| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner (Version 2.12)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
08.05.2013, 14:39
| #1 |
| |  GVU Trojaner (Version 2.12) Hallo Ich habe mir mehrere Topics angesehen dazu, aber bei den meisten ging die Problemlösung (aus meiner Sicht) nur für den speziellen Fall, deswegen ein neues Topic. Laut www.bka-trojaner.de habe ich Version 2.12. Ich habe bereits einen Scan mit OTL gemacht, die Dateien hänge ich hier per Code an: OTL.txt Code:
ATTFilter OTL logfile created on: 08.05.2013 15:28:30 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 3,75 Gb Available Physical Memory | 62,63% Memory free 11,98 Gb Paging File | 9,71 Gb Available in Paging File | 81,07% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 69,90 Gb Total Space | 15,29 Gb Free Space | 21,88% Space Free | Partition Type: NTFS Drive E: | 18,91 Gb Total Space | 3,89 Gb Free Space | 20,59% Space Free | Partition Type: NTFS Drive J: | 48,83 Gb Total Space | 1,41 Gb Free Space | 2,89% Space Free | Partition Type: NTFS Drive K: | 29,30 Gb Total Space | 1,98 Gb Free Space | 6,77% Space Free | Partition Type: NTFS Drive L: | 78,13 Gb Total Space | 57,50 Gb Free Space | 73,60% Space Free | Partition Type: NTFS Drive M: | 58,59 Gb Total Space | 4,88 Gb Free Space | 8,33% Space Free | Partition Type: NTFS Drive V: | 140,00 Gb Total Space | 21,16 Gb Free Space | 15,11% Space Free | Partition Type: NTFS Drive W: | 400,00 Gb Total Space | 257,15 Gb Free Space | 64,29% Space Free | Partition Type: NTFS Drive X: | 80,00 Gb Total Space | 79,90 Gb Free Space | 99,87% Space Free | Partition Type: NTFS Drive Y: | 80,00 Gb Total Space | 79,26 Gb Free Space | 99,08% Space Free | Partition Type: NTFS Drive Z: | 80,00 Gb Total Space | 21,29 Gb Free Space | 26,62% Space Free | Partition Type: NTFS Computer Name: KARL | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.08 15:09:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe PRC - [2013.04.10 10:53:52 | 000,879,456 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\opera.exe PRC - [2012.08.10 11:03:19 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.08 21:26:00 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.08 21:26:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.06.23 08:01:26 | 000,670,792 | ---- | M] (Juniper Networks) -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe PRC - [2010.08.03 10:43:02 | 000,522,824 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe PRC - [2010.06.03 01:26:20 | 000,132,464 | ---- | M] (Juniper Networks) -- C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe PRC - [2010.04.30 08:11:40 | 001,159,504 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\LU\LogitechUpdate.exe PRC - [2010.04.30 08:11:30 | 000,341,328 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\LU\LULnchr.exe PRC - [2010.03.03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.03.03 20:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe ========== Modules (No Company Name) ========== MOD - [2013.02.16 19:42:18 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll MOD - [2013.01.11 15:29:19 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\f7cb3ae5de64f8cbde3ccc57c780743a\IAStorUtil.ni.dll MOD - [2013.01.11 15:16:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll MOD - [2013.01.11 15:15:41 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll MOD - [2013.01.11 15:15:31 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll MOD - [2013.01.11 15:15:26 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll MOD - [2013.01.11 15:15:23 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013.01.11 15:15:23 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll MOD - [2013.01.11 15:15:14 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2012.07.28 12:08:18 | 009,465,032 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.07.14 19:58:10 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ========== Services (SafeList) ========== SRV:64bit: - [2010.07.07 03:50:54 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2010.05.06 11:30:22 | 000,357,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe -- (LBTServ) SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2013.03.29 21:53:56 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.08 21:26:00 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.08 21:26:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.06.23 08:01:26 | 000,670,792 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService) SRV - [2010.06.03 01:26:20 | 000,132,464 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe -- (JuniperAccessService) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.09.20 11:55:20 | 001,037,824 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012.05.08 21:26:00 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.08 21:26:00 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.12.15 16:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:34:02 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2010.11.20 15:34:02 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:35:32 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2010.11.20 13:35:20 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.08.03 08:43:18 | 000,032,768 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dsNcAdpt.sys -- (dsNcAdpt) DRV:64bit: - [2010.07.07 04:30:08 | 007,195,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2010.07.07 03:15:42 | 000,265,728 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.05.06 11:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2010.03.18 11:00:16 | 000,057,936 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2010.03.18 11:00:00 | 000,063,568 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2010.03.03 19:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.11.23 17:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.23 17:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice) DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.06.10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1126409137-1125755226-496644887-500\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1126409137-1125755226-496644887-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.10.15 19:33:43 | 000,000,000 | ---D | M] O1 HOSTS File: ([2011.10.30 23:50:16 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Matthias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sticky Notes.lnk = File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-1126409137-1125755226-496644887-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://d1ylr6sba64qi3.cloudfront.net/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class) O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://juniper.net/dana-cached/setup/JuniperSetupSP1.cab (JuniperSetupControlXP Class) O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{13703D0A-34C8-41C5-AABE-CEF21ED5A883}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.10.01 00:13:30 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.05.08 15:09:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2013.05.08 13:47:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Opera [2013.05.08 13:47:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Opera [2013.05.08 13:34:39 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Avira [2013.05.08 13:29:35 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Intel Corporation [2013.05.08 13:29:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\ATI [2013.05.08 13:29:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ATI [2013.05.08 13:29:22 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Logitech [2013.05.08 13:29:14 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Apple Computer [2013.05.08 13:29:14 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Adobe [2013.05.08 13:29:12 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Logitech [2013.05.08 13:29:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Adobe [2013.05.08 13:28:50 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Virtual Machines [2013.05.08 13:28:50 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.05.08 13:28:50 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Searches [2013.05.08 13:28:50 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.05.08 13:28:38 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Identities [2013.05.08 13:28:33 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Contacts [2013.05.08 13:28:20 | 000,000,000 | --SD | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Videos [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Saved Games [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Pictures [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Music [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Links [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Favorites [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Downloads [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Documents [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Desktop [2013.05.08 13:28:20 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Vorlagen [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Verlauf [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Temporary Internet Files [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Startmenü [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\SendTo [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Recent [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Netzwerkumgebung [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Lokale Einstellungen [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Videos [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Musik [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Eigene Dateien [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Bilder [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Druckumgebung [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Cookies [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Anwendungsdaten [2013.05.08 13:28:20 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Anwendungsdaten [2013.05.08 13:28:20 | 000,000,000 | -H-D | C] -- C:\Users\Administrator\AppData [2013.05.08 13:28:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Temp [2013.05.08 13:28:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Microsoft [2013.05.08 13:28:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Macromedia [2013.05.08 13:28:20 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Juniper Networks [2013.04.25 17:58:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader [2013.04.10 10:56:54 | 003,717,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll [2013.04.10 10:56:53 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll [2013.04.10 10:56:53 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll [2013.04.10 10:56:53 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll [2013.04.10 10:56:53 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll [2013.04.10 10:56:53 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll [2013.04.10 10:56:47 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013.04.10 10:56:46 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013.04.10 10:56:46 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013.04.10 10:56:46 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe [2013.04.10 10:56:46 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2013.04.10 10:56:46 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll ========== Files - Modified Within 30 Days ========== [2013.05.08 15:09:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2013.05.08 14:56:06 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.05.08 14:56:06 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.05.08 14:53:02 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.05.08 14:53:02 | 000,656,044 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.05.08 14:53:02 | 000,616,590 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.05.08 14:53:02 | 000,130,676 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.05.08 14:53:02 | 000,106,970 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.05.08 14:48:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.05.08 14:48:37 | 529,092,607 | -HS- | M] () -- C:\hiberfil.sys [2013.05.08 14:41:24 | 000,628,743 | ---- | M] () -- C:\Users\Administrator\Desktop\adwcleaner.exe [2013.04.10 19:27:05 | 004,931,088 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2013.05.08 14:41:24 | 000,628,743 | ---- | C] () -- C:\Users\Administrator\Desktop\adwcleaner.exe [2011.11.20 20:33:16 | 000,000,106 | ---- | C] () -- C:\Windows\WPCMAPI.INI [2010.08.18 11:40:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2010.11.03 00:37:24 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Juniper Networks [2013.05.08 13:47:29 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Opera [2010.11.03 00:37:24 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Juniper Networks [2010.11.03 00:37:24 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Juniper Networks [2012.09.15 19:51:36 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\.oit [2013.01.04 17:56:43 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Amazon [2011.10.16 13:04:19 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\benibela [2010.12.25 03:46:19 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Canon [2012.12.09 23:26:52 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2011.03.30 00:25:56 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Dev-Cpp [2013.04.28 08:51:23 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Dropbox [2012.08.10 12:26:06 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\DVDVideoSoft [2013.04.25 17:59:04 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Foxit Software [2012.12.13 09:53:34 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\gtk-2.0 [2011.10.30 23:50:13 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Juniper Networks [2010.08.09 14:43:34 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Leadertech [2010.12.14 16:38:38 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Miranda [2012.07.11 00:20:08 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Novell [2010.08.20 16:51:51 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\OpenOffice.org [2012.02.19 19:13:13 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Opera [2012.12.10 00:25:42 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\PDAppFlex [2012.12.23 01:53:56 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\System [2012.12.22 22:47:42 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Ubisoft [2010.11.24 22:38:13 | 000,000,000 | ---D | M] -- C:\Users\Matthias\AppData\Roaming\Windows Live Writer [2012.12.23 02:00:38 | 000,000,000 | -HSD | M] -- C:\Users\Matthias\AppData\Roaming\wyUpdate AU ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 08.05.2013 15:28:30 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
5,99 Gb Total Physical Memory | 3,75 Gb Available Physical Memory | 62,63% Memory free
11,98 Gb Paging File | 9,71 Gb Available in Paging File | 81,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 69,90 Gb Total Space | 15,29 Gb Free Space | 21,88% Space Free | Partition Type: NTFS
Drive E: | 18,91 Gb Total Space | 3,89 Gb Free Space | 20,59% Space Free | Partition Type: NTFS
Drive J: | 48,83 Gb Total Space | 1,41 Gb Free Space | 2,89% Space Free | Partition Type: NTFS
Drive K: | 29,30 Gb Total Space | 1,98 Gb Free Space | 6,77% Space Free | Partition Type: NTFS
Drive L: | 78,13 Gb Total Space | 57,50 Gb Free Space | 73,60% Space Free | Partition Type: NTFS
Drive M: | 58,59 Gb Total Space | 4,88 Gb Free Space | 8,33% Space Free | Partition Type: NTFS
Drive V: | 140,00 Gb Total Space | 21,16 Gb Free Space | 15,11% Space Free | Partition Type: NTFS
Drive W: | 400,00 Gb Total Space | 257,15 Gb Free Space | 64,29% Space Free | Partition Type: NTFS
Drive X: | 80,00 Gb Total Space | 79,90 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
Drive Y: | 80,00 Gb Total Space | 79,26 Gb Free Space | 99,08% Space Free | Partition Type: NTFS
Drive Z: | 80,00 Gb Total Space | 21,29 Gb Free Space | 26,62% Space Free | Partition Type: NTFS
Computer Name: KARL | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{21F08D86-117D-4EC2-901B-B109CBA58F48}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{2E7A61AC-1A4B-46B8-80EA-66D49856D83C}" = lport=139 | protocol=6 | dir=in | app=system |
"{447AA1C8-E6C1-41F4-B252-E2444C6CA00D}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{6DF858ED-D74C-4041-87A1-4BDFE9A2F0C6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{71A27CDD-B400-4B7C-BBC6-01BFBE37A02A}" = rport=445 | protocol=6 | dir=out | app=system |
"{9C735C4D-6A63-4B9A-A9B6-1F70E0718C07}" = lport=138 | protocol=17 | dir=in | app=system |
"{AA95C749-17E3-4BFC-8D37-C5CD5E1C94B7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADBEC06B-8DAE-462B-87CD-D879D23651FD}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{B583CC71-6E3B-4AE9-B5E5-FD5658BEA7D1}" = lport=445 | protocol=6 | dir=in | app=system |
"{B6D24323-B44E-447C-ACC4-DD5D66A4E683}" = rport=139 | protocol=6 | dir=out | app=system |
"{BC3B18ED-EBD3-48C5-BFA0-155297EA5669}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C3FCE72D-B072-4C92-A69E-35B5D822C369}" = rport=137 | protocol=17 | dir=out | app=system |
"{CF565CF2-C791-4068-B4D0-61E1A9DFF758}" = lport=137 | protocol=17 | dir=in | app=system |
"{D121A698-8F0A-4CD7-9C0E-4B06341D87E2}" = rport=138 | protocol=17 | dir=out | app=system |
"{D25CF4E5-C437-42DC-AF99-D2DE9C5ABAD9}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02363784-A3FC-46E5-9DE3-5539DFF9B4E6}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\jedi outcast\gamedata\jk2sp.exe |
"{08D6985E-6888-487A-90EF-D32CAC0B9F99}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqpse.exe |
"{09D1D30A-FC8E-439E-9975-C5487EBB8C74}" = protocol=6 | dir=in | app=c:\program files (x86)\novell\groupwise\grpwise.exe |
"{0BBBB0D9-092C-4D9B-BF1E-D05DA9BF4074}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{104432CC-C63D-4851-AD79-41FE3EDC5C1E}" = protocol=17 | dir=in | app=c:\program files (x86)\novell\groupwise\grpwise.exe |
"{155AFC77-2F0E-49EA-BF05-DA9C5A6ECD07}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe |
"{162BDC7B-E0BE-48F8-B2A2-BA9A5A03AD75}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\jedi academy\gamedata\jasp.exe |
"{16BE16AB-D1FE-45E0-8AF4-12C9E55A03B9}" = dir=in | app=p:\setup\hpznui40.exe |
"{23C84BFA-3E99-4581-BF4C-B99D0AB4E401}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\jedi outcast\gamedata\jk2mp.exe |
"{23F02788-2985-4EBC-AF40-42D5FE60A4E8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe |
"{241DFC26-ACAD-4163-8ACB-5961E9ABDD26}" = dir=in | app=c:\program files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{248B48FE-4DFE-48A9-B2CC-152FF86BBBDF}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe |
"{253498CE-810E-4990-8267-B08BD5B5259D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe |
"{2BFDDE4A-56D5-4038-98C8-614D2EDA5AA2}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\plants vs zombies\plantsvszombies.exe |
"{2E338A96-1B97-44D8-90B9-BFFE7F1B5823}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe |
"{2F8A5DED-9568-4443-954D-6DB0E661645E}" = protocol=17 | dir=in | app=v:\steam\steamapps\***\team fortress classic\hl.exe |
"{33B09290-BC60-4575-AB5A-7CB70DC905E8}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\jedi outcast\gamedata\jk2sp.exe |
"{3550E434-038E-4929-9F58-AC6BE14F76F5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{36D10E17-175F-45F4-A689-B13819DB7938}" = protocol=6 | dir=in | app=v:\steam\steamapps\***\day of defeat source\hl2.exe |
"{37C80CBE-D682-49E6-A157-E47476C25882}" = protocol=17 | dir=in | app=v:\steam\steamapps\***\day of defeat source\hl2.exe |
"{3AD29426-F6CF-49D8-8A60-FED865AE2EB2}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\star wars jedi knight\jk.exe |
"{3DE71AC9-9FB2-4231-856E-77FC145F80D6}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe |
"{409577CE-2A03-4E56-89B3-BB7996F13DB2}" = protocol=6 | dir=in | app=c:\program files (x86)\novell\groupwise\notify.exe |
"{40C8890E-6863-47E6-9676-EDB483D46F2B}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech touch mouse server\itouch-server-win.exe |
"{425C9639-E53D-4913-A26C-24CFA0C509D7}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{43BC79EF-3681-4F0F-B1D8-1475D97770C1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{45CB393B-AA4F-422D-A08C-AB59FA2B165C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe |
"{54676103-C072-4D41-A35C-5DC53B7992E6}" = protocol=17 | dir=in | app=v:\steam\steam.exe |
"{54AA0CD2-89F6-451F-94A2-23024B102175}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{574B8B47-186A-417C-92A0-181E82B0B6FE}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe |
"{5887C9BB-3092-4CFE-A3CC-0871B84A133F}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\jedi knight mysteries of the sith\jkm.exe |
"{5B3A6DF9-A525-4802-B597-CABE32FC03A5}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\universe sandbox\universe sandbox.exe |
"{5B64EA9A-D8A3-4C7C-9068-29A14C2B3B3F}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\jedi academy\gamedata\jamp.exe |
"{5BEB0AB6-D11A-4B43-9FA8-7A586AA6B0DA}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\jedi academy\gamedata\jasp.exe |
"{5BF36097-2DD9-4DE2-9E43-8D92C3D75FB2}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe |
"{5E8DC074-62C1-47D3-8288-CF333C0BBA4D}" = protocol=17 | dir=in | app=v:\ubisoft\assassin's creed\assassinscreed_dx10.exe |
"{626FBB5D-CB95-437A-B942-77510BDF1F90}" = protocol=17 | dir=in | app=v:\ubisoft\assassin's creed\assassinscreed_dx9.exe |
"{6717328A-1EF3-47A7-8170-392AE8912CB8}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{69080DF0-2580-4D66-80AB-3A4AAF77539E}" = protocol=17 | dir=in | app=c:\users\matthias\appdata\roaming\dropbox\bin\dropbox.exe |
"{6C400793-E277-4F8E-AF93-F7D120169E59}" = protocol=6 | dir=in | app=v:\steam\steamapps\***\day of defeat\hl.exe |
"{6CFC2EEA-61B0-4D18-B90A-421205FE5DDF}" = protocol=6 | dir=in | app=v:\ubisoft\assassin's creed ii\uplaybrowser.exe |
"{6F4AD82D-2DDB-47EC-9ABD-4EA758A98865}" = protocol=17 | dir=in | app=c:\program files (x86)\novell\groupwise\notify.exe |
"{70E8FCBD-7AA1-4FA7-ACE9-88B6E1B439C5}" = protocol=17 | dir=in | app=v:\steam\steamapps\***\counterstrike source beta\hl2.exe |
"{75879F9B-DF09-42CD-AEE3-5E157F6C5384}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe |
"{77CBCD1F-E1D9-485C-986C-979EA8B053B9}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqpsapp.exe |
"{81A53994-1EAD-4100-9919-D805D124119C}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\jedi outcast\gamedata\jk2mp.exe |
"{8497025D-74F6-4B01-AB3C-502772D4B8C0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{871C0173-5C8A-4852-985F-B002BC2F5D95}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{87DBC312-B73A-4822-9770-915745DE5AF4}" = protocol=17 | dir=in | app=v:\ubisoft\assassin's creed\assassinscreed_launcher.exe |
"{8B75E8D2-1D8C-435E-A748-61D63925FA24}" = protocol=6 | dir=in | app=v:\steam\steamapps\***\team fortress classic\hl.exe |
"{8BC039A7-310D-468D-8845-255980EBA94D}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{8CF700A4-19D1-44FE-995E-14AB587D9AA2}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\half-life\hl.exe |
"{9039D6CD-9A95-4FFA-9F2B-F348256B9717}" = protocol=6 | dir=in | app=v:\ubisoft\assassin's creed\assassinscreed_dx10.exe |
"{92BCF91E-A5AB-44A2-ABE2-EC825F48FD66}" = protocol=6 | dir=in | app=v:\ubisoft\assassin's creed\assassinscreed_dx9.exe |
"{9510B552-20FF-4140-88F7-DF3698C71CA1}" = protocol=17 | dir=in | app=v:\steam\steamapps\***\half-life\hl.exe |
"{97140CA6-3614-4BCF-8C9B-E2192335B673}" = protocol=17 | dir=in | app=v:\steam\steamapps\***\counter-strike source\hl2.exe |
"{9996829B-B7FD-4FC8-AFAF-190D00077E5F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe |
"{9F76A735-AB88-411B-826D-FD20ACBC75BD}" = protocol=6 | dir=in | app=v:\steam\steamapps\***\half-life\hl.exe |
"{A0154CC8-FD52-4CA4-9A32-562A771BF859}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe |
"{A0CBA841-2B24-4B02-9660-8B0F873727FB}" = protocol=6 | dir=in | app=v:\steam\steamapps\***\counterstrike source beta\hl2.exe |
"{A1B4DAE9-0C0F-4966-9519-0FEC91577BBA}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech touch mouse server\itouch-server-win.exe |
"{A6415CA0-17F5-416E-96BD-BF2FA2ED7BF2}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\jedi academy\gamedata\jamp.exe |
"{A6689E1A-FB7A-4925-B9C2-B5199624CC1D}" = protocol=6 | dir=in | app=c:\users\matthias\appdata\roaming\dropbox\bin\dropbox.exe |
"{AA835FBB-8D9F-492B-BB72-6BFE8A4BF75E}" = protocol=6 | dir=in | app=v:\steam\steamapps\***\counter-strike source\hl2.exe |
"{AB6782F0-836E-4989-9305-1F6158035C44}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{AC1120A0-762B-4C5E-879B-3250AD4E9FE9}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\half-life\hl.exe |
"{AEE1D4B3-33F1-4809-BD03-3E20E45FAD7E}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{B2BDCCC6-0D5E-42F7-BE4E-3F6510A9DE92}" = protocol=17 | dir=in | app=v:\ubisoft\assassin's creed ii\assassinscreediigame.exe |
"{B3C1DF10-AF6B-44A4-895C-A8D6FD064B56}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{B79D9C3A-6C68-4545-9D6C-2400B8F9AEB0}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{B7D8779F-E384-47E3-A65F-00897C7207AB}" = protocol=17 | dir=in | app=v:\ubisoft\assassin's creed ii\uplaybrowser.exe |
"{B7DA0FF1-F165-44FB-94CD-F5EF59ABB1F3}" = protocol=6 | dir=in | app=v:\ubisoft\assassin's creed ii\assassinscreediigame.exe |
"{BAB3BEA9-F789-45CF-A809-8A24D99EF9B2}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{BC1D8D3B-A5B1-4B04-B2CA-DDCC21D9ABF2}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"{BCFA0272-CA6D-4958-B9E4-258CFF886445}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BED0DA14-EEF5-484D-BBFF-C2D00317CDA0}" = protocol=17 | dir=in | app=v:\steam\steamapps\***\day of defeat\hl.exe |
"{BF2DD8E4-8507-4A0C-834E-7170DED12A81}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{C3CF7413-74CC-42F5-8F80-A6816BF960D8}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\left 4 dead\left4dead.exe |
"{C466B0EC-8F47-4AEB-B50F-914414A394B1}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\jedi knight mysteries of the sith\jkm.exe |
"{C487BF11-9D2B-4BE3-9E50-1FD5DEC856E3}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{C884D322-7EE0-4DAB-ABB7-4545014F996D}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\portal 2\portal2.exe |
"{CAEABADF-5F8B-4BB2-991A-05E83FE61253}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\portal 2\portal2.exe |
"{CB64CE86-8940-4C5E-91C3-D53DEDE4C428}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{CF2A4DB8-9B54-4F52-8A55-B258B27372C3}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\dark forces\dosbox\dosbox.exe |
"{D1AEDC25-D583-44EA-A8A3-668079312D67}" = protocol=17 | dir=in | app=v:\ubisoft\assassin's creed ii\assassinscreedii.exe |
"{D2A250DB-C2A5-4864-BD0A-20E13EC3B618}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\left 4 dead\left4dead.exe |
"{D3F355D9-F6C9-46E6-B771-2E6E7B5E1930}" = protocol=17 | dir=in | app=v:\steam\steamapps\common\star wars jedi knight\jk.exe |
"{D4A6CDC3-FF09-4CAD-ADDF-F168267F79A9}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\universe sandbox\universe sandbox.exe |
"{D63DCFD7-C21F-470C-86C5-4971E895E6F4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe |
"{D6FA26FC-C719-464B-B13C-93C837A03CD7}" = protocol=6 | dir=in | app=v:\steam\steam.exe |
"{DA3A2689-4B4E-4180-82E1-2E0B6D839E89}" = protocol=6 | dir=in | app=v:\ubisoft\assassin's creed ii\assassinscreedii.exe |
"{DCC33FE5-9F78-4074-AF01-04A4BB55A8E1}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E1A3950D-7E26-465B-9461-ECDC17481734}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{E2F68B24-B0A5-4DA5-A459-CFD1C6682878}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E85974F8-0B94-4D8A-84FA-805E18C4BD10}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{E8F5AFE4-4690-4027-8910-0F204B8A6652}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\plants vs zombies\plantsvszombies.exe |
"{EAAF6CC9-B106-4533-8289-C3B9A04AA3B7}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F1BF297C-FB87-4F54-81BA-41BA7F3C4D7A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F2F28E06-353A-41D9-A462-477D6895C4E9}" = protocol=6 | dir=in | app=v:\ubisoft\assassin's creed\assassinscreed_launcher.exe |
"{F4F50CD6-069D-4561-A578-2CFF3EBEE38D}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{F6F38E33-0D06-464C-8736-A4B78BFF61EA}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqsudi.exe |
"{FC443166-94D3-40EE-ADCD-B2449FE28633}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{FCCBD182-7FF7-4A7C-87F8-B372BDC23CB6}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{FCFBE4D9-1DB2-46B7-B8C5-7D76BD197E8B}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{FD0862F2-FED0-4F7F-BBBE-4AD0B89E4E1E}" = protocol=6 | dir=in | app=v:\steam\steamapps\common\dark forces\dosbox\dosbox.exe |
"TCP Query User{1AB98D7E-C1DC-4A80-AAAD-885DAACC1A70}V:\electronic arts\need for speed carbon\nfsc.exe" = protocol=6 | dir=in | app=v:\electronic arts\need for speed carbon\nfsc.exe |
"TCP Query User{34583625-24C4-4FE6-ACEB-3D1B33F04B46}C:\program files (x86)\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe |
"TCP Query User{355FC8A2-BB0A-4143-80E4-812CE3245B1F}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"TCP Query User{3A6E86BB-2357-48AE-AB2A-E7ADA2B15872}C:\program files\maple 14\jre\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\maple 14\jre\bin\java.exe |
"TCP Query User{4A111B0A-D4D9-41F4-8E18-1A9FC20B1D77}C:\program files\maple 14\jre\bin\maple.exe" = protocol=6 | dir=in | app=c:\program files\maple 14\jre\bin\maple.exe |
"TCP Query User{673F68AA-D4AD-4B62-80D3-5BAF31CD4B3E}V:\steam\steamapps\***\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=v:\steam\steamapps\***\team fortress 2\hl2.exe |
"TCP Query User{8A16EBE3-43A6-4493-B66F-CB51B6C8D651}C:\program files (x86)\winscp\winscp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winscp\winscp.exe |
"TCP Query User{9251D63D-CAEE-4A4C-930E-FDBDE0D46788}C:\program files\maple 14\jre\bin\maple.exe" = protocol=6 | dir=in | app=c:\program files\maple 14\jre\bin\maple.exe |
"TCP Query User{9A98AB4B-1CD9-4FB2-B447-B42E4A5DE5E5}V:\blizzard\warcraft iii\war3.exe" = protocol=6 | dir=in | app=v:\blizzard\warcraft iii\war3.exe |
"TCP Query User{B8473369-560D-4F21-8D61-57865657D731}V:\blizzard\warcraft iii\war3.exe" = protocol=6 | dir=in | app=v:\blizzard\warcraft iii\war3.exe |
"TCP Query User{BD45F865-0DD8-4279-B0D6-34943271B77E}V:\electronic arts\need for speed carbon\nfsc.exe" = protocol=6 | dir=in | app=v:\electronic arts\need for speed carbon\nfsc.exe |
"TCP Query User{BD8CF4C7-AD8A-43CF-B907-4AE929F7F454}C:\program files (x86)\winscp\winscp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winscp\winscp.exe |
"TCP Query User{BDF8E9B9-4ECB-412E-B6E1-0F9341C88024}C:\program files (x86)\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe |
"UDP Query User{077428D8-BB77-4F5E-A02E-23D4959998E9}C:\program files (x86)\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe |
"UDP Query User{0F122DD2-1FD1-4324-9E39-DD44ABF66814}C:\program files (x86)\winscp\winscp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winscp\winscp.exe |
"UDP Query User{3EF24A4B-B9EF-4B6A-BB10-44BF78BEC584}V:\electronic arts\need for speed carbon\nfsc.exe" = protocol=17 | dir=in | app=v:\electronic arts\need for speed carbon\nfsc.exe |
"UDP Query User{573D9892-25E5-4172-9148-132595DBA9A4}C:\program files\maple 14\jre\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\maple 14\jre\bin\java.exe |
"UDP Query User{66B2F9A1-F72E-40F0-B730-4F4919A02D3C}V:\steam\steamapps\***\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=v:\steam\steamapps\***\team fortress 2\hl2.exe |
"UDP Query User{6CB61B5B-94D3-493B-AA3B-21AA029580EF}C:\program files (x86)\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe |
"UDP Query User{757F69EB-6114-4F23-A926-1C3C7BA7F4B5}V:\electronic arts\need for speed carbon\nfsc.exe" = protocol=17 | dir=in | app=v:\electronic arts\need for speed carbon\nfsc.exe |
"UDP Query User{8726B532-784A-49A6-8C89-3CCE816694E5}V:\blizzard\warcraft iii\war3.exe" = protocol=17 | dir=in | app=v:\blizzard\warcraft iii\war3.exe |
"UDP Query User{95231B9B-8D17-4400-BFBB-7DFF3EBB2B47}C:\program files\maple 14\jre\bin\maple.exe" = protocol=17 | dir=in | app=c:\program files\maple 14\jre\bin\maple.exe |
"UDP Query User{996221B6-481D-40DA-8BFA-8E8240F4A463}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{9A6A638F-F93F-4AAC-8D48-F9EC0EE4F6BF}C:\program files\maple 14\jre\bin\maple.exe" = protocol=17 | dir=in | app=c:\program files\maple 14\jre\bin\maple.exe |
"UDP Query User{A64D6C04-988C-425C-9000-C991E722305E}C:\program files (x86)\winscp\winscp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winscp\winscp.exe |
"UDP Query User{ECF34A1F-D0ED-42AA-A0DA-EFEF2BA9EEE2}V:\blizzard\warcraft iii\war3.exe" = protocol=17 | dir=in | app=v:\blizzard\warcraft iii\war3.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{05EFBF37-0E52-4579-875C-7EEF0DFB4FCB}" = Network64
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{28A0318C-B98D-B6B1-64D1-4E4755A8E668}" = AMD Drag and Drop Transcoding
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E3FABF5-C3B9-7F7E-4AAE-977D77D48C51}" = ATI Catalyst Install Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}" = Logitech GamePanel Software 3.06.109
"{A9B54408-EF50-4821-B8A2-F597A657112A}" = HP Photosmart C309a All-In-One Driver Software 13.0 Rel .5
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B93D47B2-0862-E2E6-8115-B5DAF7AE3C01}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Maple 14" = Maple 14
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MiKTeX 2.9" = MiKTeX 2.9
"Shop for HP Supplies" = Shop for HP Supplies
"SP6" = Logitech SetPoint 6.15
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{096E41D2-F5C2-4B1B-8E66-7E62C8919233}_is1" = Winterberg Configurator Version WEM Confi 7.61
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20EFC9AA-BBC1-4DFD-81FF-99654F71CBF8}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{55456ADA-1540-491F-8E74-26431C764C0C}" = GroupWise Client - VC Runtimes (release)
"{5662D815-DB58-5082-315B-0326B37EB7CB}" = CCC Help English
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{888F0154-4AAA-4719-BFAE-01C3066B8408}" = C309a
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8C65C65C-530F-B2DB-BBD7-AF554ABEBBA1}" = Catalyst Control Center Graphics Previews Common
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{922E8525-AC7E-4294-ACAA-43712D4423C0}" = Adobe Flash Player 10 ActiveX
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A088AF9D-0B94-4C33-B327-E5B494CE810B}" = PS_AIO_05_C309_Software_Min
"{A92A4DB0-CD37-42D1-BE1D-603D53C24328}" = Intel(R) Programm für Prozessor-IDs
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B28635AB-1DF3-4F07-BFEA-975D911B549B}" = hpphotosmartdisclabelplugin
"{BBF08789-06CB-4D2F-9330-CD617AFDE528}" = Fax
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C8773FDB-D0DB-BE52-D536-F48F9886B57B}" = Adobe Download Assistant
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D69D4AE5-717C-5E56-A56F-542EF5F6A84C}" = Catalyst Control Center Graphics Previews Vista
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{D9D8F2CF-FE2D-4644-9762-01F916FE90A9}" = HPPhotoSmartDiscLabel_PaperLabel
"{DB837E02-82D0-3888-6DEC-D29587CCDC2F}" = ccc-core-static
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E50AFF40-100B-4163-9CB9-4700B3E57ED9}" = GroupWise
"{EDA12670-56B5-4459-BA21-D010F0E3EBA1}" = Emergency 4 Deluxe
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"{F86B6849-38E0-7818-F21E-6DC637932076}" = Catalyst Control Center InstallProxy
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"DPP" = Canon Utilities Digital Photo Professional 3.8
"EOS Utility" = Canon Utilities EOS Utility
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Foxit Reader_is1" = Foxit Reader
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube Download_is1" = Free YouTube Download version 3.0.13.815
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"GSview 4.9" = GSview 4.9
"Juniper Network Connect 6.5.0" = Juniper Networks Network Connect 6.5.0
"Juniper Network Connect 7.1.0" = Juniper Networks Network Connect 7.1.0
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"Logitech Touch Mouse Server" = Logitech Touch Mouse Server 1.0
"Magnus2" = Die Suche nach dem Goldschatz
"Maple 14" = Maple 14
"Miranda IM" = Miranda IM 0.9.29
"Opera 12.15.1748" = Opera 12.15
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"SetupService" = Juniper Installer Service
"ST6UNST #1" = GSkype 1.5
"Steam App 10" = Counter-Strike
"Steam App 100" = Counter-Strike: Condition Zero Deleted Scenes
"Steam App 130" = Half-Life: Blue Shift
"Steam App 20" = Team Fortress Classic
"Steam App 220" = Half-Life 2
"Steam App 240" = Counter-Strike: Source
"Steam App 260" = Counter-Strike: Source Beta
"Steam App 280" = Half-Life: Source
"Steam App 30" = Day of Defeat
"Steam App 300" = Day of Defeat: Source
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 32380" = Star Wars Jedi Knight: Dark Forces II
"Steam App 32390" = Star Wars - Jedi Knight: Mysteries of the Sith
"Steam App 32400" = Star Wars: Dark Forces
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"Steam App 360" = Half-Life Deathmatch: Source
"Steam App 380" = Half-Life 2: Episode One
"Steam App 40" = Deathmatch Classic
"Steam App 400" = Portal
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 50" = Half-Life: Opposing Force
"Steam App 500" = Left 4 Dead
"Steam App 520" = Team Fortress 2 Beta
"Steam App 550" = Left 4 Dead 2
"Steam App 60" = Ricochet
"Steam App 6020" = Star Wars Jedi Knight: Jedi Academy
"Steam App 6030" = Star Wars - Jedi Knight II: Jedi Outcast
"Steam App 620" = Portal 2
"Steam App 70" = Half-Life
"Steam App 72200" = Universe Sandbox
"Steam App 80" = Counter-Strike: Condition Zero
"TeXstudio_is1" = TeXstudio 2.2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.11
"Warcraft III" = Warcraft III
"WFTK" = Canon Utilities WFT Utility
"WinLiveSuite" = Windows Live Essentials
"winscp3_is1" = WinSCP 4.2.9
"WMS" = Windows NT Messaging
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 16.01.2012 18:30:14 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 19.01.2012 18:40:51 | Computer Name = Karl | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
[ System Events ]
Error - 08.05.2013 07:29:31 | Computer Name = Karl | Source = DCOM | ID = 10016
Description =
Error - 08.05.2013 08:43:48 | Computer Name = Karl | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
Error - 08.05.2013 08:43:49 | Computer Name = Karl | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
Error - 08.05.2013 08:43:49 | Computer Name = Karl | Source = Ntfs | ID = 262281
Description = Auf dem Volume "E:" konnte der Transaktionsressourcen-Manager aufgrund
eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in
den Daten enthalten.
Error - 08.05.2013 08:45:06 | Computer Name = Karl | Source = DCOM | ID = 10016
Description =
Error - 08.05.2013 08:48:39 | Computer Name = Karl | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?08.?05.?2013 um 14:46:44 unerwartet heruntergefahren.
Error - 08.05.2013 08:48:32 | Computer Name = Karl | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
Error - 08.05.2013 08:48:34 | Computer Name = Karl | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
Error - 08.05.2013 08:48:34 | Computer Name = Karl | Source = Ntfs | ID = 262281
Description = Auf dem Volume "E:" konnte der Transaktionsressourcen-Manager aufgrund
eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in
den Daten enthalten.
Error - 08.05.2013 08:49:56 | Computer Name = Karl | Source = DCOM | ID = 10016
Description =
< End of report >
Ich würde mich sehr über rasche Hilfe freuen. Grüße Ken |
| Themen zu GVU Trojaner (Version 2.12) |
| antivir, application/pdf:, avira, bonjour, converter, error, fehler, firefox, flash player, format, grand theft auto, gvu 2.12, homepage, iexplore.exe, install.exe, launch, logfile, mp3, plug-in, programm, realtek, registry, rundll, scan, security, software, svchost.exe, trojaner, windows, windows xp, wrapper |
Baum-Darstellung