker.INI
[2011.05.26 15:06:58 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.28 10:39:00 | 000,000,000 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\wklnhst.dat
[2010.08.28 01:18:14 | 000,007,606 | ---- | C] () -- C:\Users\Maik\AppData\Local\Resmon.ResmonCfg
[2010.03.20 00:05:19 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Files - Unicode (All) ==========
[2012.05.11 01:03:25 | 000,001,836 | ---- | M] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk
[2012.05.11 01:03:25 | 000,001,836 | ---- | C] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:93DE1838
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:93EB7685
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:ABE89FFE
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:798A3728
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:0B9176C0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:4D066AD2

< End of report >
         

--- --- ---

und OTLOTL Logfile:

OTL logfile created on: 17.03.2013 00:21:44 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = f:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,93 Gb Total Physical Memory | 3,45 Gb Available Physical Memory | 87,90% Memory free
7,86 Gb Paging File | 7,39 Gb Available in Paging File | 94,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,87 Gb Total Space | 92,66 Gb Free Space | 20,19% Space Free | Partition Type: NTFS
Drive D: | 458,87 Gb Total Space | 75,60 Gb Free Space | 16,47% Space Free | Partition Type: NTFS
Drive F: | 7,44 Gb Total Space | 7,44 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.17 00:05:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- f:\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.09.15 09:42:12 | 000,119,632 | ---- | M] (Devguru Co., Ltd.) [Auto | Stopped] -- C:\Windows\SysNative\dgdersvc.exe -- (dgdersvc)
SRV:64bit: - [2010.02.25 11:07:54 | 000,202,752 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Stopped] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2013.03.16 11:13:33 | 000,115,608 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.07 13:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.01.04 23:27:20 | 000,107,832 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.12.29 14:41:39 | 000,066,872 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.12.10 17:29:46 | 002,465,712 | ---- | M] (LogMeIn Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.09.19 12:10:58 | 002,365,792 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012.08.13 12:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.09 04:03:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 04:03:51 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.03.16 20:34:32 | 000,489,256 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.11.20 13:21:36 | 000,351,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2010.09.15 09:37:40 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Stopped] -- C:\Windows\SysWOW64\dgdersvc.exe -- (dgdersvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 22:08:38 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Disabled | Stopped] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.12 11:31:00 | 000,121,416 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV:64bit: - [2012.05.09 04:03:51 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 04:03:51 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.07 18:42:28 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.28 09:45:51 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.04.28 09:45:51 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.03 12:08:42 | 001,918,976 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.09.15 09:42:12 | 000,020,552 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.08.26 11:16:33 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.03.04 14:43:00 | 000,346,144 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.02.25 11:22:38 | 006,369,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.02.25 10:12:10 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.02.24 11:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2010.01.28 02:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.12.09 10:39:52 | 000,537,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.10.30 13:44:40 | 000,460,864 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2u.sys -- (RL_DJIFIE2_USB)
DRV:64bit: - [2009.10.30 13:44:38 | 000,049,728 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2a.sys -- (RL_DJIFIE2_WDM)
DRV:64bit: - [2009.10.30 13:44:38 | 000,036,416 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2m.sys -- (RL_DJIFIE2_MIDI)
DRV:64bit: - [2009.10.20 10:03:16 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2009.09.19 06:30:14 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2009.09.19 06:30:14 | 000,128,000 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bserd.sys -- (ss_bserd)
DRV:64bit: - [2009.09.19 06:30:14 | 000,127,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bbus.sys -- (ss_bbus)
DRV:64bit: - [2009.09.19 06:30:14 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 03:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 03:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 03:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.04.29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2009.04.10 11:58:52 | 000,014,720 | ---- | M] (ROCCAT Development, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ValoFltr.sys -- (ValFltr)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2007.09.12 08:56:50 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2007.08.13 07:01:26 | 000,034,432 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiU04E5.sys -- (SaiU04E5)
DRV - [2012.09.18 16:02:02 | 000,011,880 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.09.15 09:37:40 | 000,018,120 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.04.08 11:06:08 | 000,070,400 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004.04.08 09:46:50 | 000,054,272 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06)
DRV - [2003.12.01 16:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003.09.06 13:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prosync1.sys -- (prosync1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{769FB394-A1BE-4A29-9393-9F7D84C9BA30}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=685749&p={searchTerms}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=685749"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://google.de/"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130129
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.9.2
FF - prefs.js..extensions.enabledAddons: firegestures%40xuldev.org:1.6.20
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.5
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Maik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.16 11:13:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.21 18:46:08 | 000,000,000 | ---D | M]
 
[2010.09.02 18:23:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Extensions
[2013.03.16 13:53:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\firefox@ghostery.com
[2013.03.16 13:53:56 | 000,141,008 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\firegestures@xuldev.org.xpi
[2012.12.11 20:16:07 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.03.12 04:42:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.31 23:32:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.03.16 11:13:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.02.21 18:46:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.23 11:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2011.10.03 10:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2013.03.16 11:13:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.03.16 11:13:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.16 11:13:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.03.16 11:13:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.03.16 11:13:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.03.16 11:13:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E62AE45-5AE7-48BA-9B03-8898A35CD37B}: NameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (C:\Users\Maik\AppData\Roaming\skype.dat) - C:\Users\Maik\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\groove.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\hamachi-2-ui.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\infopath.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\misc.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mspub.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\oaa.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\ois.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\outlook.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\Winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\groove.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\hamachi-2-ui.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\infopath.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\misc.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mspub.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\oaa.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\ois.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\outlook.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\Winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O29:64bit: - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 0
O33 - MountPoints2\{29a2e83e-b0ed-11df-ac91-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{29a2e83e-b0ed-11df-ac91-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{29a2e844-b0ed-11df-ac91-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{29a2e844-b0ed-11df-ac91-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7268-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7268-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{32ce726b-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce726b-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7270-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7270-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{32ce7273-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7273-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7280-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7280-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7284-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7284-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{32ce7287-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7287-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{39961901-bfa5-11e0-9316-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{39961901-bfa5-11e0-9316-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{3996191a-bfa5-11e0-9316-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{3996191a-bfa5-11e0-9316-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe
O33 - MountPoints2\{62c42ece-caf3-11df-b1d4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{62c42ece-caf3-11df-b1d4-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a6e1f054-c444-11e0-9271-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a6e1f054-c444-11e0-9271-806e6f6e6963}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a6e1f07a-c444-11e0-9271-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{a6e1f07a-c444-11e0-9271-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{abca770d-caee-11df-b598-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{abca770d-caee-11df-b598-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{abca770f-caee-11df-b598-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{abca770f-caee-11df-b598-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b0f7d295-c5d5-11e0-bcf4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b0f7d295-c5d5-11e0-bcf4-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b13cb40d-e152-11e0-a082-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b13cb40d-e152-11e0-a082-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b13cb410-e152-11e0-a082-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b13cb410-e152-11e0-a082-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{faf4cb51-772e-11dc-8a1a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{faf4cb51-772e-11dc-8a1a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.16 20:42:00 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2013.03.15 20:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.03.15 20:40:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.03.14 15:01:48 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.03.14 15:01:48 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.03.14 15:01:48 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.03.14 15:01:47 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.03.14 15:01:47 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.03.14 15:01:47 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.03.14 15:01:47 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.03.14 15:01:47 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.03.14 15:01:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.03.14 15:01:47 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.03.14 15:01:47 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.03.14 15:01:46 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.03.14 15:01:45 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.03.14 15:01:45 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.03.14 15:01:45 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.03.14 15:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.03.12 14:55:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2013.03.12 14:41:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\THQ
[2013.03.11 21:38:27 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Company of Heroes
[2013.03.11 20:34:33 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE
[2013.03.11 20:04:10 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\HeiMfgDeLu2013
[2013.02.28 15:00:33 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.02.28 15:00:33 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.02.28 15:00:33 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.02.28 15:00:33 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.02.28 15:00:31 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.02.28 15:00:31 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.02.28 15:00:30 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.02.28 15:00:30 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.02.28 15:00:30 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.02.28 15:00:30 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.02.28 15:00:30 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.28 15:00:30 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.28 15:00:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.02.28 15:00:30 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.28 15:00:30 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.02.28 15:00:29 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.02.28 15:00:29 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.02.28 15:00:29 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.02.28 15:00:29 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.02.28 15:00:29 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.02.28 15:00:29 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.02.28 15:00:29 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.02.28 15:00:29 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.02.28 15:00:29 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.02.28 15:00:29 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.02.28 15:00:28 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.02.28 15:00:28 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.02.28 15:00:28 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.02.21 18:46:41 | 000,000,000 | ---D | C] -- C:\My E-Books
[2013.02.21 18:46:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Martview
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MartView
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MartView
[2013.02.21 18:46:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.02.21 18:46:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.02.21 18:46:08 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2013.02.21 18:46:08 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2013.02.21 18:46:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2013.02.21 18:46:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2013.02.21 18:46:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.02.21 18:38:37 | 030,628,240 | ---- | C] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[2013.02.19 15:12:21 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Bewerbung
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.17 00:25:50 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.17 00:25:50 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.17 00:25:50 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.17 00:25:50 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.17 00:25:50 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.17 00:19:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.16 23:53:14 | 000,196,608 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.16 23:43:52 | 000,000,004 | ---- | M] () -- C:\Users\Maik\AppData\Roaming\skype.ini
[2013.03.16 23:43:27 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.16 20:57:32 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.16 20:57:32 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.16 20:45:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.16 20:40:51 | 007,487,854 | ---- | M] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:32 | 007,635,474 | ---- | M] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:05 | 004,273,684 | ---- | M] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:44 | 004,269,916 | ---- | M] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | M] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.11 22:03:28 | 011,130,317 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:47 | 007,729,559 | ---- | M] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | M] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | M] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | M] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | M] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:52 | 008,165,818 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | M] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:27:38 | 142,195,184 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:25:13 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:21:29 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:03:51 | 112,550,331 | ---- | M] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:30:42 | 007,083,135 | ---- | M] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:29:57 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.02.21 18:46:30 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:46:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2013.02.21 18:46:03 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2013.02.21 18:46:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2013.02.21 18:46:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2013.02.21 18:44:56 | 072,188,980 | ---- | M] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.02.21 18:39:01 | 030,628,240 | ---- | M] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.16 20:47:30 | 000,000,004 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\skype.ini
[2013.03.16 20:40:22 | 007,487,854 | ---- | C] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:29 | 007,635,474 | ---- | C] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:02 | 004,273,684 | ---- | C] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:41 | 004,269,916 | ---- | C] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | C] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.15 20:40:27 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.15 20:40:26 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.11 22:03:24 | 011,130,317 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:42 | 007,729,559 | ---- | C] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | C] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | C] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | C] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | C] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:48 | 008,165,818 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | C] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:25:19 | 142,195,184 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:22:14 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:17:08 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:02:48 | 112,550,331 | ---- | C] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:22:21 | 007,083,135 | ---- | C] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:02:48 | 012,627,694 | ---- | C] () -- C:\Users\Maik\Desktop\Avengers #1.cbr
[2013.02.21 19:02:47 | 012,654,114 | ---- | C] () -- C:\Users\Maik\Desktop\New Avengers #1.cbr
[2013.02.21 18:46:30 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:27:59 | 072,188,980 | ---- | C] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.01.05 00:13:39 | 000,000,275 | ---- | C] () -- C:\Windows\game.ini
[2012.12.29 14:41:55 | 000,107,832 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.12.29 14:41:39 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.06.21 20:42:51 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.04.22 17:02:39 | 000,002,286 | ---- | C] () -- C:\Users\Maik\.swfinfo
[2012.04.13 16:39:19 | 000,000,367 | ---- | C] () -- C:\Users\Maik\Heimnetzgruppe - Verknüpfung.lnk
[2012.01.11 08:29:19 | 000,084,992 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\skype.dat
[2011.08.22 14:46:44 | 000,012,885 | ---- | C] () -- C:\Windows\scunin.dat
[2011.08.14 02:36:27 | 000,064,452 | ---- | C] () -- C:\Users\Maik\DefaultProfile3.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile2.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile.xml
[2011.07.11 23:39:00 | 000,000,734 | ---- | C] () -- C:\Windows\EF2.INI
[2011.06.12 12:27:26 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\FXStudioDLL.dll
[2011.06.12 12:27:25 | 000,360,448 | ---- | C] () -- C:\Windows\SysWow64\pxd32d5.dll
[2011.06.12 12:27:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\fxstudio.dll
[2011.06.12 12:27:25 | 000,235,532 | ---- | C] () -- C:\Windows\SysWow64\loadimage.dll
[2011.06.12 12:27:25 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\lttls13n.dll
[2011.06.12 12:27:25 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\RapBoxDSP.dll
[2011.06.12 12:27:25 | 000,126,976 | ---- | C] () -- C:\Windows\SysWow64\NewWaveAnzeige.dll
[2011.06.12 12:27:25 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\eJ_Tool.dll
[2011.06.12 12:27:25 | 000,075,976 | ---- | C] () -- C:\Windows\SysWow64\Bassdec.dll
[2011.06.12 12:27:25 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\fader.dll
[2011.06.12 12:27:25 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\WndRgn.dll
[2011.06.12 12:27:25 | 000,029,696 | ---- | C] () -- C:\Windows\SysWow64\pthread.dll
[2011.06.12 12:27:24 | 000,796,672 | ---- | C] () -- C:\Windows\SysWow64\LTRTN13n.DLL
[2011.06.12 12:27:24 | 000,708,608 | ---- | C] () -- C:\Windows\SysWow64\ltcry13n.dll
[2011.06.12 12:27:23 | 000,338,944 | ---- | C] () -- C:\Windows\SysWow64\lffpx7.dll
[2011.06.12 12:27:23 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\lfkodak.dll
[2011.06.12 12:27:23 | 000,031,744 | ---- | C] () -- C:\Windows\SysWow64\lfvec13n.dll
[2011.05.28 16:03:17 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2011.05.26 15:14:06 | 000,000,340 | ---- | C] () -- C:\Windows\BeatBox.INI
[2011.05.26 15:09:08 | 000,000,271 | ---- | C] () -- C:\Windows\musicmaker.INI
[2011.05.26 15:06:58 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.28 10:39:00 | 000,000,000 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\wklnhst.dat
[2010.08.28 01:18:14 | 000,007,606 | ---- | C] () -- C:\Users\Maik\AppData\Local\Resmon.ResmonCfg
[2010.03.20 00:05:19 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Files - Unicode (All) ==========
[2012.05.11 01:03:25 | 000,001,836 | ---- | M] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk
[2012.05.11 01:03:25 | 000,001,836 | ---- | C] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:93DE1838
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:93EB7685
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:ABE89FFE
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:798A3728
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:0B9176C0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:4D066AD2

< End of report >
         

--- --- ---

Hallo Schnitzel87 und

Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten.

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schliessen von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich.
Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.
Arbeite daher in deinem eigenen Interesse solange mit, bis du das OK bekommst, dass alles erledigt ist.

Hinweise zum Ablauf

• Du bekommst von mir jeweils eine individuell auf dich abgestimmte schrittweise Anleitung.
  • Lese diese Anweisungen immer zuerst vollständig durch und frag bei Unklarheiten nach, bevor du beginnst.
  • Arbeite die Anleitungen dann sorgfältig und in der angegebenen Reihenfolge ab und poste deine Rückmeldungen und Logfiles gesammelt in einer Antwort.
  • Füge den Inhalt der Logfiles wenn immer möglich innerhalb von Code-Tags in deine Antwort ein.
  • Sollten Probleme auftauchen, dann brich an dieser Stelle ab und schildere sie so gut wie möglich.

• Es ist wichtig für mich, dass sich der Zustand deines Systems nicht plötzlich unvorhersehbar ändert. Deshalb: Bitte
  • .. lasse keine Scanner oder Tools ohne Aufforderung laufen. Lösche nichts auf eigene Faust.
  • .. installiere oder deinstalliere während der Bereinigung keine Software.
  • .. frag nicht parallel in anderen Foren nach Hilfe (Crossposting).

• Ich kann dir keine Garantien geben, dass die Bereinigung schlussendlich erfolgreich sein wird und wir alles finden werden.
  • Ein Formatieren und Neuinstallieren ist meist der schnellere und immer der sicherere Weg.
  • Sollte ich eine schwerwiegende Infektion bei dir finden, werde ich dich nochmals darauf hinweisen. Es bleibt aber deine Entscheidung.

Los geht's: Alle Tools immer auf den Desktop speichern und von dort starten.

Also: Schritt 1 sollte den Rechner entsperren, die weiteren Schritte solltest du dann wieder im normalen Modus ausführen können.
(Du hast zwei Mal die OTL.txt gepostet. Wurde auch noch eine Extras.txt erstellt? Wenn ja, bitte noch nachreichen.)


Schritt 1

Erstelle zuerst auf einem Zweitrechner das Fixskript:

• Drücke dazu bitte die + R Taste, schreibe "notepad" in das Ausführen Fenster und drücke OK.
  
• Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument:
  (Wichtig: Falls du deinen Benutzernamen im Log unkenntlich gemacht hast (z.B. durch ***), dann mach das hier wieder rückgängig.)
  

  :OTL
  O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (C:\Users\Maik\AppData\Roaming\skype.dat) - C:\Users\Maik\AppData\Roaming\skype.dat ()
  [2013.03.16 23:53:14 | 000,196,608 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
  [2013.03.16 23:43:52 | 000,000,004 | ---- | M] () -- C:\Users\Maik\AppData\Roaming\skype.ini
  @Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA
  @Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:93DE1838
  @Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:93EB7685
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:E36F5B57
  @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:ABE89FFE
  @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:5D7E5A8F
  @Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:798A3728
  @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:0B9176C0
  @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:E1F04E8D
  @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:4D066AD2
           

• Speichere dann die Datei als fix.txt auf den USB-Stick, wo die OTL.exe liegt.

Danach führe folgendermassen den Fix aus:

• Schliesse den USB-Stick wieder an den infizierten Rechner an und starte diesen in den abgesicherten Modus mit Eingabeaufforderung.
• Gib nun bitte folgenden Befehl in die Kommandozeile ein und drücke Enter:

  e:\OTL.exe

  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Wenn es bei dir ein anderer Buchstabe ist, dann passe den Befehl entsprechend an.
  Es sollte sich nun das Fenster von OTL öffnen.
• Klicke auf den Fix Button.
• Drücke dann OK, um den Fix von einem File zu laden.
• Wähle die erstellte fix.txt auf dem USB-Stick aus. Ihr Inhalt wird in die Textbox eingefügt.
• Klicke nun erneut auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Diesen bitte zulassen.
• Nach einem Neustart versuche wieder in den normalen Modus zu booten.
• Auf deinem USB-Stick sollte im Ordner _OTL ein Log-File (\_OTL\MovedFiles\<time_date>.txt) erstellt worden sein.
• Kopiere nun dessen Inhalt hier in deinen Thread.

Schritt 2

Downloade dir bitte defogger (von jpshortstuff) auf deinen Desktop.

• Starte das Tool mit Doppelklick.
• Klicke nun auf den Disable Button.
• Bestätige diese Sicherheitsabfrage mit Ja.
• Wenn der Scan beendet wurde (Finished), klicke auf OK.
• Falls Defogger zu einem Neustart auffordert, bestätige dies mit OK.
• Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.txt.
• Nur falls Probleme aufgetreten sind, poste deren Inhalt mit deiner nächsten Antwort.

Klicke den Re-enable Button nicht ohne Anweisung!



Schritt 3

Lade dir Gmer herunter (auf den Button Download EXE drücken) und speichere das Programm auf den Desktop.

• Deaktiviere alle Antivirenprogramme und Malware/Spyware Scanner.
• Trenne alle bestehenden Verbindungen zu einem Netzwerk/Internet (WLAN nicht vergessen).
• Schliesse bitte alle anderen Programme.
• Starte gmer.exe (die Datei hat einen zufälligen Dateinamen).
  Vista und Win7 User mit Rechtsklick "als Administrator starten".
• Sollte sich ein Fenster mit folgender Warnung öffnen

  WARNING !!!
  GMER has found system modification, which might have been caused by ROOTKIT activity.
  Do you want to fully scan your system ?

  dann klicke unbedingt auf No.
• Entferne rechts den Haken bei:
  • IAT/EAT
  • Show all
• Setze rechts den Haken bei deiner Systempartition (normalerweise C:\).
• Starte den Scan mit einem Klick auf Scan.
• Mache gar nichts am Computer, während der Scan läuft!
• Wenn der Scan fertig ist, klicke auf Save und speichere das Logfile unter Gmer.txt auf deinen Desktop.
• Schliesse dann GMER und führe unmittelbar einen Neustart des Computers durch.
• Füge bitte den Inhalt des Logfiles hier in deine Thread ein.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor du ins Netz gehst.



Schritt 4

Verschiebe die OTL.exe vom USB-Stick auf deinen Desktop.

• Starte bitte die OTL.exe.
• Setze den Haken bei Scan all Users.
• Drücke auf den Quick Scan Button.
• Poste den Inhalt von OTL.txt hier in den Thread.

Bitte poste in deiner nächsten Antwort:

• Fixlog von OTL
• Log von Gmer
• Log von OTL

ach... hier noch das extras log : )OTL EXTRAS Logfile:

OTL Extras logfile created on: 17.03.2013 00:21:44 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = f:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,93 Gb Total Physical Memory | 3,45 Gb Available Physical Memory | 87,90% Memory free
7,86 Gb Paging File | 7,39 Gb Available in Paging File | 94,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,87 Gb Total Space | 92,66 Gb Free Space | 20,19% Space Free | Partition Type: NTFS
Drive D: | 458,87 Gb Total Space | 75,60 Gb Free Space | 16,47% Space Free | Partition Type: NTFS
Drive F: | 7,44 Gb Total Space | 7,44 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04818B01-2BBE-4ECC-8F34-30DCA57B6798}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{09CC3549-E538-43D9-AFF7-C1A957664FAA}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{176049B5-DD95-4B7F-BECC-0573677F75A7}" = lport=7777 | protocol=6 | dir=in | name=schnitzel | 
"{1F0AE0D9-C36E-4DB7-8ABF-0639AB85E6EA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2597B1A0-57E2-467D-83A4-1765DF7216A5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2767EB45-3835-4AB9-9F21-572F116C8A96}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2B305A6D-46D8-4A69-A8FE-327F7BF088EC}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{2CD5E22B-B266-4711-878A-A544937A569A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{329DB3B6-93BC-4341-A57D-1F2EFBEA249B}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{341875F1-031F-4D4F-87A1-A5C8A78BB89E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3905639D-943F-4686-97D1-48FC167A9C5C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{3BFE064D-FDAA-47E3-B0D0-5D13A7452A96}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3CAC2364-E9A5-45D1-A5F4-6C2CB35A178E}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{3E477135-AC66-4E44-A6A0-398571A25C41}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3E4D57D6-7BB9-4B65-B724-C4B5D5B232D7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{43199E2B-6A99-4D03-BF8C-C3F2554D9937}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{44EF3570-164B-4145-ACCF-BE1E6DD8901A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{455D74CA-9690-4D82-97F8-270794048030}" = rport=139 | protocol=6 | dir=out | app=system | 
"{50C10399-B570-4902-A78C-C7399D2D64BA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{561CEE33-2CCB-4442-932F-E5AAEFD2B4BF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5746B30D-8BD2-40C2-8F01-898A39B0F3EE}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{5841FEE7-D56C-4401-9694-55612B3EB639}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{588D012B-D1B4-4C92-A4DB-865C15155DD7}" = rport=137 | protocol=17 | dir=out | app=system | 
"{5E3E043E-1278-4635-AF8A-F308C4989823}" = lport=137 | protocol=17 | dir=in | app=system | 
"{600C01E9-EF15-4F3C-B5B5-DBECB5C9ABBE}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{63DBB35C-473D-4BEA-ABDE-6EECC344A70D}" = lport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{689973B5-1D51-47DB-9850-F31E94C565E2}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{6DE911A3-10B9-42E8-9E66-8DCF24897F93}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{7252DDCD-DDD3-40DD-8BB9-59B6E7887997}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{7E16D939-276D-4142-8095-9F2573869B2C}" = rport=445 | protocol=6 | dir=out | app=system | 
"{8CCE21C1-C5B0-492C-8982-2506BECDB350}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{8EDBE715-0858-4653-ABDF-F226569444AB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{8F7101A6-9206-4E34-B659-CE5E41050952}" = lport=139 | protocol=6 | dir=in | app=system | 
"{91112A4A-2D63-4B81-96C5-8F422D9FF2E6}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{930F44DC-BA12-4108-AD11-38D33BAAFC90}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=datei- und druckerfreigabe (spoolerdienst - rpc-epmap) | 
"{9A6CD5A1-EEFF-4E27-A3DB-86EC58626EE5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{9D4958FB-6365-4618-AD38-DB423FD750BD}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{9EE197AB-119F-415F-BA0C-EC8FE1107483}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A08BDB0E-098A-4D09-B8FB-947FA681884A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A1961B27-0F4B-4BB9-B1C6-421ABAC0C02E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B6CDAB17-6471-49DB-92B0-721FEF8A96E2}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{C5015DFA-00E6-4954-812D-36E22BD1A107}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{C8C066F7-E732-4C2E-BB32-F8D225D35C5B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CB71E331-1FBD-426A-92DE-E0C648AE822C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CD3BD0CB-81FB-4093-BC28-4D76BFB333F7}" = lport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D3FF6A9D-7D69-455A-8F31-2DD577E1EF52}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D5D32909-FD99-45F5-A362-10020B3CAF1C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D91F32B3-5BB3-4785-8E93-795DC5F33C36}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DCBBB2FA-A20D-45DC-8A5F-B695E47E705E}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{DFE5DA3E-FA57-4DD1-A67B-B89DA68BE086}" = lport=445 | protocol=6 | dir=in | app=system | 
"{E3C05627-4273-4011-ADF3-A808E4D86C3C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{EB0E5F9B-6B4C-4549-AAA7-C1198DAABF3D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EE82C4A6-88C8-4334-ADC6-C3C33BA1C81B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{F36FC9F3-F320-4B9B-8141-F3159C27E4E1}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{F5339CFC-FD30-4E40-BF84-637198FE30C3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F69CC5C3-131C-4CB9-95FB-C7BF11531028}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FCD23BE6-324F-467F-98D8-FA739E72F851}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0228623B-BC4C-47D2-BB19-CD383BBDBB0A}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age 2\bin_ship\dragonage2.exe | 
"{039F8666-4B96-4A00-9EAC-04313AF1521B}" = protocol=6 | dir=in | app=c:\program files (x86)\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"{07049BA8-CDB8-46B6-BE69-5E98510561AA}" = protocol=1 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv4 ausgehend) | 
"{0E06D082-5258-4AAC-9CFF-DF6E97809885}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{11EF24A5-3361-4117-AC9C-22184C717D69}" = protocol=17 | dir=in | app=c:\program files (x86)\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"{1B56954E-7106-4597-A655-29DD1A2F6C46}" = protocol=17 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv.exe | 
"{1E39A5DC-32A8-4D61-A3BC-CBBDB3536CF5}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{20BC00DA-AC10-4AC6-A49F-3F4EBE35B32F}" = protocol=6 | dir=in | app=d:\musik\elektro\lan games\flatout 2\flatout2.exe | 
"{214F4412-FC38-4D10-84AE-66CEB38DB5E9}" = protocol=17 | dir=in | app=c:\users\maik\appdata\roaming\dropbox\bin\dropbox.exe | 
"{22987E55-F35F-487C-A3EE-2D2BAEE8E64E}" = protocol=6 | dir=out | app=system | 
"{29D8D846-CF97-4516-9CFB-0D6B9E3B1DBC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{29FF3FB2-ADBB-4A23-9EC9-236697E8A6EF}" = protocol=6 | dir=in | app=c:\program files (x86)\pc3oot hackingsoft\pc3oot-tv\pc3oot-tv_gui.exe | 
"{2D8CDC17-E83F-4366-AB0E-4B38F449C9BD}" = protocol=17 | dir=in | app=c:\program files (x86)\star wars empire at war\gamedata\sweaw.exe | 
"{3070A4F3-B83C-48D0-A5AD-BEA1376D8CB1}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{32DEE9D5-D98B-4707-97EC-F4B0F5E5254B}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{34A2A186-62C8-4F97-8A3A-1C49116C3ADB}" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe | 
"{36451B2B-29EA-4802-980F-EA97205E3FCA}" = protocol=6 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{36F5D8BE-A8C9-4D90-900D-21DF1DB58406}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{38F00AB2-5AD0-4303-94E0-BF7BEBD0197C}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{3E216D04-F7BC-42B7-A76C-056F91A59223}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{3F0743EC-286B-4665-88E0-23183046C0E2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4146020B-F4C4-409B-9AF1-6E2B1504E50C}" = protocol=6 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{43D1EDCE-7389-42D5-830C-E0FCC129449F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{43DB911D-32CF-4E69-84B3-241C6EEB6059}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{45B29A30-19EC-4328-AAC9-A53488107905}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4952F0C1-687C-41B5-B624-766DBF0EFDA2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4A48D883-0CEC-4AC4-8A72-52BE0DF17DE3}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{4C7B2785-9216-4623-AC41-55CF0ECD5994}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{4E3115D2-C4E0-4610-AAD7-83E5720DA8F8}" = protocol=6 | dir=in | app=c:\program files\teamspeak 3 client\ts3client_win64.exe | 
"{4FAA0749-ECFA-400A-8357-E4A2B690B00C}" = protocol=6 | dir=in | app=c:\program files (x86)\portal 2\portal2.exe | 
"{51F342D3-102F-4048-A89B-7932DFA8C0E7}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{57BFE29A-F1BA-4580-B1E8-F95384AE7ABA}" = protocol=6 | dir=in | app=c:\program files (x86)\thq\company of heroes\reliccoh.exe | 
"{5AAB331C-788A-40E9-B9C2-BAD044C4BDCA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{601CEB52-2F08-492C-8911-22121D419F12}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{622D387D-0E9F-4CAC-884E-8C45F616BB25}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{6883AC18-B5A6-4120-946C-E9C159D905DB}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{6D2F5241-BC6A-415C-B2B3-6CB5B9C64EA9}" = protocol=6 | dir=in | app=d:\musik\elektro\lan games\unreal tournament 3\binaries\ut3.exe | 
"{6E73D716-72F2-4A65-9728-FF4551A34702}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6E8BF3B3-B81C-43F7-B63E-294E2C43CA37}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{7024BECF-19F3-4F14-A3A9-2AAECBC95227}" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 
"{7E429206-74BE-414A-900C-19E2688ABF67}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{7EFAB8FF-9488-402F-ADBA-DC2851C7F884}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe | 
"{8392AC74-5342-4C26-A83F-3B0F5D5780B0}" = protocol=6 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv_dx11.exe | 
"{856D5303-F21D-4643-A8F2-B57E708FD278}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcrmgr.exe | 
"{858C6D90-E6F5-4B5C-BFFC-AF762514C982}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe | 
"{89ED42C7-4D31-40C6-B6B6-65C7EDE31473}" = protocol=17 | dir=in | app=d:\musik\elektro\lan games\unreal tournament 3\binaries\ut3.exe | 
"{8A7CF80F-E88C-42A4-93CA-9853ED8FA1DD}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) | 
"{8EDC57F3-65D5-4A41-B767-9E36310DDE66}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{9005DFF3-684D-4F85-A7B7-59907EC53615}" = protocol=6 | dir=in | app=c:\users\maik\appdata\roaming\dropbox\bin\dropbox.exe | 
"{932A473F-E0E6-4B78-ADCC-83E5505BA4C3}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe | 
"{94266552-41B2-44F8-9061-4AF7854558F4}" = protocol=6 | dir=in | app=c:\program files (x86)\sid meier's civilization v\launcher.exe | 
"{955C9D4B-5C8C-4BD0-AE84-351A7A7086BB}" = protocol=17 | dir=in | app=c:\program files (x86)\portal 2\portal2.exe | 
"{9678F7A0-1726-46A4-87A1-CDB2052BBE2B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{977D8ED8-B0B5-4597-AC9D-0898B79839BC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{9B2FACF1-C025-4CCF-86D8-2ACF8F8056F3}" = protocol=6 | dir=in | app=c:\program files (x86)\star wars empire at war\gamedata\sweaw.exe | 
"{A17124DE-2A03-4DE4-AC51-7C7C9B615499}" = protocol=6 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv.exe | 
"{A38B5783-97B9-4A65-B2A9-0F0C7EDA26F7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{A651465C-4632-42C7-920B-B01B19666DB6}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{A6B4FA54-87B8-4AEC-8D3C-0A7AE527D4C7}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age 2\dragonage2launcher.exe | 
"{A8DBE3CC-8C0C-4D36-87D3-09F252EB6FDF}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{AED1187E-5986-4E99-A339-E76E5E9BC301}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B0929AC5-627A-41D8-8F0A-1833E865EC28}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age 2\dragonage2launcher.exe | 
"{B41E0A81-31CB-4860-AD6A-84419FA55A6E}" = protocol=17 | dir=in | app=c:\program files\teamspeak 3 client\ts3client_win64.exe | 
"{BBDA41EC-9F35-42C6-9C1B-82F5DCE7667B}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | 
"{C0BAB96E-A5CA-4D39-8D83-21ADDCB75773}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{C22FD27F-F3F8-4122-BAE2-B4FC841B8039}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcrmgr.exe | 
"{C28ADD03-4883-4AC4-B2C7-5FDCEFC1C185}" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 
"{C423DBC7-0093-4A32-8BC0-EDE66574AEFD}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age 2\bin_ship\dragonage2.exe | 
"{C8C8359B-FFF6-4D30-95D6-BB98FD881524}" = protocol=58 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv6 ausgehend) | 
"{CAEBF12A-ABDA-4D1D-B848-B26B4C0DA54A}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{CC363643-2ECC-4ABF-BDD9-B0A98E190353}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe | 
"{CD082144-30BF-4081-BFB6-1F28AC9EA992}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{CFC5B735-D304-4D8F-A897-9A02973C4220}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) | 
"{D5C6D9FC-990F-415A-B209-7EAE3B46FA35}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D5F37FE1-10D6-4465-9A41-EF3007CC0112}" = protocol=17 | dir=in | app=c:\program files (x86)\pc3oot hackingsoft\pc3oot-tv\pc3oot-tv_gui.exe | 
"{DEEB1B52-7CFD-4850-BD19-3D2975C2E40F}" = protocol=17 | dir=in | app=d:\musik\elektro\lan games\flatout 2\flatout2.exe | 
"{DFF6177C-8868-469B-81E8-7A4A768170D0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E8459610-DF5E-4FDC-9DCF-8125EFEF1B2C}" = protocol=17 | dir=in | app=c:\program files (x86)\sid meier's civilization v\launcher.exe | 
"{EAC1CDAC-C35A-4ACF-8FE3-EBCD0DEB274C}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{F44DBC08-4F49-4ABA-9277-1651571AFDAE}" = protocol=17 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv_dx11.exe | 
"{F4AFE473-B98F-428E-AF18-32F392A0A548}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{F8C85E9C-937A-4BF3-BABE-392D12EC6582}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{F96FDB6E-44AC-4665-85F0-2B61CA521BF8}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{FE382D18-19C7-4481-AC33-E1EBC6A33851}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{FE5AC35A-185C-4ECA-A49B-8599A6E10A7D}" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe | 
"{FEBA56C7-80F1-411B-B54A-A213D0E022D4}" = protocol=17 | dir=in | app=c:\program files (x86)\thq\company of heroes\reliccoh.exe | 
"{FFB6D28E-58CE-4372-AAFF-2A6061B805F2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{0EA9F4A1-A070-4774-8228-65CF20D72599}C:\program files\apexdc++\apexdc-x64.exe" = protocol=6 | dir=in | app=c:\program files\apexdc++\apexdc-x64.exe | 
"TCP Query User{2F1E9617-E7C8-46A6-871D-1D0D981CBE57}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{35C4B423-8E15-48FB-9565-EF9A90F3B4A0}C:\program files (x86)\microsoft games\age of empires iii\age3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires iii\age3.exe | 
"TCP Query User{40EB3D3D-8F40-4592-A227-4F23B2B999FD}C:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe | 
"TCP Query User{51D2C4FA-6DF9-4CCB-8D4C-5FFF3903D94A}C:\program files (x86)\games\dead.island.game.of.the.year.edition\deadislandgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\games\dead.island.game.of.the.year.edition\deadislandgame.exe | 
"TCP Query User{620BD8C6-2E39-4FD0-BA25-244D21A6DEC1}C:\program files (x86)\birth of the empires alpha 6.1\bote.exe" = protocol=6 | dir=in | app=c:\program files (x86)\birth of the empires alpha 6.1\bote.exe | 
"TCP Query User{65995831-7CCD-45B2-9728-2A1BB7EC6AE5}C:\program files (x86)\star wars empire at war\gamedata\fpupdate.exe" = protocol=6 | dir=in | app=c:\program files (x86)\star wars empire at war\gamedata\fpupdate.exe | 
"TCP Query User{7E34E07D-8B1E-40BB-8943-D18A69DAFCAD}C:\windows\syswow64\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dplaysvr.exe | 
"TCP Query User{806A7F1C-E539-468B-A7A5-DEA4A63A59C9}D:\musik\elektro\lan games\unreal tournament 3\binaries\ut3.exe" = protocol=6 | dir=in | app=d:\musik\elektro\lan games\unreal tournament 3\binaries\ut3.exe | 
"TCP Query User{82D529FD-52FB-4AAD-990A-CBB6503A3660}C:\program files (x86)\birth of the empires alpha 6.1\bote.exe" = protocol=6 | dir=in | app=c:\program files (x86)\birth of the empires alpha 6.1\bote.exe | 
"TCP Query User{82E6D36A-39AA-48B1-926C-522505DF5D90}C:\users\maik\appdata\local\temp\00ad0c0a982d4800bec5d559bdb5f5a0\relicdownloader.exe" = protocol=6 | dir=in | app=c:\users\maik\appdata\local\temp\00ad0c0a982d4800bec5d559bdb5f5a0\relicdownloader.exe | 
"TCP Query User{90C647AF-9F03-47ED-B7E7-FEA08F799A2D}D:\musik\elektro\lan games\aoe 2\age2_x1\age2_x1.exe" = protocol=6 | dir=in | app=d:\musik\elektro\lan games\aoe 2\age2_x1\age2_x1.exe | 
"TCP Query User{9A41684E-E01F-4B14-94F0-B7FC4CA98FDF}C:\program files (x86)\microsoft games\age of empires iii\age3y.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires iii\age3y.exe | 
"TCP Query User{9B6321C1-6C2D-4371-8699-39A26B72C7FB}C:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 
"TCP Query User{9CFCD630-BDC4-491A-BE5A-BAF4F6EBBA97}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{A350D041-7826-497A-9CDE-805DC15F6DED}C:\windows\syswow64\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dplaysvr.exe | 
"TCP Query User{AB727845-29CD-47DF-BC4A-59618803EB04}C:\program files (x86)\portal 2\portal2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\portal 2\portal2.exe | 
"TCP Query User{B0B548A3-86A3-46C7-9B64-E11A9F7FC928}C:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe | 
"TCP Query User{B6D9D4C1-3DD1-4CCA-AC30-9B3D43647102}D:\musik\elektro\lan games\flatout 2\flatout2.exe" = protocol=6 | dir=in | app=d:\musik\elektro\lan games\flatout 2\flatout2.exe | 
"TCP Query User{BA74B60D-E08D-4089-89BF-E7AAC87D7DD6}C:\program files (x86)\sid meier's civilization v\civilizationv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv.exe | 
"TCP Query User{F35D3420-1E74-4895-98ED-9D1DF450425B}C:\program files\apexdc++\apexdc-x64.exe" = protocol=6 | dir=in | app=c:\program files\apexdc++\apexdc-x64.exe | 
"UDP Query User{09A65EF7-E8BF-4E41-A26E-446F6A421120}C:\program files (x86)\sid meier's civilization v\civilizationv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv.exe | 
"UDP Query User{177BF7BF-2A0D-4F9C-95C5-6AF6B5D59216}C:\program files (x86)\portal 2\portal2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\portal 2\portal2.exe | 
"UDP Query User{25CB41C8-49B3-40B2-809E-108B61319E05}C:\program files (x86)\birth of the empires alpha 6.1\bote.exe" = protocol=17 | dir=in | app=c:\program files (x86)\birth of the empires alpha 6.1\bote.exe | 
"UDP Query User{2DA40DE3-CA41-42D0-B33B-B9AA6DBE4453}C:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 
"UDP Query User{360A28AA-5D0C-454B-B77D-6AEC78D35B7E}D:\musik\elektro\lan games\aoe 2\age2_x1\age2_x1.exe" = protocol=17 | dir=in | app=d:\musik\elektro\lan games\aoe 2\age2_x1\age2_x1.exe | 
"UDP Query User{3C8488C3-A5CB-4540-98B5-100BADF6DE38}D:\musik\elektro\lan games\flatout 2\flatout2.exe" = protocol=17 | dir=in | app=d:\musik\elektro\lan games\flatout 2\flatout2.exe | 
"UDP Query User{4885A23A-2F42-4C63-B80C-1FBC8843010A}C:\program files (x86)\microsoft games\age of empires iii\age3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires iii\age3.exe | 
"UDP Query User{7BBAEA4E-AE3A-4133-BD17-154214026C89}C:\windows\syswow64\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dplaysvr.exe | 
"UDP Query User{90FC12E3-4B88-4AB9-831E-29F048CAE1F4}C:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe | 
"UDP Query User{996F0AD1-4AF4-4AC3-B2F0-AD1F99330AA9}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{9C8CD4BC-3DAB-475E-920B-51903BB2A473}C:\program files\apexdc++\apexdc-x64.exe" = protocol=17 | dir=in | app=c:\program files\apexdc++\apexdc-x64.exe | 
"UDP Query User{A5AE852E-9649-420A-A120-A9923E847953}C:\program files (x86)\star wars empire at war\gamedata\fpupdate.exe" = protocol=17 | dir=in | app=c:\program files (x86)\star wars empire at war\gamedata\fpupdate.exe | 
"UDP Query User{A7036594-BB2B-4609-883C-A2ECD6B86788}D:\musik\elektro\lan games\unreal tournament 3\binaries\ut3.exe" = protocol=17 | dir=in | app=d:\musik\elektro\lan games\unreal tournament 3\binaries\ut3.exe | 
"UDP Query User{AAF17DD3-ADBB-4AC2-9EB4-A2234DB3F197}C:\program files (x86)\microsoft games\age of empires iii\age3y.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires iii\age3y.exe | 
"UDP Query User{ABB9969D-6B77-41ED-849D-C4DD4028421B}C:\program files\apexdc++\apexdc-x64.exe" = protocol=17 | dir=in | app=c:\program files\apexdc++\apexdc-x64.exe | 
"UDP Query User{C21C64EE-200D-42CB-B6A4-1C1916232F02}C:\windows\syswow64\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dplaysvr.exe | 
"UDP Query User{C5620359-F8F6-4159-AC76-4AD0215CAE9A}C:\program files (x86)\birth of the empires alpha 6.1\bote.exe" = protocol=17 | dir=in | app=c:\program files (x86)\birth of the empires alpha 6.1\bote.exe | 
"UDP Query User{CA83A968-7183-4504-B69A-D2CE675ADFE3}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{CD036AAC-E309-4C0B-9D91-9A837257D51F}C:\program files (x86)\games\dead.island.game.of.the.year.edition\deadislandgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\games\dead.island.game.of.the.year.edition\deadislandgame.exe | 
"UDP Query User{F5DC656D-E26F-4263-9232-1AF94068F382}C:\users\maik\appdata\local\temp\00ad0c0a982d4800bec5d559bdb5f5a0\relicdownloader.exe" = protocol=17 | dir=in | app=c:\users\maik\appdata\local\temp\00ad0c0a982d4800bec5d559bdb5f5a0\relicdownloader.exe | 
"UDP Query User{F8E75ED3-2671-4DF5-B372-DEF3C36C5862}C:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\cryptic studios\star trek online\live\gameclient.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java(TM) 7 Update 3 (64-bit)
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy Gamepad tool 0.7.1001
"{43D1A6DC-F2D3-4EBC-8851-CC8B9C0C8763}_is1" = ApexDC++ 1.4.3
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{738E4E18-C4FB-8948-9779-A6857A677E51}" = ccc-utility64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9ED333F8-3E6C-4A38-BAFA-728454121CDA}" = PDF-XChange Viewer
"{A4404CD3-561D-6B14-ECDA-69AB1BC6A5BC}" = ATI Catalyst Install Manager
"{A8EC0CC0-AD8D-4244-B080-424EDF7A7634}" = Native Instruments Traktor 2
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DDA8FE2D-EA67-194C-D6A5-F52BC4FDA20F}" = ATI AVIVO64 Codecs
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"C-Media CM106 Like Sound Driver" = USB Multi-Channel Audio Device
"EPSON SX525WD Series" = EPSON SX525WD Series Printer Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"USB_AUDIO_DEusb-audio.deRLDJIF2" = Digital Jockey - IE2
"VLC media player" = VLC media player 2.0.2
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00C91FFD-66F7-7599-27A4-2158E063DE8B}" = Catalyst Control Center Graphics Full New
"{0151E7E3-E236-F8FA-1B1E-4116E848AA80}" = Catalyst Control Center Graphics Full Existing
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{09A1B02F-7814-E662-098A-0AE641A5DFFD}" = Catalyst Control Center Localization All
"{0A753859-207A-436C-BB49-B0A4FA72F91E}_is1" = Birth of the Empires 0.81
"{0CEC2F82-AEB2-4C4B-B450-62C6CEF159FE}_is1" = Age of Empires 2 & The Conquerors v1.1 Userpatch AiO version 0.2
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{106B4413-ACBB-4CDE-8707-587DB9BD77EC}" = LogMeIn Hamachi
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{176CFC97-0619-63F5-216F-DA91DF5C180C}" = CCC Help Thai
"{178EF55D-51F6-62EC-A25F-C7CB3FB375B8}" = CCC Help Dutch
"{1857AAB1-77E0-40FF-91C5-9E415F248F36}" = MartView
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1AB7AB77-6AF0-8349-CDAA-0BB7BD5AD57C}" = CCC Help Chinese Standard
"{1B8099EF-9E12-42AE-814A-D169D0176564}" = System Health Windows SideShow Gadget
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{287A4E96-AC57-4A19-9B51-C5EED2EAB382}" = Star Trek Legacy
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2EAE344E-F3FB-967E-51B5-EF1697364D91}" = CCC Help Russian
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{32E2F180-247C-4077-B06A-20F9868568E1}_is1" = UltraMixer 3.0.0
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{3516C69A-024D-42A8-B948-FFAA7B9CC49A}" = Windows SideShow Managed Runtime 1.0
"{3548CAD1-45FB-72E9-7C5B-3F50FB42E2D2}" = CCC Help Italian
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{434D0FA0-1558-4D8E-AC3D-BD1000008200}" = DiRT 3
"{45410935-B52C-468A-A836-0D1000018201}" = BulletStorm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D43D635-6FDA-4FA5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.2
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{50A9A489-68FB-17EB-5EC7-44F55E5E3FCD}" = Catalyst Control Center Graphics Previews Vista
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58AE1219-4CF0-7920-A8D9-204AE4291B6B}" = CCC Help Finnish
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{5B4383F2-37EE-4E97-AD81-F5FF76F286DA}" = OutlookAddInNet3Setup
"{5F4D7F9D-E36B-4E3C-A11C-DB365E676232}" = CCC Help Polish
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{654304D2-7FDB-5A2C-84AD-8253AD4B47A1}" = ccc-core-static
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{67565ee8-222f-4073-933e-a2b9ab033e49}" = Nero 9 Essentials
"{6A4B388A-C460-9371-A401-272BED1BC785}" = CCC Help Danish
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6BC06531-C06B-0637-6868-DFC30D297ECF}" = CCC Help Swedish
"{6DEF8F72-0510-2265-3C1B-3D72DBFF6CCA}" = CCC Help Spanish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7F446B99-7355-05E0-B9DA-580993D79E0C}" = CCC Help Turkish
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.20
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2007
"{90120000-0017-0407-0000-0000000FF1CE}_OMUI.de-de_{2733AA87-26FC-41B0-9D2F-3092345BC370}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_OMUI.de-de_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_OMUI.de-de_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_OMUI.de-de_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_OMUI.de-de_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002A-0407-1000-0000000FF1CE}_OMUI.de-de_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_OMUI.de-de_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2007
"{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2007
"{90120000-0101-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C17B3F0-577B-538D-DB8C-40197D03FAD4}" = CCC Help Japanese
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6F5703D-A4B1-4857-9EDD-DC0ABBBB0D96}" = TuneUp Utilities Language Pack (en-US)
"{A7A34FC9-DF24-4A36-00AD-D4EFE94CC116}" = SimCity 4 Deluxe
"{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B191AED2-AF18-3195-44AF-5D60A8F52DB7}" = CCC Help Chinese Traditional
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B95EBC95-B7CF-D326-EB73-AA1E33D1A31E}" = CCC Help French
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{BAF19BB1-7716-4F37-5C47-E9DD9A70BC0F}" = Catalyst Control Center InstallProxy
"{BD243CE6-93CC-1284-4A90-90EA06B19FFB}" = CCC Help Greek
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{BE627CA2-AB0E-275B-FCEF-6FBDE4AB1124}" = CCC Help German
"{C24B5777-DA09-50F7-79EF-E26E53D1559A}" = CCC Help English
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C77E500C-FB0C-D423-991B-3FE5B24AAA80}" = CCC Help Norwegian
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{CABAE860-68A5-0ACE-46FE-DF8B40DAD5BD}" = CCC Help Hungarian
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D215ED58-928A-C704-C104-F3333A429336}" = Catalyst Control Center Core Implementation
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.8 Game
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{EA3A9E2A-6D28-9D91-E65F-0C5978100D3F}" = Catalyst Control Center Graphics Light
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{EE10D76C-39B7-40A8-A24C-1BEEACBED160}" = Catalyst Control Center - Branding
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F19CD3A3-21ED-90AA-E57B-1E54D44EF874}" = CCC Help Portuguese
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F2E23139-3404-4E3C-9855-7724415D62A5}" = Dragon Age II
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FB08F5BF-8B35-CA7F-2C6C-4C7875EFF8C8}" = CCC Help Korean
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FEFB7AF2-FFD6-6ED1-7749-6F998A22A2B7}" = CCC Help Czech
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ashampoo ClipFinder HD_is1" = Ashampoo ClipFinder HD v.2.2.9
"Avira AntiVir Desktop" = Avira Free Antivirus
"Company of Heroes" = Company of Heroes
"Counter-Strike: Source v17" = Counter-Strike: Source v17
"Dead.Island.Game.of.The.Year.Edition_is1" = Dead.Island.Game.of.The.Year.Edition
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.35.1031
"GFWL_{434D0FA0-1558-4D8E-AC3D-BD1000008200}" = DiRT 3
"GOGPACKSTRONGHOLDCRUSADERHD_is1" = Stronghold Crusader Extreme HD
"Identity Card" = Identity Card
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"LogMeIn Hamachi" = LogMeIn Hamachi
"MartView" = MartView
"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"MyFreeCodec" = MyFreeCodec
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OMUI.de-de" = Microsoft Office Language Pack 2007 - German/Deutsch
"OpenAL" = OpenAL
"Opera 12.14.1738" = Opera 12.14
"Pc3ooT-Tv 2.0.1.3" = Pc3ooT-Tv 2.0.1.3
"Pc3ooT-Tv 2.0.1.7" = Pc3ooT-Tv 2.0.1.7
"Pc3ooT-Tv 2.0.1.8" = Pc3ooT-Tv 2.0.1.8
"Pc3ooT-Tv 2.0.2.3" = Pc3ooT-Tv 2.0.2.3
"PhotoScape" = PhotoScape
"Postal 2_is1" = Portal 2
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PS3 Media Server" = PS3 Media Server
"S3" = Die Siedler III Gold Edition
"Sins of a Solar Empire Rebellion (c) Stardock_is1" = Sins of a Solar Empire Rebellion (c) Stardock version 1
"Star Trek Elite Force II" = Star Trek Elite Force II
"Star Trek Online" = Star Trek Online
"Starcraft" = Starcraft
"Tropico3" = Tropico 3 1.00
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"Virtual DJ Pro Full - Atomix Productions" = Virtual DJ Pro Full - Atomix Productions
"VLC media player" = VLC media player 2.0.4
"vShare.tv plugin" = vShare.tv plugin 1.3
"Warcraft III Reign of Chaos & The Frozen Throne" = Warcraft III Reign of Chaos & The Frozen Throne
"WinLiveSuite_Wave3" = Windows Live Essentials
"YDKJG3" = YOU DON'T KNOW JACK® 3 - Abwärts!
"You Don't Know Jack 4" = You Don't Know Jack 4 1.00
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Dropbox" = Dropbox
"MyFreeCodec" = MyFreeCodec
"Tropico 4" = Tropico 4 1.00
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 08.08.2011 14:01:13 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 08.08.2011 14:01:13 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.08.2011 12:08:38 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 09.08.2011 12:09:31 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
 (x86)\windows live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.08.2011 12:09:31 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
 (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
 "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile  8.  Die 
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie
 das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 
Error - 09.08.2011 12:09:44 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.08.2011 12:09:44 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksCal.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.08.2011 12:09:44 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.08.2011 12:09:44 | Computer Name = Maik-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 10.08.2011 18:25:35 | Computer Name = Maik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: sweaw.exe, Version: 1.0.0.0, Zeitstempel:
 0x43f5c608  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x20202020  ID des fehlerhaften Prozesses:
 0xb74  Startzeit der fehlerhaften Anwendung: 0x01cc57a685006602  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Star Wars Empire at War\GameData\sweaw.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: aa620f9a-c39f-11e0-958e-90fba6e08c43
 
[ Media Center Events ]
Error - 04.01.2013 09:33:21 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 14:33:21 - Fehler beim Herstellen der Internetverbindung.  14:33:21 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 04.01.2013 09:33:54 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 14:33:50 - Fehler beim Herstellen der Internetverbindung.  14:33:50 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 04.01.2013 10:34:32 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 15:34:32 - Fehler beim Herstellen der Internetverbindung.  15:34:32 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 04.01.2013 10:35:02 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 15:35:01 - Fehler beim Herstellen der Internetverbindung.  15:35:01 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 06.01.2013 07:01:18 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 12:01:18 - Fehler beim Herstellen der Internetverbindung.  12:01:18 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 06.01.2013 07:01:27 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 12:01:23 - Fehler beim Herstellen der Internetverbindung.  12:01:23 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 06.01.2013 08:01:34 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 13:01:34 - Fehler beim Herstellen der Internetverbindung.  13:01:34 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 06.01.2013 08:01:40 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 13:01:39 - Fehler beim Herstellen der Internetverbindung.  13:01:39 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 08.01.2013 12:00:38 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 17:00:38 - Fehler beim Herstellen der Internetverbindung.  17:00:38 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 08.01.2013 12:01:11 | Computer Name = Maik-PC | Source = MCUpdate | ID = 0
Description = 17:01:08 - Fehler beim Herstellen der Internetverbindung.  17:01:08 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ System Events ]
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Arbeitsstationsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst 
"Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
 wurde:   %%31
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper
 und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper
 und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.03.2013 19:19:12 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   AFD  avipbb  avkmgr  DfsC  discache  mwlPSDFilter  mwlPSDNServ  mwlPSDVDisk  NetBIOS  NetBT  nsiproxy
prodrv06
prohlp02
prosync1
Psched
rdbss
sfhlp01
spldr
sptd
tdx
vwififlt
Wanarpv6
WfpLwf
 
Error - 16.03.2013 19:20:06 | Computer Name = Maik-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 16.03.2013 19:20:06 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         

--- --- ---

Ok, danke.
Melde dich einfach wieder hier, wenn du alle Logs hast, dann geht's weiter.

fix log

:OTL
O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (C:\Users\Maik\AppData\Roaming\skype.dat) - C:\Users\Maik\AppData\Roaming\skype.dat ()
[2013.03.16 23:53:14 | 000,196,608 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.16 23:43:52 | 000,000,004 | ---- | M] () -- C:\Users\Maik\AppData\Roaming\skype.ini
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:93DE1838
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:93EB7685
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:ABE89FFE
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:798A3728
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:0B9176C0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:4D066AD2
         

- bei defrogger kam keine fehlermeldung, brauchste trotzdem das log?

- log gmer
[code]
GMER Logfile:

GMER 2.1.19155 - hxxp://www.gmer.net
Rootkit scan 2013-03-17 01:46:43
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.80.0 931,51GB
Running: prily0ei.exe; Driver: C:\Users\Maik\AppData\Local\Temp\kwldypoc.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\SysWOW64\PnkBstrA.exe[1872] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                             0000000074961a22 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[1872] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                             0000000074961ad0 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[1872] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                             0000000074961b08 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[1872] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                             0000000074961bba 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[1872] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                             0000000074961bda 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                             0000000074961a22 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                             0000000074961ad0 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                             0000000074961b08 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                             0000000074961bba 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                             0000000074961bda 2 bytes [96, 74]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                      00000000752a1465 2 bytes [2A, 75]
.text   C:\Windows\SysWOW64\PnkBstrB.exe[1896] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                     00000000752a14bb 2 bytes [2A, 75]
.text   ...                                                                                                                 * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [2700:2616]                                                                         000007fef2639688

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files (x86)\DAEMON Tools Lite\
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x9F 0xC0 0x04 0x3A ...
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x13 0x00 0xBC 0x4D ...
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0xF4 0xEC 0xEC 0x9B ...
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files (x86)\DAEMON Tools Lite\
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x9F 0xC0 0x04 0x3A ...
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x13 0x00 0xBC 0x4D ...
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0xF4 0xEC 0xEC 0x9B ...

---- EOF - GMER 2.1 ----
         

--- --- ---


- log OTL
OTL Logfile:

OTL logfile created on: 17.03.2013 01:53:21 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Maik\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,93 Gb Total Physical Memory | 2,91 Gb Available Physical Memory | 74,16% Memory free
7,86 Gb Paging File | 6,76 Gb Available in Paging File | 86,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,87 Gb Total Space | 92,54 Gb Free Space | 20,17% Space Free | Partition Type: NTFS
Drive D: | 458,87 Gb Total Space | 75,60 Gb Free Space | 16,47% Space Free | Partition Type: NTFS
 
Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.17 00:05:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maik\Desktop\OTL.exe
PRC - [2013.01.04 23:27:20 | 000,107,832 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe
PRC - [2012.12.29 14:41:39 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.08.08 11:38:15 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 04:03:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 04:03:51 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.09.15 09:42:12 | 000,119,632 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\SysNative\dgdersvc.exe -- (dgdersvc)
SRV:64bit: - [2010.02.25 11:07:54 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2013.03.16 11:13:33 | 000,115,608 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.07 13:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.01.04 23:27:20 | 000,107,832 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.12.29 14:41:39 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.12.10 17:29:46 | 002,465,712 | ---- | M] (LogMeIn Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.09.19 12:10:58 | 002,365,792 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012.08.13 12:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.09 04:03:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 04:03:51 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.03.16 20:34:32 | 000,489,256 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.09.15 09:37:40 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\dgdersvc.exe -- (dgdersvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 22:08:38 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Disabled | Stopped] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.12 11:31:00 | 000,121,416 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV:64bit: - [2012.05.09 04:03:51 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 04:03:51 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.07 18:42:28 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.28 09:45:51 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.04.28 09:45:51 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.03 12:08:42 | 001,918,976 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.09.15 09:42:12 | 000,020,552 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.08.26 11:16:33 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.03.04 14:43:00 | 000,346,144 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.02.25 11:22:38 | 006,369,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.02.25 10:12:10 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.02.24 11:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2010.01.28 02:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.12.09 10:39:52 | 000,537,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.10.30 13:44:40 | 000,460,864 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2u.sys -- (RL_DJIFIE2_USB)
DRV:64bit: - [2009.10.30 13:44:38 | 000,049,728 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2a.sys -- (RL_DJIFIE2_WDM)
DRV:64bit: - [2009.10.30 13:44:38 | 000,036,416 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2m.sys -- (RL_DJIFIE2_MIDI)
DRV:64bit: - [2009.10.20 10:03:16 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2009.09.19 06:30:14 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2009.09.19 06:30:14 | 000,128,000 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bserd.sys -- (ss_bserd)
DRV:64bit: - [2009.09.19 06:30:14 | 000,127,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bbus.sys -- (ss_bbus)
DRV:64bit: - [2009.09.19 06:30:14 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 03:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 03:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 03:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.04.29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2009.04.10 11:58:52 | 000,014,720 | ---- | M] (ROCCAT Development, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ValoFltr.sys -- (ValFltr)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2007.09.12 08:56:50 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2007.08.13 07:01:26 | 000,034,432 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiU04E5.sys -- (SaiU04E5)
DRV - [2012.09.18 16:02:02 | 000,011,880 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.09.15 09:37:40 | 000,018,120 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.04.08 11:06:08 | 000,070,400 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004.04.08 09:46:50 | 000,054,272 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06)
DRV - [2003.12.01 16:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003.09.06 13:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prosync1.sys -- (prosync1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{769FB394-A1BE-4A29-9393-9F7D84C9BA30}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=685749&p={searchTerms}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=685749"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://google.de/"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130129
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.9.2
FF - prefs.js..extensions.enabledAddons: firegestures%40xuldev.org:1.6.20
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.5
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Maik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.16 11:13:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.21 18:46:08 | 000,000,000 | ---D | M]
 
[2010.09.02 18:23:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Extensions
[2013.03.16 13:53:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\firefox@ghostery.com
[2013.03.16 13:53:56 | 000,141,008 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\firegestures@xuldev.org.xpi
[2012.12.11 20:16:07 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.03.12 04:42:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.31 23:32:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.03.16 11:13:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.02.21 18:46:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.23 11:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2011.10.03 10:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2013.03.16 11:13:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.03.16 11:13:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.16 11:13:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.03.16 11:13:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.03.16 11:13:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.03.16 11:13:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E62AE45-5AE7-48BA-9B03-8898A35CD37B}: NameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000 Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\groove.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\hamachi-2-ui.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\infopath.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\misc.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mspub.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\oaa.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\ois.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\outlook.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\Winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\groove.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\hamachi-2-ui.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\infopath.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\misc.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mspub.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\oaa.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\ois.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\outlook.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\Winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 0
O33 - MountPoints2\{29a2e83e-b0ed-11df-ac91-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{29a2e83e-b0ed-11df-ac91-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{29a2e844-b0ed-11df-ac91-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{29a2e844-b0ed-11df-ac91-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7268-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7268-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{32ce726b-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce726b-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7270-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7270-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{32ce7273-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7273-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7280-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7280-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{32ce7284-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7284-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{32ce7287-b13d-11df-927e-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{32ce7287-b13d-11df-927e-90fba6e08c43}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{39961901-bfa5-11e0-9316-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{39961901-bfa5-11e0-9316-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{3996191a-bfa5-11e0-9316-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{3996191a-bfa5-11e0-9316-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{5cd07718-ac14-11e0-90d4-90fba6e08c43}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe
O33 - MountPoints2\{62c42ece-caf3-11df-b1d4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{62c42ece-caf3-11df-b1d4-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a6e1f054-c444-11e0-9271-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a6e1f054-c444-11e0-9271-806e6f6e6963}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a6e1f07a-c444-11e0-9271-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{a6e1f07a-c444-11e0-9271-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{abca770d-caee-11df-b598-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{abca770d-caee-11df-b598-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{abca770f-caee-11df-b598-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{abca770f-caee-11df-b598-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b0f7d295-c5d5-11e0-bcf4-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b0f7d295-c5d5-11e0-bcf4-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b13cb40d-e152-11e0-a082-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b13cb40d-e152-11e0-a082-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{b13cb410-e152-11e0-a082-90fba6e08c43}\Shell - "" = AutoRun
O33 - MountPoints2\{b13cb410-e152-11e0-a082-90fba6e08c43}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{faf4cb51-772e-11dc-8a1a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{faf4cb51-772e-11dc-8a1a-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.17 01:06:50 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Maik\Desktop\OTL.exe
[2013.03.16 20:42:00 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2013.03.15 20:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.03.15 20:40:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.03.14 15:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.03.12 14:55:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2013.03.12 14:41:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\THQ
[2013.03.11 21:38:27 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Company of Heroes
[2013.03.11 20:34:33 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE
[2013.03.11 20:04:10 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\HeiMfgDeLu2013
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.02.21 18:46:41 | 000,000,000 | ---D | C] -- C:\My E-Books
[2013.02.21 18:46:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Martview
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MartView
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MartView
[2013.02.21 18:46:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.02.21 18:46:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.02.21 18:46:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.02.21 18:38:37 | 030,628,240 | ---- | C] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[2013.02.19 15:12:21 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Bewerbung
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.17 01:51:21 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.17 01:51:06 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.17 01:50:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.17 01:45:12 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.17 01:15:26 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.17 01:15:26 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.17 01:13:46 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.17 01:13:46 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.17 01:13:46 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.17 01:13:46 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.17 01:13:46 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.17 01:07:13 | 000,000,020 | ---- | M] () -- C:\Users\Maik\defogger_reenable
[2013.03.17 01:03:40 | 000,377,856 | ---- | M] () -- C:\Users\Maik\Desktop\prily0ei.exe
[2013.03.17 01:02:36 | 000,050,477 | ---- | M] () -- C:\Users\Maik\Desktop\Defogger.exe
[2013.03.17 00:05:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maik\Desktop\OTL.exe
[2013.03.16 20:40:51 | 007,487,854 | ---- | M] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:32 | 007,635,474 | ---- | M] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:05 | 004,273,684 | ---- | M] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:44 | 004,269,916 | ---- | M] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | M] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.11 22:03:28 | 011,130,317 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:47 | 007,729,559 | ---- | M] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | M] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | M] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | M] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | M] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:52 | 008,165,818 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | M] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:27:38 | 142,195,184 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:25:13 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:21:29 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:03:51 | 112,550,331 | ---- | M] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:30:42 | 007,083,135 | ---- | M] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:29:57 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.02.21 18:46:30 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:44:56 | 072,188,980 | ---- | M] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.02.21 18:39:01 | 030,628,240 | ---- | M] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.17 01:07:12 | 000,000,020 | ---- | C] () -- C:\Users\Maik\defogger_reenable
[2013.03.17 01:06:53 | 000,050,477 | ---- | C] () -- C:\Users\Maik\Desktop\Defogger.exe
[2013.03.17 01:06:52 | 000,377,856 | ---- | C] () -- C:\Users\Maik\Desktop\prily0ei.exe
[2013.03.17 01:05:17 | 000,065,536 | ---- | C] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.16 20:40:22 | 007,487,854 | ---- | C] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:29 | 007,635,474 | ---- | C] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:02 | 004,273,684 | ---- | C] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:41 | 004,269,916 | ---- | C] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | C] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.15 20:40:27 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.15 20:40:26 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.11 22:03:24 | 011,130,317 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:42 | 007,729,559 | ---- | C] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | C] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | C] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | C] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | C] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:48 | 008,165,818 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | C] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:25:19 | 142,195,184 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:22:14 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:17:08 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:02:48 | 112,550,331 | ---- | C] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:22:21 | 007,083,135 | ---- | C] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:02:48 | 012,627,694 | ---- | C] () -- C:\Users\Maik\Desktop\Avengers #1.cbr
[2013.02.21 19:02:47 | 012,654,114 | ---- | C] () -- C:\Users\Maik\Desktop\New Avengers #1.cbr
[2013.02.21 18:46:30 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:27:59 | 072,188,980 | ---- | C] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.01.05 00:13:39 | 000,000,275 | ---- | C] () -- C:\Windows\game.ini
[2012.12.29 14:41:55 | 000,107,832 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.12.29 14:41:39 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.06.21 20:42:51 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.04.22 17:02:39 | 000,002,286 | ---- | C] () -- C:\Users\Maik\.swfinfo
[2012.04.13 16:39:19 | 000,000,367 | ---- | C] () -- C:\Users\Maik\Heimnetzgruppe - Verknüpfung.lnk
[2011.08.22 14:46:44 | 000,012,885 | ---- | C] () -- C:\Windows\scunin.dat
[2011.08.14 02:36:27 | 000,064,452 | ---- | C] () -- C:\Users\Maik\DefaultProfile3.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile2.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile.xml
[2011.07.11 23:39:00 | 000,000,734 | ---- | C] () -- C:\Windows\EF2.INI
[2011.06.12 12:27:26 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\FXStudioDLL.dll
[2011.06.12 12:27:25 | 000,360,448 | ---- | C] () -- C:\Windows\SysWow64\pxd32d5.dll
[2011.06.12 12:27:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\fxstudio.dll
[2011.06.12 12:27:25 | 000,235,532 | ---- | C] () -- C:\Windows\SysWow64\loadimage.dll
[2011.06.12 12:27:25 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\lttls13n.dll
[2011.06.12 12:27:25 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\RapBoxDSP.dll
[2011.06.12 12:27:25 | 000,126,976 | ---- | C] () -- C:\Windows\SysWow64\NewWaveAnzeige.dll
[2011.06.12 12:27:25 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\eJ_Tool.dll
[2011.06.12 12:27:25 | 000,075,976 | ---- | C] () -- C:\Windows\SysWow64\Bassdec.dll
[2011.06.12 12:27:25 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\fader.dll
[2011.06.12 12:27:25 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\WndRgn.dll
[2011.06.12 12:27:25 | 000,029,696 | ---- | C] () -- C:\Windows\SysWow64\pthread.dll
[2011.06.12 12:27:24 | 000,796,672 | ---- | C] () -- C:\Windows\SysWow64\LTRTN13n.DLL
[2011.06.12 12:27:24 | 000,708,608 | ---- | C] () -- C:\Windows\SysWow64\ltcry13n.dll
[2011.06.12 12:27:23 | 000,338,944 | ---- | C] () -- C:\Windows\SysWow64\lffpx7.dll
[2011.06.12 12:27:23 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\lfkodak.dll
[2011.06.12 12:27:23 | 000,031,744 | ---- | C] () -- C:\Windows\SysWow64\lfvec13n.dll
[2011.05.28 16:03:17 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2011.05.26 15:14:06 | 000,000,340 | ---- | C] () -- C:\Windows\BeatBox.INI
[2011.05.26 15:09:08 | 000,000,271 | ---- | C] () -- C:\Windows\musicmaker.INI
[2011.05.26 15:06:58 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.28 10:39:00 | 000,000,000 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\wklnhst.dat
[2010.08.28 01:18:14 | 000,007,606 | ---- | C] () -- C:\Users\Maik\AppData\Local\Resmon.ResmonCfg
[2010.03.20 00:05:19 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.13 15:00:34 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Ashampoo
[2012.11.19 15:24:02 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Audacity
[2011.07.02 18:37:01 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.08.29 23:50:21 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\DAEMON Tools Lite
[2012.09.13 18:15:52 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Dropbox
[2012.11.05 15:27:16 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\DVDVideoSoft
[2012.11.05 15:27:12 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.26 15:47:47 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\eSobi
[2012.05.02 20:12:48 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ICAClient
[2012.02.09 01:01:37 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ICQ
[2011.08.06 17:06:56 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\IObit
[2010.10.05 11:25:19 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\IrfanView
[2012.12.29 12:03:31 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Kalypso Media
[2012.11.11 16:58:59 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\LolClient
[2012.08.09 09:35:40 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\MotioninJoy
[2010.08.25 21:48:06 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\OEM
[2010.08.26 10:26:13 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Opera
[2010.10.06 20:38:24 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\PC Suite
[2012.02.24 15:11:25 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\pdfforge
[2011.08.10 19:49:23 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Petroglyph
[2012.04.13 23:24:24 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\PhotoScape
[2011.08.02 01:31:07 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ProtectDISC
[2010.10.06 20:32:36 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Samsung
[2011.10.26 21:17:40 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Sierra Entertainment
[2011.09.26 21:18:17 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Tropico 3
[2012.02.01 23:49:37 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Tropico 4
[2012.09.07 20:46:19 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\TS3Client
[2012.09.06 00:34:44 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ts3overlay
[2012.10.07 17:16:05 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\TuneUp Software
[2011.12.01 22:36:55 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Ubisoft
[2012.11.06 18:04:40 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\UltraMixer
[2010.09.03 12:09:56 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Uniblue
[2011.07.03 17:15:18 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Unity
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2012.05.11 01:03:25 | 000,001,836 | ---- | M] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk
[2012.05.11 01:03:25 | 000,001,836 | ---- | C] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk

< End of report >
         

--- --- ---

Defogger-Log brauche ich nicht, nein.

Weiter:


Schritt 1

Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.

• Schliesse alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Löschen.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Schritt 2

Warnung für Mitleser:
Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix.

• WICHTIG: Speichere Combofix auf deinen Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft, bitte gar nichts am Computer arbeiten, auch nicht die Maus bewegen!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen (C:\Combofix.txt).
• Bitte poste den Inhalt dieses Logfiles in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.



Schritt 3

Starte bitte die OTL.exe.

• Setze den Haken bei Scan all Users.
• Drücke auf den Quick Scan Button.
• Poste den Inhalt von OTL.txt hier in den Thread.

Bitte poste in deiner nächsten Antwort:

• Log von AdwCleaner
• Log von Combofix
• Log von OTL

- adw log

AdwCleaner Logfile:

# AdwCleaner v2.114 - Datei am 17/03/2013 um 03:56:44 erstellt
# 
Aktualisiert am 05/03/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Maik - MAIK-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Maik\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll
Ordner Gelöscht : C:\Program Files (x86)\vShare.tv plugin
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Users\Maik\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Maik\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MyNewsBarLauncher.IE5BarLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MyNewsBarLauncher.IE5BarLauncher.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MyNewsBarLauncher.IE5BarLauncherBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MyNewsBarLauncher.IE5BarLauncherBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16470

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v19.0.2 (de)

Datei : C:\Users\Maik\AppData\Roaming\Mozilla\Firefox\Profiles\bn1mhg0b.default\prefs.js

C:\Users\Maik\AppData\Roaming\Mozilla\Firefox\Profiles\bn1mhg0b.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Maik\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

-\\ Opera v12.14.1738.0

Datei : C:\Users\Maik\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [5172 octets] - [17/03/2013 03:56:44]

########## EOF - C:\AdwCleaner[S1].txt - [5232 octets] ##########
         

--- --- ---


- combofix log ist leider weg. der hat mir gesagt, die datei konnte nicht gefunden werden unter Maik/Appdata ect. und ob ich eine neue datei erstellen möchtem hab leider direkt ja gedrückt, positive schaltflächen machen mich fertig...

der hat aber ne weile nach dem neustart gearbeitet um das log zu erstellen

- otl log
OTL Logfile:

OTL logfile created on: 17.03.2013 04:37:54 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Maik\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,93 Gb Total Physical Memory | 2,78 Gb Available Physical Memory | 70,68% Memory free
7,86 Gb Paging File | 6,66 Gb Available in Paging File | 84,83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,87 Gb Total Space | 90,43 Gb Free Space | 19,71% Space Free | Partition Type: NTFS
Drive D: | 458,87 Gb Total Space | 75,60 Gb Free Space | 16,47% Space Free | Partition Type: NTFS
Drive F: | 7,44 Gb Total Space | 7,43 Gb Free Space | 99,91% Space Free | Partition Type: FAT32
 
Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.17 00:05:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maik\Desktop\OTL.exe
PRC - [2013.01.04 23:27:20 | 000,107,832 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe
PRC - [2012.12.29 14:41:39 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.08.08 11:38:15 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 04:03:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 04:03:51 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.09.15 09:42:12 | 000,119,632 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\SysNative\dgdersvc.exe -- (dgdersvc)
SRV:64bit: - [2010.02.25 11:07:54 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2013.03.16 11:13:33 | 000,115,608 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.07 13:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.01.04 23:27:20 | 000,107,832 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.12.29 14:41:39 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.12.10 17:29:46 | 002,465,712 | ---- | M] (LogMeIn Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.09.19 12:10:58 | 002,365,792 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012.08.13 12:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.09 04:03:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 04:03:51 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.03.16 20:34:32 | 000,489,256 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.09.15 09:37:40 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\dgdersvc.exe -- (dgdersvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 22:08:38 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Disabled | Stopped] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.12 11:31:00 | 000,121,416 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV:64bit: - [2012.05.09 04:03:51 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 04:03:51 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.07 18:42:28 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.28 09:45:51 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.04.28 09:45:51 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.03 12:08:42 | 001,918,976 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.09.15 09:42:12 | 000,020,552 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.08.26 11:16:33 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.03.04 14:43:00 | 000,346,144 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.02.25 11:22:38 | 006,369,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.02.25 10:12:10 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.02.24 11:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2010.01.28 02:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.12.09 10:39:52 | 000,537,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.10.30 13:44:40 | 000,460,864 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2u.sys -- (RL_DJIFIE2_USB)
DRV:64bit: - [2009.10.30 13:44:38 | 000,049,728 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2a.sys -- (RL_DJIFIE2_WDM)
DRV:64bit: - [2009.10.30 13:44:38 | 000,036,416 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rldjif2m.sys -- (RL_DJIFIE2_MIDI)
DRV:64bit: - [2009.10.20 10:03:16 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2009.09.19 06:30:14 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2009.09.19 06:30:14 | 000,128,000 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bserd.sys -- (ss_bserd)
DRV:64bit: - [2009.09.19 06:30:14 | 000,127,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bbus.sys -- (ss_bbus)
DRV:64bit: - [2009.09.19 06:30:14 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 03:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 03:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 03:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.04.29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2009.04.10 11:58:52 | 000,014,720 | ---- | M] (ROCCAT Development, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ValoFltr.sys -- (ValFltr)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2007.09.12 08:56:50 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2007.08.13 07:01:26 | 000,034,432 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiU04E5.sys -- (SaiU04E5)
DRV - [2012.09.18 16:02:02 | 000,011,880 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.09.15 09:37:40 | 000,018,120 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010.09.15 09:33:32 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.04.08 11:06:08 | 000,070,400 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004.04.08 09:46:50 | 000,054,272 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06)
DRV - [2003.12.01 16:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003.09.06 13:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prosync1.sys -- (prosync1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173608102207pe458v155w4641v858
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\..\SearchScopes\{769FB394-A1BE-4A29-9393-9F7D84C9BA30}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=685749&p={searchTerms}
IE - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=685749"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://google.de/"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130129
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.9.2
FF - prefs.js..extensions.enabledAddons: firegestures%40xuldev.org:1.6.20
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.5
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=685749&p="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Maik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.16 11:13:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.03.17 03:56:49 | 000,000,000 | ---D | M]
 
[2010.09.02 18:23:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Extensions
[2013.03.16 13:53:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.03.15 19:28:16 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\bn1mhg0b.default\extensions\firefox@ghostery.com
[2013.03.16 13:53:56 | 000,141,008 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\firegestures@xuldev.org.xpi
[2012.12.11 20:16:07 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\firefox\profiles\bn1mhg0b.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.03.12 04:42:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.31 23:32:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.03.16 11:13:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.02.21 18:46:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.23 11:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2013.03.16 11:13:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.03.16 11:13:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.16 11:13:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.03.16 11:13:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.03.16 11:13:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.03.16 11:13:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2013.03.17 04:22:43 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3515296584-3130688908-3157385626-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Maik\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E62AE45-5AE7-48BA-9B03-8898A35CD37B}: NameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.17 04:31:05 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.03.17 04:24:30 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.03.17 04:02:03 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.03.17 04:02:03 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.03.17 04:02:03 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.03.17 04:01:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.17 04:01:31 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.03.17 03:56:08 | 005,040,250 | R--- | C] (Swearware) -- C:\Users\Maik\Desktop\ComboFix.exe
[2013.03.17 01:06:50 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Maik\Desktop\OTL.exe
[2013.03.16 20:42:00 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2013.03.15 20:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.03.15 20:40:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.03.14 15:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.03.14 15:00:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.03.12 14:55:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2013.03.12 14:41:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\THQ
[2013.03.11 21:38:27 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Company of Heroes
[2013.03.11 20:34:33 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE
[2013.03.11 20:04:10 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\HeiMfgDeLu2013
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.21 19:29:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.02.21 18:46:41 | 000,000,000 | ---D | C] -- C:\My E-Books
[2013.02.21 18:46:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Martview
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MartView
[2013.02.21 18:46:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MartView
[2013.02.21 18:46:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.02.21 18:46:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.02.21 18:46:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.02.21 18:38:37 | 030,628,240 | ---- | C] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[2013.02.19 15:12:21 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Bewerbung
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.17 04:34:46 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.17 04:34:31 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.17 04:34:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.17 04:33:53 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.17 04:33:53 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.17 04:22:43 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.03.17 03:56:59 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.17 03:56:59 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.17 03:56:59 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.17 03:56:59 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.17 03:56:59 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.17 03:54:20 | 005,040,250 | R--- | M] (Swearware) -- C:\Users\Maik\Desktop\ComboFix.exe
[2013.03.17 03:53:30 | 000,597,667 | ---- | M] () -- C:\Users\Maik\Desktop\adwcleaner.exe
[2013.03.17 03:45:10 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.17 01:07:13 | 000,000,020 | ---- | M] () -- C:\Users\Maik\defogger_reenable
[2013.03.17 01:03:40 | 000,377,856 | ---- | M] () -- C:\Users\Maik\Desktop\prily0ei.exe
[2013.03.17 01:02:36 | 000,050,477 | ---- | M] () -- C:\Users\Maik\Desktop\Defogger.exe
[2013.03.17 00:05:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maik\Desktop\OTL.exe
[2013.03.16 20:40:51 | 007,487,854 | ---- | M] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:32 | 007,635,474 | ---- | M] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:05 | 004,273,684 | ---- | M] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:44 | 004,269,916 | ---- | M] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | M] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.11 22:03:28 | 011,130,317 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:47 | 007,729,559 | ---- | M] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | M] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | M] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | M] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | M] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:52 | 008,165,818 | ---- | M] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | M] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:27:38 | 142,195,184 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:25:13 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:21:29 | 150,000,000 | ---- | M] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:03:51 | 112,550,331 | ---- | M] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:30:42 | 007,083,135 | ---- | M] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:29:57 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.02.21 18:46:30 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:44:56 | 072,188,980 | ---- | M] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.02.21 18:39:01 | 030,628,240 | ---- | M] (MartView) -- C:\Users\Maik\Desktop\martview252_setup_raw.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Maik\Desktop\*.tmp files -> C:\Users\Maik\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.17 04:02:03 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.03.17 04:02:03 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.03.17 04:02:03 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.03.17 04:02:03 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.03.17 04:02:03 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.03.17 03:56:06 | 000,597,667 | ---- | C] () -- C:\Users\Maik\Desktop\adwcleaner.exe
[2013.03.17 01:07:12 | 000,000,020 | ---- | C] () -- C:\Users\Maik\defogger_reenable
[2013.03.17 01:06:53 | 000,050,477 | ---- | C] () -- C:\Users\Maik\Desktop\Defogger.exe
[2013.03.17 01:06:52 | 000,377,856 | ---- | C] () -- C:\Users\Maik\Desktop\prily0ei.exe
[2013.03.17 01:05:17 | 000,065,536 | ---- | C] () -- C:\Windows\SysNative\Ikeext.etl
[2013.03.16 20:40:22 | 007,487,854 | ---- | C] () -- C:\Users\Maik\Desktop\olly_murs_feat_flo_rida_-_troublemaker.mp3
[2013.03.16 20:39:29 | 007,635,474 | ---- | C] () -- C:\Users\Maik\Desktop\passenger_-_let_her_go.mp3
[2013.03.16 20:39:02 | 004,273,684 | ---- | C] () -- C:\Users\Maik\Desktop\arash_feat_sean_paul_-_she_makes_me_go.mp3
[2013.03.16 20:35:41 | 004,269,916 | ---- | C] () -- C:\Users\Maik\Desktop\wiz_khalifa_-_no_sleep_%28produced_by_benny_blanco%29.mp3
[2013.03.16 20:34:27 | 005,342,006 | ---- | C] () -- C:\Users\Maik\Desktop\baauer_-_harlem_shake.mp3
[2013.03.15 20:40:27 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.15 20:40:26 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.11 22:03:24 | 011,130,317 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_vs_mad_mark_-_sky_is_the_limit.mp3
[2013.03.11 21:58:42 | 007,729,559 | ---- | C] () -- C:\Users\Maik\Desktop\avicii_vs_nicky_romero_-_i_could_be_the_one_%28radio_edit%29.mp3
[2013.03.11 21:58:01 | 004,260,482 | ---- | C] () -- C:\Users\Maik\Desktop\macklemore_feat_ray_dalton_-_cant_hold_us.mp3
[2013.03.11 21:57:34 | 006,881,412 | ---- | C] () -- C:\Users\Maik\Desktop\calvin_harris_feat_florence_welch_-_sweet_nothing_%28album_version%29.mp3
[2013.03.11 21:55:13 | 005,538,747 | ---- | C] () -- C:\Users\Maik\Desktop\bingo_players_feat_far_east_movement_-_get_up_%28rattle%29.mp3
[2013.03.11 21:48:40 | 008,437,415 | ---- | C] () -- C:\Users\Maik\Desktop\justin_timberlake_feat_jay_z_-_suit_and_tie_%28radio_edit%29.mp3
[2013.03.11 21:47:48 | 008,165,818 | ---- | C] () -- C:\Users\Maik\Desktop\dj_antoine_-_bella_vita.mp3
[2013.03.11 21:46:37 | 008,810,953 | ---- | C] () -- C:\Users\Maik\Desktop\taylor_swift_-_i_knew_you_were_trouble.mp3
[2013.03.11 20:25:19 | 142,195,184 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r01
[2013.03.11 20:22:14 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.r00
[2013.03.11 20:17:08 | 150,000,000 | ---- | C] () -- C:\Users\Maik\Desktop\VA-Dream_Dance_Vol.66-3CD-2013-VOiCE.rar
[2013.03.11 20:02:48 | 112,550,331 | ---- | C] () -- C:\Users\Maik\Desktop\HeiMfgDeLu2013.rar
[2013.03.11 19:22:21 | 007,083,135 | ---- | C] () -- C:\Users\Maik\Desktop\pitbull_feat_christina_aguilera_-_feel_this_moment_%28exclu%29.mp3
[2013.02.21 19:02:48 | 012,627,694 | ---- | C] () -- C:\Users\Maik\Desktop\Avengers #1.cbr
[2013.02.21 19:02:47 | 012,654,114 | ---- | C] () -- C:\Users\Maik\Desktop\New Avengers #1.cbr
[2013.02.21 18:46:30 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\MartView.lnk
[2013.02.21 18:27:59 | 072,188,980 | ---- | C] () -- C:\Users\Maik\Desktop\DC Comics presents 87(Panini)(c2c)(7S).cbz
[2013.01.05 00:13:39 | 000,000,275 | ---- | C] () -- C:\Windows\game.ini
[2012.12.29 14:41:55 | 000,107,832 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.12.29 14:41:39 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.06.21 20:42:51 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.04.22 17:02:39 | 000,002,286 | ---- | C] () -- C:\Users\Maik\.swfinfo
[2012.04.13 16:39:19 | 000,000,367 | ---- | C] () -- C:\Users\Maik\Heimnetzgruppe - Verknüpfung.lnk
[2011.08.22 14:46:44 | 000,012,885 | ---- | C] () -- C:\Windows\scunin.dat
[2011.08.14 02:36:27 | 000,064,452 | ---- | C] () -- C:\Users\Maik\DefaultProfile3.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile2.xml
[2011.08.14 02:36:27 | 000,050,182 | ---- | C] () -- C:\Users\Maik\DefaultProfile.xml
[2011.07.11 23:39:00 | 000,000,734 | ---- | C] () -- C:\Windows\EF2.INI
[2011.06.12 12:27:26 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\FXStudioDLL.dll
[2011.06.12 12:27:25 | 000,360,448 | ---- | C] () -- C:\Windows\SysWow64\pxd32d5.dll
[2011.06.12 12:27:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\fxstudio.dll
[2011.06.12 12:27:25 | 000,235,532 | ---- | C] () -- C:\Windows\SysWow64\loadimage.dll
[2011.06.12 12:27:25 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\lttls13n.dll
[2011.06.12 12:27:25 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\RapBoxDSP.dll
[2011.06.12 12:27:25 | 000,126,976 | ---- | C] () -- C:\Windows\SysWow64\NewWaveAnzeige.dll
[2011.06.12 12:27:25 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\eJ_Tool.dll
[2011.06.12 12:27:25 | 000,075,976 | ---- | C] () -- C:\Windows\SysWow64\Bassdec.dll
[2011.06.12 12:27:25 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\fader.dll
[2011.06.12 12:27:25 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\WndRgn.dll
[2011.06.12 12:27:25 | 000,029,696 | ---- | C] () -- C:\Windows\SysWow64\pthread.dll
[2011.06.12 12:27:24 | 000,796,672 | ---- | C] () -- C:\Windows\SysWow64\LTRTN13n.DLL
[2011.06.12 12:27:24 | 000,708,608 | ---- | C] () -- C:\Windows\SysWow64\ltcry13n.dll
[2011.06.12 12:27:23 | 000,338,944 | ---- | C] () -- C:\Windows\SysWow64\lffpx7.dll
[2011.06.12 12:27:23 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\lfkodak.dll
[2011.06.12 12:27:23 | 000,031,744 | ---- | C] () -- C:\Windows\SysWow64\lfvec13n.dll
[2011.05.28 16:03:17 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2011.05.26 15:14:06 | 000,000,340 | ---- | C] () -- C:\Windows\BeatBox.INI
[2011.05.26 15:09:08 | 000,000,271 | ---- | C] () -- C:\Windows\musicmaker.INI
[2011.05.26 15:06:58 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.28 10:39:00 | 000,000,000 | ---- | C] () -- C:\Users\Maik\AppData\Roaming\wklnhst.dat
[2010.08.28 01:18:14 | 000,007,606 | ---- | C] () -- C:\Users\Maik\AppData\Local\Resmon.ResmonCfg
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.13 15:00:34 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Ashampoo
[2012.11.19 15:24:02 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Audacity
[2011.07.02 18:37:01 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.08.29 23:50:21 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\DAEMON Tools Lite
[2012.09.13 18:15:52 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Dropbox
[2012.11.05 15:27:16 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\DVDVideoSoft
[2010.08.26 15:47:47 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\eSobi
[2012.05.02 20:12:48 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ICAClient
[2012.02.09 01:01:37 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ICQ
[2011.08.06 17:06:56 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\IObit
[2010.10.05 11:25:19 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\IrfanView
[2012.12.29 12:03:31 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Kalypso Media
[2012.11.11 16:58:59 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\LolClient
[2012.08.09 09:35:40 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\MotioninJoy
[2010.08.25 21:48:06 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\OEM
[2010.08.26 10:26:13 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Opera
[2010.10.06 20:38:24 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\PC Suite
[2011.08.10 19:49:23 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Petroglyph
[2012.04.13 23:24:24 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\PhotoScape
[2011.08.02 01:31:07 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ProtectDISC
[2010.10.06 20:32:36 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Samsung
[2011.10.26 21:17:40 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Sierra Entertainment
[2011.09.26 21:18:17 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Tropico 3
[2012.02.01 23:49:37 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Tropico 4
[2012.09.07 20:46:19 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\TS3Client
[2012.09.06 00:34:44 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\ts3overlay
[2012.10.07 17:16:05 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\TuneUp Software
[2011.12.01 22:36:55 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Ubisoft
[2012.11.06 18:04:40 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\UltraMixer
[2010.09.03 12:09:56 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Uniblue
[2011.07.03 17:15:18 | 000,000,000 | ---D | M] -- C:\Users\Maik\AppData\Roaming\Unity
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2012.05.11 01:03:25 | 000,001,836 | ---- | M] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk
[2012.05.11 01:03:25 | 000,001,836 | ---- | C] ()(C:\Windows\SysNative\??????????????????????????????°????????‰??????????°????????u??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-Pop 90.lnk) -- C:\Windows\SysNative\㩃啜敳獲䵜楡屫敄歳潴屰敎敵⁳敖穲楥档楮屳䅖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥㔭䑃㈭〰尷〴‰慖ⴠ丠湯汰獵汵牴ⵡ潐⁰〹牥䌭㑤㈭〰⸷㍭u済ɚ洸ɚ汨ɚ殘ɚ櫈ɚ槸ɚ椨ɚ桘ɚ旨ɚ枈ɚ暸ɚ摈ɚ攘ɚ捸ɚ抨ɚ愈ɚ懘ɚ怸ɚ彨ɚ庘ɚ巈ɚ峸ɚ尨ɚ存ɚ媈ɚ妸ɚ壨ɚ堘ɚ坈ɚ噸ɚ嫋屰蠀嚿桔囑桔哌桔哟桔哲桔哺桔唂桔唊桔唒桔嫕桔唽桔啅桔啍桔啕桔啝桔啥桔啭桔喀桔喓桔嫹桔喦桔單桔嗁桔嗔桔嗧桔嗺桔嘍桔嘕桔嘝桔囤桔嘱桔嘹桔噁桔噺桔嚓桔-Pop 90.lnk

< End of report >
         

--- --- ---

combofix log ist leider weg.

Als du findest kein Log als C:\Combofix.txt?
Findest du auch kein Textfile im Ordner C:\Qoobox, welches den Combofix-Lauf dokumentiert?

war unter C: zu finden, hier nun im anhang...

Die Logfiles bitte nicht anhängen, sondern deren Inhalt direkt innerhalb von Codetags einfügen: [code]Inhalt Logfile[/code].
Wenn es zu gross dafür ist, dann bitte in ein zip-Archiv packen und anhängen (und nicht in ein rar-File).