Hallo ihr Lieben,
Ich habe folgendes Problem. Seit kurzem wird mir auf jeder Internetseite Werbung für Onlinegames, Kontaktbörsen usw. angezeigt. Es öffnen sich außerdem ständig neue Werbefenster wenn ich auf einen Link klicke. Unten den Werbebilder steht immer "Ads not by this site". Auch habe ich das Gefühl, dass die Internetverbindung seit dem langsamer geworden ist. Ich hab das Problem gegoogelt und in eurem Forum bei einigen anderen Usern mit dem selben Problem lesen können, dass es sich dabei eventuell um einen Trojaner handeln könnte. Ihnen wurde geraten das Programm Malwarebytes zu benutzen,deshalb habe ich das Programm meinen PC scannen lassen und es wurde eine infiziertes Objekt gefunden. Dieses habe ich dann entfernt. Allerdings ist die Werbung immer noch nicht verschwunden.

Ich habe nun die Anleitung von euch befolgt und folgende Dateien bekommen:


OTL

OTL logfile created on: 5/20/2013 9:39:10 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.91 Gb Total Physical Memory | 1.80 Gb Available Physical Memory | 45.95% Memory free
7.83 Gb Paging File | 5.46 Gb Available in Paging File | 69.73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 50.00 Gb Total Space | 7.10 Gb Free Space | 14.19% Space Free | Partition Type: NTFS
Drive D: | 628.01 Gb Total Space | 379.95 Gb Free Space | 60.50% Space Free | Partition Type: NTFS

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/20 21:38:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe
PRC - [2013/03/22 16:09:37 | 002,787,280 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
PRC - [2012/12/18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/08/08 19:09:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012/05/23 13:32:38 | 001,466,760 | ---- | M] (Garmin) -- C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe
PRC - [2012/05/10 21:49:36 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012/05/10 21:49:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/02/01 23:24:40 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011/02/01 23:24:38 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/11/03 21:01:34 | 000,983,104 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2010/11/03 21:01:20 | 001,298,496 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
PRC - [2010/11/03 20:53:28 | 000,897,088 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2010/11/03 20:53:06 | 000,979,008 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
PRC - [2010/09/30 03:05:32 | 000,048,752 | ---- | M] (FUJITSU LIMITED) -- C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
PRC - [2010/03/18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PRC - [2009/08/13 16:06:00 | 000,662,016 | ---- | M] (Sonix) -- C:\Windows\vsnp2uvc.exe
PRC - [2009/07/08 22:58:26 | 000,162,912 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe


========== Modules (No Company Name) ==========

MOD - [2013/05/15 22:39:27 | 018,002,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a9594959e951127f16eb49644ba92f79\PresentationFramework.ni.dll
MOD - [2013/05/15 22:39:16 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\7cfbbd029ef945fbcdaedd24b2b67a24\PresentationCore.ni.dll
MOD - [2013/05/15 22:39:12 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\153143f74d840484b510d8cf5187796b\System.Windows.Forms.ni.dll
MOD - [2013/05/15 22:39:09 | 007,069,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\2f9e0112e10f9e70d3430d0be9863976\System.Core.ni.dll
MOD - [2013/05/15 22:39:04 | 003,858,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\af18b8a8f56494da44cc448f3b9704a5\WindowsBase.ni.dll
MOD - [2013/05/15 22:39:01 | 000,749,056 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\aaf1949171dfbfcd4669ed8ba6cd3f10\System.Security.ni.dll
MOD - [2013/05/14 21:07:00 | 013,136,776 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.202\pepflashplayer.dll
MOD - [2013/04/09 10:57:07 | 000,390,096 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
MOD - [2013/04/09 10:57:05 | 004,050,896 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll
MOD - [2013/04/09 10:56:15 | 000,598,480 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\26.0.1410.64\libglesv2.dll
MOD - [2013/04/09 10:56:14 | 000,124,368 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\26.0.1410.64\libegl.dll
MOD - [2013/04/09 10:56:13 | 001,606,096 | ---- | M] () -- C:\Users\***\AppData\Local\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll
MOD - [2013/03/22 16:09:37 | 002,787,280 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
MOD - [2013/03/22 16:08:36 | 002,520,016 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll
MOD - [2013/01/09 19:51:09 | 001,801,728 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\866894ebe5258bf9f45d6b063229e990\System.Xaml.ni.dll
MOD - [2013/01/09 16:07:22 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\dfeff31ab1e7cd3480c8942290c92f5d\PresentationFramework.Aero.ni.dll
MOD - [2013/01/09 16:07:14 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\43cd41484df96d15df949eb17dd88152\System.Xml.ni.dll
MOD - [2013/01/09 16:07:09 | 001,667,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b573c6a62bb88df0ee2af59b6a8ca910\System.Drawing.ni.dll
MOD - [2013/01/09 16:07:06 | 009,094,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\15872842e3e63ddf0f720f406706198e\System.ni.dll
MOD - [2013/01/09 16:07:02 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll
MOD - [2011/05/26 13:42:00 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll


========== Services (SafeList) ==========

SRV:64bit: - [2011/01/05 23:41:38 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011/01/05 23:28:50 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2011/01/05 23:26:56 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010/10/08 00:58:14 | 000,331,776 | ---- | M] (FUJITSU LIMITED) [Auto | Running] -- C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe -- (PFNService)
SRV:64bit: - [2010/09/23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/06/18 00:47:12 | 000,063,336 | ---- | M] (FUJITSU LIMITED) [Auto | Running] -- C:\Program Files\Fujitsu\PSUtility\PSUService.exe -- (PowerSavingUtilityService)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2013/03/22 16:09:37 | 002,787,280 | ---- | M] () [Auto | Running] -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2012/12/18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/05/10 21:49:36 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/10 21:49:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/02/01 23:24:40 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/01 23:24:38 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/11/03 21:01:34 | 000,983,104 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)
SRV - [2010/11/03 21:01:20 | 001,298,496 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)
SRV - [2010/11/03 20:53:28 | 000,897,088 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)
SRV - [2010/03/18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/05/10 21:49:36 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/05/10 21:49:36 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012/03/16 14:55:26 | 000,227,840 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juwwanecm.sys -- (huawei_wwanecm)
DRV:64bit: - [2012/03/16 14:55:26 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2012/03/16 14:55:26 | 000,098,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV:64bit: - [2012/03/16 14:55:26 | 000,087,040 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2012/03/16 14:55:26 | 000,028,672 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl)
DRV:64bit: - [2012/03/16 14:55:24 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/12/15 16:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/04/15 04:08:26 | 012,228,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/03/24 07:47:02 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)
DRV:64bit: - [2011/03/24 07:47:02 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/18 01:11:54 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011/01/04 04:29:46 | 008,507,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2010/12/28 20:45:54 | 000,412,776 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/11/04 14:07:06 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux)
DRV:64bit: - [2010/11/04 12:31:44 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)
DRV:64bit: - [2010/10/20 03:12:58 | 000,274,432 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)
DRV:64bit: - [2010/10/20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010/10/14 18:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010/10/09 15:35:38 | 001,801,216 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)
DRV:64bit: - [2010/05/07 04:19:58 | 000,245,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/11/19 14:45:08 | 000,299,568 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/24 07:31:30 | 000,021,104 | ---- | M] (FUJITSU LIMITED) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\FBIOSDRV.sys -- (FBIOSDRV)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2006/11/01 12:59:24 | 000,007,296 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fuj02e3.sys -- (FUJ02E3)
DRV:64bit: - [2006/11/01 12:20:28 | 000,007,808 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fuj02b1.sys -- (FUJ02B1)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {96522675-C420-4DD3-826A-82602BEBCF9A}
IE:64bit: - HKLM\..\SearchScopes\{96522675-C420-4DD3-826A-82602BEBCF9A}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {96522675-C420-4DD3-826A-82602BEBCF9A}
IE - HKLM\..\SearchScopes\{96522675-C420-4DD3-826A-82602BEBCF9A}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSF

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www1.delta-search.com/?affID=119357&tt=gc_190513_215&babsrc=HP_ss&mntrId=9C42AC72897C590D
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ts.fujitsu.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectd [Binary data over 200 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.com/ig/redirectd [Binary data over 200 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?affID=119357&tt=gc_190513_215&babsrc=HP_ss&mntrId=9C42AC72897C590D
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {96522675-C420-4DD3-826A-82602BEBCF9A}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_190513_215&babsrc=SP_ss&mntrId=9C42AC72897C590D
IE - HKCU\..\SearchScopes\{96522675-C420-4DD3-826A-82602BEBCF9A}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSG_deDE467
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\***\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\***\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\lfind@nijadsoft.net: C:\Program Files (x86)\LyricsFinder\FF\ [2013/05/20 18:48:40 | 000,000,000 | ---D | M]

[2013/05/20 18:49:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://www1.delta-search.com/?affID=119357&tt=gc_190513_215&babsrc=HP_ss&mntrId=9C42AC72897C590D
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aalnjolghjkkogicompabhhbbkljnlka\0.303_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.4_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnbcopcndefcccgdofjadnafjljgofam\1.110_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcjdanpjacpeeppdjkppebobilhaglfo\2.9_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgplpejojljhgndghinonhjpmbdmjamk\1.0.0.2_1\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\
CHR - Extension: No name found = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Lyrics Finder) - {398C01F1-E584-46AD-A649-4F78B435DCFE} - C:\Program Files (x86)\LyricsFinder\lfind.dll (Nijad Software)
O2 - BHO: (delta Helper Object) - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Delta Toolbar) - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [FDM7] C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe (FUJITSU LIMITED)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe (FUJITSU LIMITED)
O4:64bit: - HKLM..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)
O4:64bit: - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PfNet] C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe (FUJITSU LIMITED)
O4:64bit: - HKLM..\Run: [PSUTility] C:\Program Files\Fujitsu\PSUtility\TrayManager.exe (FUJITSU LIMITED)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)
O4 - HKLM..\Run: [AIS_RegApp] C:\Program Files (x86)\Fujitsu\AIS Connect\regapp\RegApp.exe (Fujitsu)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe File not found
O4 - HKLM..\Run: [Garmin Lifetime Updater] C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe (Garmin)
O4 - HKLM..\Run: [IndicatorUtility] C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)
O4 - HKLM..\Run: [YouCam Mirror Tray icon] C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3F1FC6AF-1785-46A7-93F8-760C26FFAB6F}: NameServer = 139.7.30.126 139.7.30.125
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D928363-E233-496E-9D42-91FE310172E3}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20 - AppInit_DLLs: (c:\progra~3\browse~1\261249~1.132\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f14abde7-9d61-11e2-ba87-ac72897c5910}\Shell - "" = AutoRun
O33 - MountPoints2\{f14abde7-9d61-11e2-ba87-ac72897c5910}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe /checkApplicationPresence
O33 - MountPoints2\{f14abe7f-9d61-11e2-ba87-ac72897c5910}\Shell - "" = AutoRun
O33 - MountPoints2\{f14abe7f-9d61-11e2-ba87-ac72897c5910}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe /checkApplicationPresence
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/20 21:25:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\DivX
[2013/05/20 20:31:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2013/05/20 20:31:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/20 20:31:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/05/20 20:31:15 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/05/20 20:31:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/05/20 20:27:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2013/05/20 20:27:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2013/05/20 20:26:47 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/05/20 20:09:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\CrashDumps
[2013/05/20 19:00:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\XnView
[2013/05/20 18:59:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
[2013/05/20 18:59:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\XnView
[2013/05/20 18:51:18 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2013/05/20 18:50:06 | 000,000,000 | ---D | C] -- C:\Users\***\Qtrax
[2013/05/20 18:49:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX
[2013/05/20 18:49:34 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013/05/20 18:49:34 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Extensions
[2013/05/20 18:49:34 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
[2013/05/20 18:49:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
[2013/05/20 18:49:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Xvid
[2013/05/20 18:49:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
[2013/05/20 18:49:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow
[2013/05/20 18:49:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DirectVobSub
[2013/05/20 18:49:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ffdshow
[2013/05/20 18:49:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DirectVobSub
[2013/05/20 18:49:23 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect
[2013/05/20 18:49:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
[2013/05/20 18:49:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Haali
[2013/05/20 18:49:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\LavFilters
[2013/05/20 18:49:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lame For Audacity
[2013/05/20 18:49:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DSP-worx
[2013/05/20 18:49:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\CDXReader
[2013/05/20 18:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2013/05/20 18:49:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenSource Flash Video Splitter
[2013/05/20 18:49:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\BabSolution
[2013/05/20 18:49:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/05/20 18:49:05 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Delta
[2013/05/20 18:49:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Delta
[2013/05/20 18:48:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\DSite
[2013/05/20 18:48:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013/05/20 18:48:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LyricsFinder
[2013/05/20 18:48:40 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Babylon
[2013/05/13 20:00:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4AC12A27-60A6-4274-8B99-B8DBDBD3025F}
[2013/05/09 22:44:13 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{ACBF030E-B19A-476A-A9E3-4B0D5CD83ABC}
[2013/05/02 17:26:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\fontconfig
[2013/05/02 17:26:13 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\gegl-0.2
[2013/05/02 17:26:13 | 000,000,000 | ---D | C] -- C:\Users\***\.gimp-2.8
[2013/05/02 17:23:13 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP 2
[2013/05/02 17:14:40 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{36CC068C-D968-405A-9DA2-B264DDFF2BFD}
[2013/05/01 19:10:00 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner
[2013/04/28 20:21:57 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Kamera
[1 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/20 21:40:23 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/20 21:40:23 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/20 21:38:20 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2013/05/20 21:38:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2366262021-3429744855-3110590674-1000UA.job
[2013/05/20 21:33:29 | 000,000,412 | ---- | M] () -- C:\Windows\tasks\Lyrics Finder Update.job
[2013/05/20 21:32:57 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/20 21:32:37 | 000,000,286 | ---- | M] () -- C:\Windows\tasks\DSite.job
[2013/05/20 21:32:28 | 000,279,632 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/05/20 21:31:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/20 21:31:46 | 3152,506,880 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/20 21:28:32 | 000,004,882 | ---- | M] () -- C:\Windows\unins000.dat
[2013/05/20 21:28:09 | 000,715,038 | ---- | M] () -- C:\Windows\unins000.exe
[2013/05/20 21:24:59 | 000,001,621 | ---- | M] () -- C:\Users\***\Desktop\DivX Movies.lnk
[2013/05/20 21:24:41 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/20 20:39:07 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2366262021-3429744855-3110590674-1000Core.job
[2013/05/20 20:31:18 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013/05/20 20:27:07 | 000,002,025 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/05/20 19:01:06 | 000,040,891 | ---- | M] () -- C:\Users\***\Desktop\chipnummer.jpg
[2013/05/20 19:00:49 | 000,000,929 | ---- | M] () -- C:\Users\***\Desktop\XnView.lnk
[2013/05/15 22:37:53 | 001,636,028 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/15 22:37:53 | 000,697,322 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013/05/15 22:37:53 | 000,652,600 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/15 22:37:53 | 000,148,328 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013/05/15 22:37:53 | 000,121,274 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/05/02 17:41:05 | 000,002,532 | ---- | M] () -- C:\Users\***\AppData\Local\recently-used.xbel
[2013/04/22 22:17:42 | 000,002,022 | -H-- | M] () -- C:\Users\***\Documents\Default.rdp
[1 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/20 21:38:20 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2013/05/20 21:28:47 | 000,696,832 | ---- | C] () -- C:\Windows\SysNative\xvidcore.dll
[2013/05/20 21:28:47 | 000,255,488 | ---- | C] () -- C:\Windows\SysNative\xvidvfw.dll
[2013/05/20 21:28:47 | 000,173,568 | ---- | C] () -- C:\Windows\SysNative\xvid.ax
[2013/05/20 21:28:46 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\xvid.ax
[2013/05/20 21:28:45 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2013/05/20 21:28:45 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2013/05/20 21:28:28 | 000,715,038 | ---- | C] () -- C:\Windows\unins000.exe
[2013/05/20 21:24:59 | 000,001,621 | ---- | C] () -- C:\Users\***\Desktop\DivX Movies.lnk
[2013/05/20 20:31:18 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013/05/20 20:27:07 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/05/20 20:27:07 | 000,002,025 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/05/20 19:01:06 | 000,040,891 | ---- | C] () -- C:\Users\***\Desktop\chipnummer.jpg
[2013/05/20 18:59:20 | 000,000,929 | ---- | C] () -- C:\Users\***\Desktop\XnView.lnk
[2013/05/20 18:49:25 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2013/05/20 18:49:24 | 000,178,688 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2013/05/20 18:49:21 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2013/05/20 18:49:21 | 000,148,992 | ---- | C] ( ) -- C:\Windows\SysNative\lagarith.dll
[2013/05/20 18:49:21 | 000,004,882 | ---- | C] () -- C:\Windows\unins000.dat
[2013/05/20 18:48:44 | 000,000,286 | ---- | C] () -- C:\Windows\tasks\DSite.job
[2013/05/20 18:48:41 | 000,000,412 | ---- | C] () -- C:\Windows\tasks\Lyrics Finder Update.job
[2013/05/02 17:41:05 | 000,002,532 | ---- | C] () -- C:\Users\***\AppData\Local\recently-used.xbel
[2013/05/02 17:23:45 | 000,000,898 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
[2012/01/21 05:41:16 | 000,245,760 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnp2uvc.dll
[2012/01/21 05:41:16 | 000,024,576 | ---- | C] () -- C:\Windows\snuvcdsm.exe
[2012/01/21 05:41:16 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini

========== ZeroAccess Check ==========

[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/02/21 22:16:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\.chimera
[2013/05/20 18:49:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\BabSolution
[2013/05/20 18:48:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Babylon
[2013/05/20 18:49:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CDXReader
[2013/05/20 18:49:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Delta
[2013/05/20 18:48:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DSite
[2013/01/07 13:30:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2013/01/07 13:30:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/05/07 21:24:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Fujitsu
[2012/01/20 21:57:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Fujitsu Launch Center
[2012/05/25 20:33:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Garmin
[2012/03/25 12:41:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2013/05/20 21:28:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LavFilters
[2012/07/01 11:23:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenCandy
[2012/11/26 19:44:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PhotoScape
[2013/02/19 15:41:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Python
[2013/04/06 21:22:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SoftGrid Client
[2012/01/23 17:50:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TP
[2012/07/01 11:24:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software
[2013/04/04 22:03:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Vodafone
[2012/06/14 21:08:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer
[2013/05/20 19:02:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\XnView

========== Purity Check ==========



< End of report >


Extras

OTL Extras logfile created on: 5/20/2013 9:39:10 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.91 Gb Total Physical Memory | 1.80 Gb Available Physical Memory | 45.95% Memory free
7.83 Gb Paging File | 5.46 Gb Available in Paging File | 69.73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 50.00 Gb Total Space | 7.10 Gb Free Space | 14.19% Space Free | Partition Type: NTFS
Drive D: | 628.01 Gb Total Space | 379.95 Gb Free Space | 60.50% Space Free | Partition Type: NTFS

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Betrachten mit XnView] -- "C:\Program Files (x86)\XnView\xnview.exe" "%1" (XnView, hxxp://www.xnview.com)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Betrachten mit XnView] -- "C:\Program Files (x86)\XnView\xnview.exe" "%1" (XnView, hxxp://www.xnview.com)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0194E714-8467-47AB-AD78-63284C73D3D6}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{06E89086-29C2-4D18-AC5D-25C083906403}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{12B4082B-5932-49E4-B57B-BBCC7F362790}" = rport=137 | protocol=17 | dir=out | app=system |
"{1C0978CD-7BE6-48A8-98F4-70D89DA89787}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1D0A225D-ACE3-440F-9D86-687440F66FF2}" = lport=139 | protocol=6 | dir=in | app=system |
"{39697303-8E2E-442C-8712-8113EC945DB9}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3FD57F9C-ABB3-4A33-B879-7A5105D3FCB3}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4C3A7D2B-ACD2-40C3-93F0-1C62D9FB20D2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5FAC2CBE-6C9A-47CD-A83B-7A200B9E9A29}" = lport=2869 | protocol=6 | dir=in | app=system |
"{60C39E79-EA4B-4686-AC57-149CAC2C4C5E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6321BDE2-F614-4B1E-A4C0-8621099986E2}" = lport=138 | protocol=17 | dir=in | app=system |
"{6563C2B9-B075-4D19-AC4E-E9CB457EB261}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6E23D517-1A68-4FEB-B46C-F9901244898F}" = rport=139 | protocol=6 | dir=out | app=system |
"{804F0CED-4776-40CF-A86E-2EA24B2C3879}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9B1961D8-8A39-4839-8D58-75534461DDFA}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9E223F5C-B818-4587-AC8D-503218F8E411}" = lport=137 | protocol=17 | dir=in | app=system |
"{A7938203-40A0-4CD8-861B-3FAB4DB7410F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B1EC4D80-4152-4537-AC59-D6DF0882899D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C53FDFD9-CCB1-42ED-AA94-30A53741C517}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C8F208CD-74FC-4715-AFB7-EA7AF1AAB572}" = lport=445 | protocol=6 | dir=in | app=system |
"{DB40EA82-9594-4639-83CE-800D508D6722}" = lport=10243 | protocol=6 | dir=in | app=system |
"{EF3C06F0-62A5-44D4-8339-121D654FDCCB}" = rport=138 | protocol=17 | dir=out | app=system |
"{F2607067-BE25-4E56-8D53-1502BD0B12C5}" = rport=445 | protocol=6 | dir=out | app=system |
"{FED41864-E685-4D1D-B96C-29A41B5E64FA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0992E114-1A3F-4BDD-A37D-24DF1A43CA9D}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{09C40D10-B202-42D7-BFB0-333BD3C5534D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{09E48FD5-39F4-4BB2-9349-11AEDBB823CC}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{0A2947F7-9773-49A4-A0FF-828A79DB978A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{0A95C804-E868-4EEB-A1F7-6BB46FAE54A4}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{108EDC67-ACA0-4FF4-9C52-D8FF9EC908E5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{125C01FA-E27E-4CC3-BF94-71ABF843DF41}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{167F63F5-C651-459B-A117-053A2E5D8927}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{1692AC11-A894-411E-AC34-95B0320A77E7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2560FCFC-8CB4-4996-A19D-348DDFA082B6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3AFA6444-F2FD-41A1-8149-23211B24DE3D}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{51C12C6E-61CE-4CC0-AA64-529B46A4DD0E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{51D843AC-36B9-4F24-B972-B9D2DBA18027}" = protocol=6 | dir=out | app=system |
"{6399AC6D-74BB-4BD3-8E56-0937267B18C5}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{665E0B63-D99F-4677-9D50-7D607E694A5D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6FA3AD14-5FB6-4592-A98F-E8721AD5F4A2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{73FF8CAB-6DE7-48E2-B2DB-9D70C6BFA60A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{88599510-3ABA-46CB-A734-C3A0624C8396}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{9EC34745-7ABA-4BB5-82E4-3F4A32BC29A3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B3674A0D-B8F8-49D3-9F9B-0436BCE59E82}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C1F3CA0D-2C6D-44A2-8B10-0B4EDB9F15A8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C7C6819C-A558-49A4-B023-7583C0B772A0}" = dir=in | app=c:\program files (x86)\intel corporation\intel widi\widiapp.exe |
"{CD5BA6AC-58BE-48A0-934F-39586C047530}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{CE0BA250-2934-4A9B-9950-C38507875E7C}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{CF9E9D84-3B8C-4228-AB70-884280501FC2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D2FAE450-596E-4BA4-AD20-68F59422B3A7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DA634382-9852-48CC-A572-81BC95BDB64D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{F79DBC14-89AC-4834-AD9F-35A71A69C802}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FDCD8A4B-B5E9-45F1-A905-93045A23E610}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}" = Intel(R) PROSet/Wireless WiFi Software
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{28EF7372-9087-4AC3-9B9F-D9751FCDF830}" = Intel(R) Wireless Display
"{4108974B-DE87-4AD4-9167-930C62C45691}" = Fujitsu Display Manager
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7BA64D21-EE46-4a9a-8145-52B0175C3F86}" = Plugfree NETWORK
"{7CE8BE79-ABC3-4B2C-9543-28ED2B0A9EA8}" = Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A5FADEAC-B0A9-4C27-A8B5-05381A339F4E}" = Plugfree NETWORK
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{BCF07271-A853-4D3A-B668-4B752174CAA8}" = iTunes
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility
"{EB418DDD-5365-4381-87F6-D8BBB21CC1CA}" = Garmin Communicator Plugin x64
"{EC314CDF-3521-482B-A21C-65AC95664814}" = Fujitsu MobilityCenter Extension Utility
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"GIMP-2_is1" = GIMP 2.8.4
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserProtect
"{17079027-EB8A-42C6-9BF8-825B78889F6A}" = Garmin Communicator Plugin
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{25680C01-6753-4FE9-A891-7857F26457C1}" = Intel(R) WiDi
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = FJ Camera
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{45411273-7307-4F9D-BCAF-7E5ED0A36050}" = Garmin Lifetime Updater
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{49A588CF-5FD4-4774-BFBF-0764287DE82B}" = Power Saving Utility
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{549BF60D-FDDA-4E4C-ABE3-9E897BC09E79}" = Anytime USB Charge Utility
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9983CD31-473F-4808-8317-5346119F0187}" = eBay
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B1E035A6-F03E-426F-82F0-BAC56FF873DC}" = AIS Connect
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C8E4B31D-337C-483D-822D-16F11441669B}" = Fujitsu Hotkey Utility
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F59AC46C-10C3-4023-882C-4212A92283B3}_is1" = Lagarith Lossless Codec (1.3.27)
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"AIS Connect" = AIS Connect
"Avira AntiVir Desktop" = Avira Free Antivirus
"DC-Bass Source" = DC-Bass Source 1.3.0
"delta" = Delta toolbar
"Delta Chrome Toolbar" = Delta Chrome Toolbar
"DeskUpdate_is1" = DeskUpdate 4.11
"DivX Setup" = DivX-Setup
"ffdshow_is1" = ffdshow v1.1.4399 [2012-03-22]
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212
"HaaliMkx" = Haali Media Splitter
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{4108974B-DE87-4AD4-9167-930C62C45691}" = Fujitsu Display Manager
"InstallShield_{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel
"InstallShield_{C8E4B31D-337C-483D-822D-16F11441669B}" = Fujitsu Hotkey Utility
"InstallShield_{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility
"InstallShield_{EC314CDF-3521-482B-A21C-65AC95664814}" = Fujitsu MobilityCenter Extension Utility
"LAME_is1" = LAME v3.99.3 (for Windows)
"lfind@nijadsoft.net" = Lyrics Finder
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter 1.0.0.5
"PhotoScape" = PhotoScape
"vsfilter_is1" = DirectVobSub 2.40.4209
"WinLiveSuite" = Windows Live Essentials
"XnView_is1" = XnView 2.00
"Xvid Video Codec 1.3.2" = Xvid Video Codec

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"DSite" = Update for Codec Pack
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12/9/2012 3:04:57 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7082

Error - 12/9/2012 3:04:58 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/9/2012 3:04:58 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8080

Error - 12/9/2012 3:04:58 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8080

Error - 12/9/2012 3:04:59 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/9/2012 3:04:59 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9126

Error - 12/9/2012 3:04:59 PM | Computer Name = ***-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9126

Error - 12/10/2012 1:26:13 PM | Computer Name = ***-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/10/2012 4:18:36 PM | Computer Name = ***-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/11/2012 3:18:49 PM | Computer Name = ***-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 5/5/2013 1:17:11 PM | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows-Fehlerberichterstattungsdienst erreicht.

Error - 5/5/2013 1:17:41 PM | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows-Fehlerberichterstattungsdienst erreicht.

Error - 5/5/2013 1:18:11 PM | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows-Fehlerberichterstattungsdienst erreicht.

Error - 5/6/2013 11:41:14 AM | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 5/7/2013 3:30:09 PM | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 5/12/2013 8:54:08 AM | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 5/12/2013 4:27:37 PM | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows-Fehlerberichterstattungsdienst erreicht.

Error - 5/16/2013 11:54:13 AM | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 5/20/2013 2:38:39 PM | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows-Fehlerberichterstattungsdienst erreicht.

Error - 5/20/2013 3:29:24 PM | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


< End of report >



GMER


GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-20 22:16:11
Windows 6.1.7601 Service Pack 1 x64
Running: gmer_2.1.19163.exe


---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00150079fe36
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ac72897c5910
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 11117
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 7954
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7D928363-E233-496E-9D42-91FE310172E3}@LeaseObtainedTime 1369078376
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7D928363-E233-496E-9D42-91FE310172E3}@T1 1369510376
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7D928363-E233-496E-9D42-91FE310172E3}@T2 1369834376
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7D928363-E233-496E-9D42-91FE310172E3}@LeaseTerminatesTime 1369942376
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00150079fe36 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ac72897c5910 (not active ControlSet)

---- EOF - GMER 2.1 ----

Ich wäre froh, wenn mir jemand helfen könnte! Vielen Dank schon mal im Voraus!!
Viele Grüße :-)

Hi emisch

Ich bin Smeenk und ich werde versuchen Dir zu helfen


Systemscan mit ZOEK

Bitte lade die zoek.exe von hier: http://hijackthis.nl/smeenk/

• Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen.
• Starte die Zoek.exe mit einem Doppelklick (nur Windows XP-Benutzer).
• Windows Vista/7 Benutzer starten das Tool bitte per Rechtsklick auf das Icon und wählen "Als Administrator starten".
• Kopiere untenstehende Code in das Textfeld:
  

  emptyclsid;
  chromelook;
  autoclean;
  startupall;
  filesrcm;
  firefoxlook;
           

• Nun klicke auf "Run script" und warte geduldig, bis der Scan durchgelaufen ist.
• Wenn das Tool fertig ist, wird sich Notepad mit dem Logfile öffnen (ggfs. erst nach einem Neustart).
  Nachträglich kannst Du den Bericht unter c:\zoek-results.log einsehen.
• Poste mir das Log File zoek-results.log

Bitte alles nach Möglichkeit hier in CODE-Tags posten: [code] Dein Log hier [/code]

Hallo Smeenk,
danke für deine Hilfe! Hier ist das Log File:

Zoek.exe Version 4.0.0.2 Updated 21-May-2013
Tool run by *** on 21.05.2013 at 20:01:24,08.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2366262021-3429744855-3110590674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully
HKEY_USERS\S-1-5-21-2366262021-3429744855-3110590674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-2366262021-3429744855-3110590674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrowserProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BrowserProtect deleted successfully

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"bProtector Start Page"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"bProtectorDefaultScope"=-

==== Deleting Files \ Folders ======================

"C:\ProgramData\rebootpending.txt" deleted
"C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data" deleted
"C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences" deleted
"C:\Windows\tasks\Lyrics Finder Update.job" deleted
"C:\Windows\tasks\DSite.job" deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.settings" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23" not deleted
"C:\Program Files (x86)\Delta" deleted
"C:\Program Files (x86)\Common Files\DVDVideoSoft\TB" deleted
"C:\Program Files (x86)\Common Files\DVDVideoSoft\bin" deleted
"C:\Program Files (x86)\LyricsFinder" deleted
"C:\Users\***\AppData\Roaming\BabSolution" deleted
"C:\Users\***\AppData\Roaming\Babylon" deleted
"C:\Users\***\AppData\Roaming\Delta" deleted
"C:\Users\***\AppData\Roaming\DSite" deleted
"C:\Users\***\AppData\Roaming\OpenCandy" deleted
"C:\ProgramData\BrowserProtect" not deleted
"C:\ProgramData\Partner" deleted
"C:\ProgramData\Babylon" deleted
"C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect" deleted
"C:\Users\***\AppData\Local\PackageAware" deleted
"C:\Windows\SysWow64\searchplugins" deleted
"C:\Windows\SysWow64\Extensions" deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension" not deleted
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings" not deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2013-05-20 19:28:28	DDC0B6672AB7862A3C2D7AA2ADB6B645	715038	----a-w-	C:\Windows\unins000.exe
2013-05-20 16:49:21	F9173B9FF19E07D9F2384AADB196B763	4882	----a-w-	C:\Windows\unins000.dat
====== C:\Users\***\AppData\Local\Temp ====
2013-05-07 18:15:40	AE5BD330CCA60544A36A65944A14269F	12871152	----a-w-	C:\Users\***\AppData\Local\Temp\tmp7784.exe
====== C:\Windows\SysWOW64 =====
2013-05-20 22:50:11	F59A16A9418044C1D505C53DA370B099	2046976	----a-w-	C:\Windows\SysWOW64\iertutil.dll
2013-05-20 22:50:11	E14A07B768EC49D382CABCE2F078D576	232960	----a-w-	C:\Windows\SysWOW64\url.dll
2013-05-20 22:50:11	DEFB55D4FF094673DF31FA89A8A8A2F0	226816	----a-w-	C:\Windows\SysWOW64\dxtrans.dll
2013-05-20 22:50:11	D5E5A86F49ACC11768D8339094C3AFD8	13760512	----a-w-	C:\Windows\SysWOW64\ieframe.dll
2013-05-20 22:50:11	C9A062F32FF600C96795B43CD9A53151	2877440	----a-w-	C:\Windows\SysWOW64\jscript9.dll
2013-05-20 22:50:11	C68FBBF01E86CB6CF0B797748FBD6C1A	357888	----a-w-	C:\Windows\SysWOW64\dxtmsft.dll
2013-05-20 22:50:11	C28A634CF127DA67D566B5E14D0A0170	719360	----a-w-	C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-20 22:50:11	C225E5307D8D4982A1687F2702C37C78	158720	----a-w-	C:\Windows\SysWOW64\msls31.dll
2013-05-20 22:50:11	B96C13B5C85AC4240FE95DE115945D59	38400	----a-w-	C:\Windows\SysWOW64\imgutil.dll
2013-05-20 22:50:11	AF0332E09DDBE0172237D1958A7DADB8	79872	----a-w-	C:\Windows\SysWOW64\mshtmled.dll
2013-05-20 22:50:11	A7E8E3A9F92D9B0D495F636A1D282883	48640	----a-w-	C:\Windows\SysWOW64\mshtmler.dll
2013-05-20 22:50:11	9DF7A7C74D8632CB5EBD37E3A374825E	204800	----a-w-	C:\Windows\SysWOW64\webcheck.dll
2013-05-20 22:50:11	9D9AC6CE9A9D951AC40DE91CD6F0A620	1441280	----a-w-	C:\Windows\SysWOW64\inetcpl.cpl
2013-05-20 22:50:11	9D6BD7D1EE59B6D0FD65F1A6DF5706F9	137216	----a-w-	C:\Windows\SysWOW64\ieUnatt.exe
2013-05-20 22:50:11	96E0F0BED5D9EBABB899D8CA83C36A7E	523264	----a-w-	C:\Windows\SysWOW64\vbscript.dll
2013-05-20 22:50:11	932571EFF79B93F94E84ADF4989A277F	69120	----a-w-	C:\Windows\SysWOW64\icardie.dll
2013-05-20 22:50:11	8C3D32A4A46326031309A43C52539D7F	1400416	----a-w-	C:\Windows\SysWOW64\ieapfltr.dat
2013-05-20 22:50:11	8A45166CD9874463AB76B552C9C2D3AD	110592	----a-w-	C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-20 22:50:11	87E71F2A83681F41B796CA685818EF2D	163840	----a-w-	C:\Windows\SysWOW64\msrating.dll
2013-05-20 22:50:11	828B4A41BE891A7AEC07E693422B4A3A	117248	----a-w-	C:\Windows\SysWOW64\iepeers.dll
2013-05-20 22:50:11	81C4D657D37C3A5418B54BFECE821B84	57344	----a-w-	C:\Windows\SysWOW64\pngfilt.dll
2013-05-20 22:50:11	80B47F0F45C3EBF41C30E0BA367D25D3	125440	----a-w-	C:\Windows\SysWOW64\occache.dll
2013-05-20 22:50:11	7A468BC721C1D34E60389D3F2F87BBEA	14323712	----a-w-	C:\Windows\SysWOW64\mshtml.dll
2013-05-20 22:50:11	6DF2C6438CFF6EFCBBB88AEE01795501	73728	----a-w-	C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-20 22:50:11	65C95886E1B17001ADDF163AC18C5525	1130496	----a-w-	C:\Windows\SysWOW64\urlmon.dll
2013-05-20 22:50:11	5ABB3F36AF17007F33FA275E96A2C95E	1767424	----a-w-	C:\Windows\SysWOW64\wininet.dll
2013-05-20 22:50:11	5915AA67DECA289F7B4AFB686CDB09E9	71680	----a-w-	C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-20 22:50:11	56E51C26745FF7413514EA4DDF33BC6C	11776	----a-w-	C:\Windows\SysWOW64\msfeedssync.exe
2013-05-20 22:50:11	52AA8A8DA4175580F365D275EB53DBE3	493056	----a-w-	C:\Windows\SysWOW64\msfeeds.dll
2013-05-20 22:50:11	52A7D73D5570F757D865DDECD087FB41	138752	----a-w-	C:\Windows\SysWOW64\wextract.exe
2013-05-20 22:50:11	4A47CAEA8D3B82DE439A79771ECED4B1	361984	----a-w-	C:\Windows\SysWOW64\html.iec
2013-05-20 22:50:11	49834B94A8E8383B700EDDEF46C2AE6A	2706432	----a-w-	C:\Windows\SysWOW64\mshtml.tlb
2013-05-20 22:50:11	414A3D9AAE072CDEFE0B64C2EBEE18D2	61952	----a-w-	C:\Windows\SysWOW64\tdc.ocx
2013-05-20 22:50:11	404FAD93ABFBD86D1AAAB47D5DFA6505	242200	----a-w-	C:\Windows\SysWOW64\iedkcs32.dll
2013-05-20 22:50:11	3AB2A38F7EA9E62D176A78FB58761E24	12800	----a-w-	C:\Windows\SysWOW64\mshta.exe
2013-05-20 22:50:11	366D8EA2ADCBA228C9487BC6D2427DDC	109056	----a-w-	C:\Windows\SysWOW64\iesysprep.dll
2013-05-20 22:50:11	338520304B99471BD0ED121954FE7863	82432	----a-w-	C:\Windows\SysWOW64\inseng.dll
2013-05-20 22:50:11	2D7A29C35D0894481A69FA3AC45F18F0	41984	----a-w-	C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-20 22:50:11	28AEB03752D716BF149DBC93A9ACC17E	391168	----a-w-	C:\Windows\SysWOW64\ieui.dll
2013-05-20 22:50:11	0F44172A5B34E8F208CD0F209EDD4A73	629248	----a-w-	C:\Windows\SysWOW64\ieapfltr.dll
2013-05-20 22:50:11	0402BFC25AB49E02256BC24E32829773	185344	----a-w-	C:\Windows\SysWOW64\elshyph.dll
2013-05-20 22:50:11	038F76279EC64878A072D988DE13C7B2	150528	----a-w-	C:\Windows\SysWOW64\iexpress.exe
2013-05-20 22:50:11	03180AFD271BFD88813F428421BC4A1A	39424	----a-w-	C:\Windows\SysWOW64\jsproxy.dll
2013-05-20 22:50:11	0142341520F0A0F2B0E312335B96705B	690688	----a-w-	C:\Windows\SysWOW64\jscript.dll
2013-05-20 22:50:10	F0D4AE074D9BC0741DC6E91C741F2F8C	23040	----a-w-	C:\Windows\SysWOW64\licmgr10.dll
2013-05-20 22:50:10	DFDBC397D0DDBD1AFA3CB400D4C003A9	61440	----a-w-	C:\Windows\SysWOW64\iesetup.dll
2013-05-20 22:50:10	3CC9825BFFE7B7429C8B79B0395ACDA8	33280	----a-w-	C:\Windows\SysWOW64\iernonce.dll
2013-05-20 22:50:10	1FF56AC32B38A94C3C88497BD6E00C96	25185	----a-w-	C:\Windows\SysWOW64\ieuinit.inf
2013-05-20 22:49:13	FB3F036EF6A467F7AF46C821FF5D198D	220160	----a-w-	C:\Windows\SysWOW64\d3d10core.dll
2013-05-20 22:49:13	D4F264FE23F8953D840904418220C15E	293376	----a-w-	C:\Windows\SysWOW64\dxgi.dll
2013-05-20 22:49:13	D4212AB475A3B25EC4DF574536C3EDC5	249856	----a-w-	C:\Windows\SysWOW64\d3d10_1core.dll
2013-05-20 22:49:13	C7A730AFB80B11F93EFC81B1D6F920D7	364544	----a-w-	C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-05-20 22:49:13	B3170CCC779B682C3341873EA60CF084	1988096	----a-w-	C:\Windows\SysWOW64\d3d10warp.dll
2013-05-20 22:49:13	9FF8F684BACF326082E5562F7C104A79	3419136	----a-w-	C:\Windows\SysWOW64\d2d1.dll
2013-05-20 22:49:13	8B285BDAB7735FDFB18E6F7122923B77	187392	----a-w-	C:\Windows\SysWOW64\UIAnimation.dll
2013-05-20 22:49:13	8504944851DF6175CC489A8F3328459E	1080832	----a-w-	C:\Windows\SysWOW64\d3d10.dll
2013-05-20 22:49:13	7ACDFB4CC67F4993DF0E0731576309B2	1504768	----a-w-	C:\Windows\SysWOW64\d3d11.dll
2013-05-20 22:49:13	6A7B5A3EFCCDB53DA41CF6838056990F	1158144	----a-w-	C:\Windows\SysWOW64\XpsPrint.dll
2013-05-20 22:49:13	6A13B4F3B3F575F1E24B877B9359AABA	10752	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-20 22:49:13	6951562DC4625EEFC6EACD52AD165866	9728	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-20 22:49:13	62A6EB5771580CAE445804389F3F7432	207872	----a-w-	C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-05-20 22:49:13	60F4AEFA103D421EA4A40E31409B4756	3072	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-20 22:49:13	600A65F922CCDCBB2D11467914241556	2284544	----a-w-	C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-05-20 22:49:13	589CBC4989F750E1DA35625AB481CF43	4096	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-20 22:49:13	545F1BAAADD0BF1F4FE4586293FCA07D	417792	----a-w-	C:\Windows\SysWOW64\WMPhoto.dll
2013-05-20 22:49:13	4FF3EC04CD47DD62181894B71B004E40	604160	----a-w-	C:\Windows\SysWOW64\d3d10level9.dll
2013-05-20 22:49:13	49ACA548B2423F1C67898E6AC719A9A6	3584	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-20 22:49:13	4277F5164DE9B7C665BB928B9145BEE0	1247744	----a-w-	C:\Windows\SysWOW64\DWrite.dll
2013-05-20 22:49:13	3C1936A12C62254F914A01BBC6A8DC69	161792	----a-w-	C:\Windows\SysWOW64\d3d10_1.dll
2013-05-20 22:49:13	3BE0D923AA45A4DBE091C2D84F0B4FE7	3072	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-20 22:49:13	3BCECD87AB4E6743BFB45B352AD1A529	1230336	----a-w-	C:\Windows\SysWOW64\WindowsCodecs.dll
2013-05-20 22:49:13	2E33DFD10F28F86C3FC40EE123CC3904	2560	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-20 22:49:13	1C60E09CA1C3A045BC4D367F67C915B7	5632	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-20 22:49:13	007863E45F25AA47A4C30D0930BBFD85	5632	---ha-w-	C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-20 19:28:46	5E8CD1804C1A035311F5DA9C1048F024	153088	----a-w-	C:\Windows\SysWOW64\xvid.ax
2013-05-20 19:28:45	E3833540C755C06EC18D414047448B14	645632	----a-w-	C:\Windows\SysWOW64\xvidcore.dll
2013-05-20 19:28:45	348AC3C5B87056E24C9E0039332BFB66	240640	----a-w-	C:\Windows\SysWOW64\xvidvfw.dll
2013-05-20 16:49:25	C0992C27E792440DA1DD5CFE8EE03E32	79360	----a-w-	C:\Windows\SysWOW64\ff_vfw.dll
2013-05-20 16:49:24	72C57D8501528179C6957E2F541CE215	178688	----a-w-	C:\Windows\SysWOW64\unrar.dll
2013-05-20 16:49:21	FA425C74CE2EB719B2A77A7A2ADDAE32	216064	----a-w-	C:\Windows\SysWOW64\lagarith.dll
2013-05-15 18:11:37	565D78187494FB5F08B5A52DEB2AEA7A	12872704	----a-w-	C:\Windows\SysWOW64\shell32.dll
2013-05-15 18:11:35	E904178851A6A44BFA97E064EF779E9D	1796096	----a-w-	C:\Windows\SysWOW64\authui.dll
2013-05-15 18:11:35	1F05F5A16881CD928C82D53CEFCF4477	180224	----a-w-	C:\Windows\SysWOW64\shdocvw.dll
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
2013-05-20 22:50:12	5051BB40FFB2BA4870C0A059CA03294F	1054720	----a-w-	C:\Windows\Sysnative\MsSpellCheckingFacility.exe
2013-05-20 22:50:11	3531FA12A76A32ECECD972196775DF7C	226304	----a-w-	C:\Windows\Sysnative\elshyph.dll
2013-05-20 22:50:10	FE6CB2001A8C2A85B617CD3FC85D8242	526336	----a-w-	C:\Windows\Sysnative\ieui.dll
2013-05-20 22:50:10	FC6B4D5450871A4D5CB344AFF6C090EF	281600	----a-w-	C:\Windows\Sysnative\dxtrans.dll
2013-05-20 22:50:10	F651D95B5043EFC20A6108A853553984	92160	----a-w-	C:\Windows\Sysnative\SetIEInstalledDate.exe
2013-05-20 22:50:10	EC6E8273B6CB79CA5B7B00CA82D1FCEE	136704	----a-w-	C:\Windows\Sysnative\iesysprep.dll
2013-05-20 22:50:10	EC08E38751854C5B8899139B7DD29FF9	197120	----a-w-	C:\Windows\Sysnative\msrating.dll
2013-05-20 22:50:10	E965529C43D25F2BDA77D705098BF777	135680	----a-w-	C:\Windows\Sysnative\IEAdvpack.dll
2013-05-20 22:50:10	E34F0440799F9A0F9DC4265F4ADA75C1	1365504	----a-w-	C:\Windows\Sysnative\urlmon.dll
2013-05-20 22:50:10	E1055A7FAD39F1F7C44F6152044056EA	905728	----a-w-	C:\Windows\Sysnative\mshtmlmedia.dll
2013-05-20 22:50:10	D9C10A4A0B3411146E6FC8936B079934	167424	----a-w-	C:\Windows\Sysnative\iexpress.exe
2013-05-20 22:50:10	D8DD5CBB9668EEE98915EA49C72F78FA	441856	----a-w-	C:\Windows\Sysnative\html.iec
2013-05-20 22:50:10	D8076F8A3C34064582035AE6696DC34A	27648	----a-w-	C:\Windows\Sysnative\licmgr10.dll
2013-05-20 22:50:10	D0F66CFAED5B85543216EF526D380B8B	270848	----a-w-	C:\Windows\Sysnative\iedkcs32.dll
2013-05-20 22:50:10	D0D4CE6C6CE87269A34A184356475D17	149504	----a-w-	C:\Windows\Sysnative\occache.dll
2013-05-20 22:50:10	C56EF4C50A1FEED0CC9B7AE068CBBBBB	19231232	----a-w-	C:\Windows\Sysnative\mshtml.dll
2013-05-20 22:50:10	C2F21E3059AFF5E616F3E361D9FA10CD	62976	----a-w-	C:\Windows\Sysnative\pngfilt.dll
2013-05-20 22:50:10	BC0D4AFBE94D8E1F81C8926D805C3366	247296	----a-w-	C:\Windows\Sysnative\webcheck.dll
2013-05-20 22:50:10	ADE73A865A5F136E84F49BB6B1627C6E	1509376	----a-w-	C:\Windows\Sysnative\inetcpl.cpl
2013-05-20 22:50:10	A197763AA7487807279AB61CD6835CEF	89600	----a-w-	C:\Windows\Sysnative\RegisterIEPKEYs.exe
2013-05-20 22:50:10	9D6B9124B582F0FBF275B434CE5A672C	2647552	----a-w-	C:\Windows\Sysnative\iertutil.dll
2013-05-20 22:50:10	9B2BB51ED6D28860A48CFF46FD6D3DC1	2706432	----a-w-	C:\Windows\Sysnative\mshtml.tlb
2013-05-20 22:50:10	97588F2871E1FE8E3EB57B17B98DF03B	67072	----a-w-	C:\Windows\Sysnative\iesetup.dll
2013-05-20 22:50:10	942E110384668EEFF44751A02EDDF5E4	48640	----a-w-	C:\Windows\Sysnative\mshtmler.dll
2013-05-20 22:50:10	8C3D32A4A46326031309A43C52539D7F	1400416	----a-w-	C:\Windows\Sysnative\ieapfltr.dat
2013-05-20 22:50:10	82D602EBBBA6D08E4691F32269FD3494	12800	----a-w-	C:\Windows\Sysnative\msfeedssync.exe
2013-05-20 22:50:10	7F4F74880E0B586EB7A9E225C34B1296	15404032	----a-w-	C:\Windows\Sysnative\ieframe.dll
2013-05-20 22:50:10	7EC25F7ABF7CE6B0FE93787524EE537B	452096	----a-w-	C:\Windows\Sysnative\dxtmsft.dll
2013-05-20 22:50:10	7DAA72F6C30D81EE31EC2BDC90054326	603136	----a-w-	C:\Windows\Sysnative\msfeeds.dll
2013-05-20 22:50:10	772EC073332D1BA2DBEC32C6D063811A	855552	----a-w-	C:\Windows\Sysnative\jscript.dll
2013-05-20 22:50:10	658E8FEC79A4AB5BFDE032627B5C9667	13824	----a-w-	C:\Windows\Sysnative\mshta.exe
2013-05-20 22:50:10	63CAE56FE4215F98FEB0188748A99378	52224	----a-w-	C:\Windows\Sysnative\msfeedsbs.dll
2013-05-20 22:50:10	5B15164486C66B76699E1CD2CD2F3A2A	51200	----a-w-	C:\Windows\Sysnative\imgutil.dll
2013-05-20 22:50:10	4E426A67C46379B75A5E671B46FC07F6	102912	----a-w-	C:\Windows\Sysnative\inseng.dll
2013-05-20 22:50:10	4CFBEC37E4FAD530E623E1541E1EA958	599552	----a-w-	C:\Windows\Sysnative\vbscript.dll
2013-05-20 22:50:10	440104AEB9DAF8AC9842080AE59740FA	77312	----a-w-	C:\Windows\Sysnative\tdc.ocx
2013-05-20 22:50:10	42758AF68D3C4912C8D8A18088AD2555	51712	----a-w-	C:\Windows\Sysnative\ie4uinit.exe
2013-05-20 22:50:10	40738329209CBE2C9B48F7E30F7C1414	144896	----a-w-	C:\Windows\Sysnative\wextract.exe
2013-05-20 22:50:10	402D797A7905DC3C6FE11E75CD5252EB	235008	----a-w-	C:\Windows\Sysnative\url.dll
2013-05-20 22:50:10	31E219322B8D765F9F84B80D1D92A07F	173568	----a-w-	C:\Windows\Sysnative\ieUnatt.exe
2013-05-20 22:50:10	2C96C695B6015042AC867EA419A45C20	3958784	----a-w-	C:\Windows\Sysnative\jscript9.dll
2013-05-20 22:50:10	2AAE2B8FED8390879C2369FC63F7001F	97280	----a-w-	C:\Windows\Sysnative\mshtmled.dll
2013-05-20 22:50:10	27A9000C534AA9BADC9EE74940F50C6D	2242048	----a-w-	C:\Windows\Sysnative\wininet.dll
2013-05-20 22:50:10	254502230F2259D255D4149C235173B1	53248	----a-w-	C:\Windows\Sysnative\jsproxy.dll
2013-05-20 22:50:10	23556D116D5FB93395B2A648EEB24251	81408	----a-w-	C:\Windows\Sysnative\icardie.dll
2013-05-20 22:50:10	1FF56AC32B38A94C3C88497BD6E00C96	25185	----a-w-	C:\Windows\Sysnative\ieuinit.inf
2013-05-20 22:50:10	18A94D6E9D27D169D38DAB91F6A97518	136192	----a-w-	C:\Windows\Sysnative\iepeers.dll
2013-05-20 22:50:10	168602AB16D30D5D6E091CA609FC7E75	39936	----a-w-	C:\Windows\Sysnative\iernonce.dll
2013-05-20 22:50:10	1456EECCB5CF6B91513200F95D61706E	762368	----a-w-	C:\Windows\Sysnative\ieapfltr.dll
2013-05-20 22:50:10	112183DF91C9BAECB498E4A86ECDE598	216064	----a-w-	C:\Windows\Sysnative\msls31.dll
2013-05-20 22:49:13	FB4045578F5180BDB1963AB352B78548	5632	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-20 22:49:13	FA428BDBCFAB9DC3D58F0BD2CCD50EA2	1682432	----a-w-	C:\Windows\Sysnative\XpsPrint.dll
2013-05-20 22:49:13	F5CEF064C7E6D95DA86B9D064A56A969	3584	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-20 22:49:13	F49E92B50CED5C9F1725D3C0329FD933	10752	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-20 22:49:13	F1C19F0AA151B90A7416FA1D50DDB582	245248	----a-w-	C:\Windows\Sysnative\WindowsCodecsExt.dll
2013-05-20 22:49:13	E8EEA503870CB6A6DC4E09A2433DF33E	2776576	----a-w-	C:\Windows\Sysnative\msmpeg2vdec.dll
2013-05-20 22:49:13	C4C183E6551084039EC862DA1C945E3D	1175552	----a-w-	C:\Windows\Sysnative\FntCache.dll
2013-05-20 22:49:13	C498EF41B93986BCBD483597573EB96D	2565120	----a-w-	C:\Windows\Sysnative\d3d10warp.dll
2013-05-20 22:49:13	BDDF242A49E7B7DC5CCEC291BCE53ACB	1424384	----a-w-	C:\Windows\Sysnative\WindowsCodecs.dll
2013-05-20 22:49:13	B2CA1AC17E78D986B22FD6C2261CD84F	1238528	----a-w-	C:\Windows\Sysnative\d3d10.dll
2013-05-20 22:49:13	AFC3DB5C6EB8CA8017DDB81D6C0AD02A	9728	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-20 22:49:13	AFB73882AE41E1629A63E6713FE30FB9	296960	----a-w-	C:\Windows\Sysnative\d3d10core.dll
2013-05-20 22:49:13	9AE80F6A66B30E3ED8CDF858CF28B11B	194560	----a-w-	C:\Windows\Sysnative\d3d10_1.dll
2013-05-20 22:49:13	9108540E866F75C7AF2B91DD921A8091	3072	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-20 22:49:13	9094039A00485F71C4DE64BF51F64C46	3072	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-20 22:49:13	8DFB5752FCE145A6B295093C0A8BE131	363008	----a-w-	C:\Windows\Sysnative\dxgi.dll
2013-05-20 22:49:13	893E8C1E4A1263EDDB1A6922D0E32201	465920	----a-w-	C:\Windows\Sysnative\WMPhoto.dll
2013-05-20 22:49:13	7E8A672B7B06A6EB11960C22E0360C59	3928064	----a-w-	C:\Windows\Sysnative\d2d1.dll
2013-05-20 22:49:13	72723D3E4781BADC62C3180C137E7B23	4096	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-20 22:49:13	6F623BD09CBB4C3F97374F12976E5EA5	522752	----a-w-	C:\Windows\Sysnative\XpsGdiConverter.dll
2013-05-20 22:49:13	64A4AB126E24FD3F58EBE64852773DB5	2560	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-20 22:49:13	63F72417CA38D8FC8F53709649B589E3	333312	----a-w-	C:\Windows\Sysnative\d3d10_1core.dll
2013-05-20 22:49:13	63BB89DED1E9104E68D33E54DE4D340D	1643520	----a-w-	C:\Windows\Sysnative\DWrite.dll
2013-05-20 22:49:13	448B02AD260EC3E1E892FCE6DFDDEEBD	1887232	----a-w-	C:\Windows\Sysnative\d3d11.dll
2013-05-20 22:49:13	3834316FE8A653227282196525E07DFE	648192	----a-w-	C:\Windows\Sysnative\d3d10level9.dll
2013-05-20 22:49:13	0E6FBF19D9DFBB77316C23DF91F8A101	5632	---ha-w-	C:\Windows\Sysnative\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-20 22:49:13	04CB7C8FDC6D9640DD82A527208F72C4	221184	----a-w-	C:\Windows\Sysnative\UIAnimation.dll
2013-05-20 19:28:47	9DAEC9D57ED0B24FDE04E93EFEDB627D	173568	----a-w-	C:\Windows\Sysnative\xvid.ax
2013-05-20 19:28:47	4F35C25B664FE4C10C83ADA9F827DCA6	696832	----a-w-	C:\Windows\Sysnative\xvidcore.dll
2013-05-20 19:28:47	12160D5E79E2D6DD251793134CD0E3F9	255488	----a-w-	C:\Windows\Sysnative\xvidvfw.dll
2013-05-20 16:49:21	EE6407670B4CA47CCC9AF5ED41A19150	148992	----a-w-	C:\Windows\Sysnative\lagarith.dll
2013-05-15 18:11:44	943F527DF79E6B400104341AA7023C75	144384	----a-w-	C:\Windows\Sysnative\cdd.dll
2013-05-15 18:11:37	3EF480BFED1B5947A32585E30A58D4ED	1930752	----a-w-	C:\Windows\Sysnative\authui.dll
2013-05-15 18:11:37	22A0AE97360C1B146FDD9AA55AC0E989	197120	----a-w-	C:\Windows\Sysnative\shdocvw.dll
2013-05-15 18:11:37	1BFC94665BCA35F9001ADC7BFB167C63	14172672	----a-w-	C:\Windows\Sysnative\shell32.dll
2013-05-15 18:11:35	E948D1D42DC68923ABD75EEB5BCCD1D3	111448	----a-w-	C:\Windows\Sysnative\consent.exe
2013-05-15 18:11:35	9D2A2369AB4B08A4905FE72DB104498F	70144	----a-w-	C:\Windows\Sysnative\appinfo.dll
2013-05-15 18:11:26	FE90B750AB808FB9DD8FBB428B5FF83B	230400	----a-w-	C:\Windows\Sysnative\wwansvc.dll
2013-05-15 18:11:26	30B1489F2DCD8DC1AB6BB60CA6093615	48640	----a-w-	C:\Windows\Sysnative\wwanprotdim.dll
2013-05-15 18:11:25	A11523523B31086DD760C0189C763359	3153920	----a-w-	C:\Windows\Sysnative\win32k.sys
====== C:\Windows\Sysnative\drivers =====
2013-05-20 18:31:15	0BB97D43299910CBFBA59C461B99B910	25928	----a-w-	C:\Windows\Sysnative\drivers\mbam.sys
2013-05-15 18:11:44	AF2E16242AA723F68F461B6EAE2EAD3D	983400	----a-w-	C:\Windows\Sysnative\drivers\dxgkrnl.sys
2013-05-15 18:11:44	1F04CFB79DD5FB7694468CE3FB3DCC31	265064	----a-w-	C:\Windows\Sysnative\drivers\dxgmms1.sys
2013-04-23 20:10:48	B98F8C6E31CD07B2E6F71F7F648E38C0	1656680	----a-w-	C:\Windows\Sysnative\drivers\ntfs.sys
====== C:\Windows\Tasks ======
====== C:\Windows\Temp ======
======= C:\Program Files =====
2013-05-20 16:51:18	--------	d-----w-	C:\Program Files\DivX
2013-05-02 15:23:13	--------	d-----w-	C:\Program Files\GIMP 2
======= C:\Program Files (x86) =====
2013-05-20 18:27:05	--------	d-----w-	C:\Program Files (x86)\Common Files\Adobe
2013-05-20 18:27:05	--------	d-----w-	C:\Program Files (x86)\Adobe
2013-05-20 16:59:15	--------	d-----w-	C:\Program Files (x86)\XnView
2013-05-20 16:49:39	--------	d-----w-	C:\Program Files (x86)\DivX
2013-05-20 16:49:29	--------	d-----w-	C:\Program Files (x86)\Xvid
2013-05-20 16:49:23	--------	d-----w-	C:\Program Files (x86)\ffdshow
2013-05-20 16:49:23	--------	d-----w-	C:\Program Files (x86)\DirectVobSub
2013-05-20 16:49:22	--------	d-----w-	C:\Program Files (x86)\Haali
2013-05-20 16:49:21	--------	d-----w-	C:\Program Files (x86)\Lame For Audacity
2013-05-20 16:49:21	--------	d-----w-	C:\Program Files (x86)\DSP-worx
2013-05-20 16:49:18	--------	d-----w-	C:\Program Files (x86)\OpenSource Flash Video Splitter
======= C: =====
====== C:\Users\***\AppData\Roaming ======
2013-05-20 19:25:17	--------	d-----w-	C:\users\***\AppData\Roaming\DivX
2013-05-20 18:09:10	--------	d-----w-	C:\users\***\AppData\Local\CrashDumps
2013-05-20 17:00:46	--------	d-----w-	C:\users\***\AppData\Roaming\XnView
2013-05-20 16:49:22	--------	d-----w-	C:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-05-20 16:49:21	--------	d-----w-	C:\users\***\AppData\Roaming\LavFilters
2013-05-20 16:49:21	--------	d-----w-	C:\users\***\AppData\Roaming\CDXReader
2013-05-02 15:41:05	849E2FB247892BA9004970B4B5A12DAE	2532	----a-w-	C:\users\***\AppData\Local\recently-used.xbel
2013-05-02 15:26:15	--------	d-----w-	C:\users\***\AppData\Local\fontconfig
2013-05-02 15:26:13	--------	d-----w-	C:\users\***\AppData\Local\gegl-0.2
====== C:\Users\*** ======
2013-05-20 19:38:20	D41D8CD98F00B204E9800998ECF8427E	0	----a-w-	C:\Users\***\defogger_reenable
2013-05-20 16:59:20	--------	d-----w-	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2013-05-20 16:50:06	--------	d-----w-	C:\Users\***\Qtrax
2013-05-20 16:49:32	--------	d-----w-	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
2013-05-20 16:49:27	--------	d-----w-	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-05-20 16:49:26	--------	d-----w-	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow
2013-05-20 16:49:24	--------	d-----w-	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DirectVobSub
2013-05-20 16:49:23	--------	d-----w-	C:\ProgramData\BrowserProtect
2013-05-20 16:49:20	--------	d-----w-	C:\ProgramData\DivX
2013-05-02 15:26:13	--------	d-----w-	C:\Users\***\.gimp-2.8

====== C: exe-files ==
2013-05-21 17:43:52	C43F0A905657FE5EA8EF0244E692E758	79584	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp\avshadow.exe
2013-05-21 17:43:52	6F2974248B974B6DE037A6C682B59414	248032	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\vista64\avshadow.exe
2013-05-21 17:43:52	64140E3954710DD7CA9F097252E382CA	88288	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\wsctool.exe
2013-05-21 17:43:51	E2CC8FE6056AA1664E9E2628692D1EF9	66336	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\toastNotifier.exe
2013-05-21 17:43:51	D9A92E6DD41C5ADC045AE485026AA40C	86752	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\sched.exe
2013-05-21 17:43:51	CEDE02D7AF62449A2C38C49ABECC0CD3	4995416	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\vcredist_x86.exe
2013-05-21 17:43:51	CDC1D96E03EE475AAB7E82852BE14287	2758368	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\presetup.exe
2013-05-21 17:43:51	C67EBE5C9DA7462D2FF6394979D06EA2	91872	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\setuppending.exe
2013-05-21 17:43:51	8C2C2E5119E844B43085CBC73106754B	597560	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\update.exe
2013-05-21 17:43:51	79AC9425C345302914EC0DEF25C2DA94	764984	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\setup.exe
2013-05-21 17:43:51	715A90A0E5FC7F59DCD4C233ED492F4A	98544	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\licmgr.exe
2013-05-21 17:43:51	22DC787A09D2EC7E3F1138A26C41083C	46960	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\updrgui.exe
2013-05-21 17:43:50	9F5DEC0A6FB856A405567A662F9F3E0D	147512	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\guardgui.exe
2013-05-21 17:43:50	8431C70B4F671C3D95EDBDED05FAE755	456928	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\fact.exe
2013-05-21 17:43:50	7D9DA7DF9535859A4EFC16F69BFE4A8A	83680	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ipmgui.exe
2013-05-21 17:43:50	35A91695EC9BEF89C2C1D4D4FD6D15D7	40808	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\insthlp.exe
2013-05-21 17:43:50	3241F39A04D5A7A27D22761592BE30B4	50032	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\imp64b.exe
2013-05-21 17:43:50	12D4E394014C6A9EFB34D64AE4E64CE0	170864	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\inssda64.exe
2013-05-21 17:43:49	F0096413AD44007EAF651171A625CEE9	181984	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avrestart.exe
2013-05-21 17:43:49	EDAE538F742A20D0E4DBEAD2FA6136F2	58080	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avupgsvc.exe
2013-05-21 17:43:49	ADA0D1407E2C328FB95686E9D5AB88B5	111328	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ccuac.exe
2013-05-21 17:43:49	9EDAE2D1CA368E8D01BEE8BFBC9488E4	562744	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avwebgrd.exe
2013-05-21 17:43:49	66A7A38F7C439153B758548375EB9E5E	110816	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avguard.exe
2013-05-21 17:43:49	5FF8FFD589DA25F43C4FE944A4B2AE0A	775224	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avwebg7.exe
2013-05-21 17:43:49	5A06D4AA070B80464A272D67FCC5D7AF	285408	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avnotify.exe
2013-05-21 17:43:49	366D042446928E2BE7F053766E631D7E	636984	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avscan.exe
2013-05-21 17:43:49	14D4F782EF8E75C0785A093BE10F8FC6	232672	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avwebloader.exe
2013-05-21 17:43:49	14855274B4E742D704909C8F32734BA9	165512	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avwsc.exe
2013-05-21 17:43:49	020D1DB5DFB5E03A35777950463383FF	345312	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avgnt.exe
2013-05-21 17:43:48	DB1774FBEB8E3E2DCD75486B6407D4D9	379200	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\AppRemover_CLI.exe
2013-05-21 17:43:48	B321B1B8BF16F6B3341121D477EFA02A	321856	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\64bitProxy.exe
2013-05-21 17:43:48	AD74CCA501DA08EF395E520D9C258F81	5655248	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ApnToolbarInstaller.exe
2013-05-21 17:43:48	93A912072351DFEF975F12EFAD18BD9F	145096	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ApnStub.exe
2013-05-21 17:43:48	756602CC316F7DB59F6E56E43D1192A6	126416	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\AppRemover_64.exe
2013-05-21 17:43:48	6A510E9EC1684D05CC982636B14754CA	330976	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avcenter.exe
2013-05-21 17:43:48	63A5363103A02C654209E686EAF7F723	84704	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avadmin.exe
2013-05-21 17:43:48	51318B6FD70FEC60B3F51E6C8C6B720D	424504	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\avconfig.exe
2013-05-21 17:40:36	4754539F6D178B84DE28DBCBE7CDA23A	2092792	----a-w-	C:\Users\***\Downloads\avira_free_antivirus.exe
2013-05-20 22:50:12	5051BB40FFB2BA4870C0A059CA03294F	1054720	----a-w-	C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-20 22:50:11	AAD90795E84E710543C6C7C2F7048E30	770608	----a-w-	C:\Program Files (x86)\Internet Explorer\iexplore.exe
2013-05-20 22:50:11	9D6BD7D1EE59B6D0FD65F1A6DF5706F9	137216	----a-w-	C:\Windows\SysWOW64\ieUnatt.exe
2013-05-20 22:50:11	6DF2C6438CFF6EFCBBB88AEE01795501	73728	----a-w-	C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-20 22:50:11	5915AA67DECA289F7B4AFB686CDB09E9	71680	----a-w-	C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-20 22:50:11	56E51C26745FF7413514EA4DDF33BC6C	11776	----a-w-	C:\Windows\SysWOW64\msfeedssync.exe
2013-05-20 22:50:11	5397E32E882C0148CEC13D9EACFB7157	222208	----a-w-	C:\Program Files (x86)\Internet Explorer\ielowutil.exe
2013-05-20 22:50:11	52A7D73D5570F757D865DDECD087FB41	138752	----a-w-	C:\Windows\SysWOW64\wextract.exe
2013-05-20 22:50:11	3AB2A38F7EA9E62D176A78FB58761E24	12800	----a-w-	C:\Windows\SysWOW64\mshta.exe
2013-05-20 22:50:11	3090B888E263E56744F8BFEF3A36D67D	467456	----a-w-	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
2013-05-20 22:50:11	15CCEAC53648FF7C17AE98923BCD3D75	24576	----a-w-	C:\Program Files (x86)\Internet Explorer\ExtExport.exe
2013-05-20 22:50:11	038F76279EC64878A072D988DE13C7B2	150528	----a-w-	C:\Windows\SysWOW64\iexpress.exe
2013-05-20 22:50:10	F651D95B5043EFC20A6108A853553984	92160	----a-w-	C:\Windows\System32\SetIEInstalledDate.exe
2013-05-20 22:50:10	D9C10A4A0B3411146E6FC8936B079934	167424	----a-w-	C:\Windows\System32\iexpress.exe
2013-05-20 22:50:10	D57BCCD989555B0D6E47AE0F364DD4D3	327680	----a-w-	C:\Program Files\Internet Explorer\iediagcmd.exe
2013-05-20 22:50:10	CEA304830B4770BDA3572B87D0841848	775232	----a-w-	C:\Program Files\Internet Explorer\iexplore.exe
2013-05-20 22:50:10	A197763AA7487807279AB61CD6835CEF	89600	----a-w-	C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-20 22:50:10	82D602EBBBA6D08E4691F32269FD3494	12800	----a-w-	C:\Windows\System32\msfeedssync.exe
2013-05-20 22:50:10	658E8FEC79A4AB5BFDE032627B5C9667	13824	----a-w-	C:\Windows\System32\mshta.exe
2013-05-20 22:50:10	4BA4770D890B320DAB575B07C7DAF59D	481280	----a-w-	C:\Program Files\Internet Explorer\ieinstal.exe
2013-05-20 22:50:10	42758AF68D3C4912C8D8A18088AD2555	51712	----a-w-	C:\Windows\System32\ie4uinit.exe
2013-05-20 22:50:10	40738329209CBE2C9B48F7E30F7C1414	144896	----a-w-	C:\Windows\System32\wextract.exe
2013-05-20 22:50:10	31E219322B8D765F9F84B80D1D92A07F	173568	----a-w-	C:\Windows\System32\ieUnatt.exe
2013-05-20 22:50:10	05277EDA27E5A55CA22AC37DAC47DD23	223744	----a-w-	C:\Program Files\Internet Explorer\ielowutil.exe
2013-05-20 20:03:29	60BF4AE8CC40B0E3E28613657ED2EED8	377856	----a-w-	C:\Users\***\Downloads\gmer_2.1.19163.exe
2013-05-20 19:38:49	4ADCFEE16EE9978F06157634669D36FB	602112	----a-w-	C:\Users\***\Downloads\OTL.exe
2013-05-20 19:37:52	9146F21288AB749C4C729343F5F285A1	50477	----a-w-	C:\Users\***\Downloads\Defogger (1).exe
2013-05-20 19:35:51	9146F21288AB749C4C729343F5F285A1	50477	----a-w-	C:\Users\***\Downloads\Defogger.exe
2013-05-20 19:28:44	33AD5A2D8955C9CC536E2863D9180224	1180013	----a-w-	C:\Program Files (x86)\ffdshow\unins000.exe
2013-05-20 19:28:30	3B9DBE8B7D889A38A39FB939552755F8	715085	----a-w-	C:\Program Files (x86)\DirectVobSub\unins000.exe
2013-05-20 19:28:30	10D2E750A8C68B5154CB8400D9BC3EBE	715038	----a-w-	C:\Program Files (x86)\Lame For Audacity\unins000.exe
2013-05-20 19:28:28	DDC0B6672AB7862A3C2D7AA2ADB6B645	715038	----a-w-	C:\Windows\unins000.exe
2013-05-20 19:26:17	10026EC8187DAC21938CC1729369D675	774080	----a-w-	C:\Users\***\Downloads\CodecPack (2).exe
2013-05-20 19:19:54	30EB31C1AD345B71A2DAF434873A2FD1	774080	----a-w-	C:\Users\***\Downloads\CodecPack (1).exe
2013-05-20 18:30:27	683FDD3D773C58B262DC07CD0C6CE938	10285040	----a-w-	C:\Users\***\Downloads\mbam-setup-1.75.0.1300.exe
2013-05-20 18:18:38	1D19DA53D020DC945DA3DFC188ABA2D8	544	----a-w-	C:\$RECYCLE.BIN\S-1-5-21-2366262021-3429744855-3110590674-1000\$IA7ZJSB.exe
2013-05-20 18:03:40	08617BD95E77E5DB23A989145688B7FD	272308984	----a-w-	C:\Users\***\Downloads\rescue_system-common-en.exe
2013-05-20 16:59:18	AB5474FCA337E683F7EC217DC082672D	200704	----a-w-	C:\Program Files (x86)\XnView\PlugIns\slide.exe
2013-05-20 16:59:18	4F5CA907D9B9D760528BF30DBA85BA47	143419	----a-w-	C:\Program Files (x86)\XnView\PlugIns\jbig2dec.exe
2013-05-20 16:59:18	1CEBE266557C996AF0D4FDD393BA5468	1937392	----a-w-	C:\Program Files (x86)\XnView\nconvert.exe
2013-05-20 16:59:17	3AFCC2F33497E7BA46F4012BBEDA0D75	870112	----a-w-	C:\Program Files (x86)\XnView\PlugIns\CS_Manager.exe
2013-05-20 16:59:16	05C673DE53B2D220A4C9CB289D716F2C	38912	----a-w-	C:\Program Files (x86)\XnView\AddOn\pngout.exe
2013-05-20 16:59:15	E2124BCE1550026C1C471F3C42EFD495	737304	----a-w-	C:\Program Files (x86)\XnView\unins000.exe
2013-05-20 16:59:15	31F28B0095B33CF04F9730763DAE2D6B	4964336	----a-w-	C:\Program Files (x86)\XnView\xnview.exe
2013-05-20 16:57:28	2B5F9FB1F00B226560AD5CB125F524E9	15186280	----a-w-	C:\Users\***\Downloads\XnView-win-full_2.00.exe
2013-05-20 16:52:15	145945C46A622D57DD59B12EA4957F69	932704	----a-w-	C:\ProgramData\DivX\Setup\DivXSetup.exe
2013-05-20 16:51:14	6471E1784FD88B122303A11793FA0841	232936	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJD9U2M1\Installer[6].exe
2013-05-20 16:51:13	E4C709108193E5D5609CDB57373D16E3	183752	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5C9KZLX\Installer[6].exe
2013-05-20 16:50:50	E484CE83125EC6437E76A1E13293EAD3	16041920	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YPRULX1F\Installer[6].exe
2013-05-20 16:50:50	524D9BAF0E6FB04675BAA5B7EE14E5EE	287744	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TG19G3V5\Installer[5].exe
2013-05-20 16:50:37	043DD02277290E4F9A527CA25DCCC804	7767200	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJD9U2M1\Installer[5].exe
2013-05-20 16:50:32	A5EA5EDD13B14018411B151A38E7BEF1	3056296	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5C9KZLX\Installer[5].exe
2013-05-20 16:50:30	F33760E6692D421C651D84626191E4A3	1473904	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YPRULX1F\Installer[5].exe
2013-05-20 16:50:27	CE1BACB38075D6D60EBE776E67341D70	293272	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJD9U2M1\Installer[4].exe
2013-05-20 16:50:27	24D2269A5BA9CE33809856C8A0E927E4	2460872	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TG19G3V5\Installer[4].exe
2013-05-20 16:50:26	2C459EE7461E287E3CFDD35794E2686F	699504	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5C9KZLX\Installer[4].exe
2013-05-20 16:50:25	0CC8B85146C7B6C0167D7D759AC69AE2	510080	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YPRULX1F\Installer[4].exe
2013-05-20 16:50:24	C9B74856CB5A407F85624E7A1750F0E1	340216	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TG19G3V5\Installer[3].exe
2013-05-20 16:50:24	61CFF6C69825AD397E0E8999D1657A35	293520	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5C9KZLX\Installer[3].exe
2013-05-20 16:50:24	1BDFF567304BE2819539DCF4C08A9D33	77344	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJD9U2M1\Installer[3].exe
2013-05-20 16:50:23	A17276821249C751C8DAE93AA8EA5081	632904	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YPRULX1F\Installer[3].exe
2013-05-20 16:50:20	9D612D7BAC9E379CB7D2793771FA336C	2034224	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TG19G3V5\Installer[2].exe
2013-05-20 16:50:01	DB1350BC93FC049313DEF93659683283	13518048	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJD9U2M1\Installer[2].exe
2013-05-20 16:50:00	ECF5451451A81CCD22DFE71142B259D4	420304	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YPRULX1F\Installer[2].exe
2013-05-20 16:50:00	7C9912383F37E4DD988A9C7E173D8590	201456	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5C9KZLX\Installer[2].exe
2013-05-20 16:49:45	EDB8927A9C860E154354E9F478C51D31	10655680	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TG19G3V5\Installer[1].exe
2013-05-20 16:49:43	3A43406E0BD522158E74D19F664DCFD3	973536	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJD9U2M1\Installer[1].exe
2013-05-20 16:49:41	C48A935B48D420751FD54F2F86E24B91	1352000	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5C9KZLX\Installer[1].exe
2013-05-20 16:49:40	B3AC5B514760865241C2CB889B919104	952184	----a-w-	C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YPRULX1F\Installer[1].exe
2013-05-20 16:49:38	BCBBE5230ADF3E7E1470D40B1CD17A14	18711176	----a-w-	C:\$RECYCLE.BIN\S-1-5-21-2366262021-3429744855-3110590674-1000\$RA7ZJSB.exe
2013-05-20 16:49:34	D9C8DC2D7EC28E3FF25C99EF17C8631A	2787280	----a-w-	C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
2013-05-20 16:49:33	4EA4DB3630F7E033B2F94A2FD7B424CE	42297	----a-w-	C:\Program Files (x86)\Haali\MatroskaSplitter\uninstall.exe
2013-05-20 16:49:32	85A5CD76C363F7D8AF8CDFC24F16ED4C	3537327	----a-w-	C:\Program Files (x86)\Xvid\uninstall.exe
2013-05-20 16:49:30	C39AD6299E0E1F7AA3F5B51AC9B5CD0E	6144	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\AviC.exe
2013-05-20 16:49:30	C39AD6299E0E1F7AA3F5B51AC9B5CD0E	6144	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\AviC.exe
2013-05-20 16:49:30	C39AD6299E0E1F7AA3F5B51AC9B5CD0E	6144	----a-w-	C:\Program Files (x86)\Xvid\AviC.exe
2013-05-20 16:49:30	B9B5C142C75E7E2A95E7E958CF6EAB3A	6150331	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\autoupdate-windows.exe
2013-05-20 16:49:30	B9B5C142C75E7E2A95E7E958CF6EAB3A	6150331	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\autoupdate-windows.exe
2013-05-20 16:49:30	B9B5C142C75E7E2A95E7E958CF6EAB3A	6150331	----a-w-	C:\Program Files (x86)\Xvid\autoupdate-windows.exe
2013-05-20 16:49:30	95CAEF9DA6E9AEE1ECD627527CFA0F38	9216	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\OGMCalc.exe
2013-05-20 16:49:30	95CAEF9DA6E9AEE1ECD627527CFA0F38	9216	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\OGMCalc.exe
2013-05-20 16:49:30	95CAEF9DA6E9AEE1ECD627527CFA0F38	9216	----a-w-	C:\Program Files (x86)\Xvid\OGMCalc.exe
2013-05-20 16:49:30	7CE40A557359849EA374E0E4DDE52E26	23040	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\MiniCalc.exe
2013-05-20 16:49:30	7CE40A557359849EA374E0E4DDE52E26	23040	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\MiniCalc.exe
2013-05-20 16:49:30	7CE40A557359849EA374E0E4DDE52E26	23040	----a-w-	C:\Program Files (x86)\Xvid\MiniCalc.exe
2013-05-20 16:49:30	6D9E1356A9C1B5F36698FAFF9205E34A	8192	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\CheckUpdate.exe
2013-05-20 16:49:30	6D9E1356A9C1B5F36698FAFF9205E34A	8192	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\CheckUpdate.exe
2013-05-20 16:49:30	6D9E1356A9C1B5F36698FAFF9205E34A	8192	----a-w-	C:\Program Files (x86)\Xvid\CheckUpdate.exe
2013-05-20 16:49:30	487AF46145B81C5BC54873E764F93636	13824	----a-w-	C:\Program Files (x86)\Xvid\StatsReader.exe
2013-05-20 16:49:30	487AF46145B81C5BC54873E764F93636	13824	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\StatsReader.exe
2013-05-20 16:49:30	487AF46145B81C5BC54873E764F93636	13824	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\StatsReader.exe
2013-05-20 16:49:29	FA31E5F1D353649141D3C78278DD7579	166912	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\MiniConvert.exe
2013-05-20 16:49:29	FA31E5F1D353649141D3C78278DD7579	166912	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\MiniConvert.exe
2013-05-20 16:49:29	FA31E5F1D353649141D3C78278DD7579	166912	----a-w-	C:\Program Files (x86)\Xvid\MiniConvert.exe
2013-05-20 16:49:29	6AD766E0133C15132877FE64A50D3EBC	144384	----a-w-	C:\Program Files (x86)\Xvid\xvid_encraw.exe
2013-05-20 16:49:29	6AD766E0133C15132877FE64A50D3EBC	144384	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\xvid_encraw.exe
2013-05-20 16:49:29	6AD766E0133C15132877FE64A50D3EBC	144384	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\xvid_encraw.exe
2013-05-20 16:49:28	D9C8DC2D7EC28E3FF25C99EF17C8631A	2787280	----a-w-	C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
2013-05-20 16:49:22	D5DF15FEF6FE8CAC8F28F0B3B1806144	61564	----a-w-	C:\Program Files (x86)\DSP-worx\DC-Bass Source\Uninstall.exe
2013-05-20 16:49:22	3D77B4125F1F50AC17B2F26D69945274	475648	----a-w-	C:\Program Files (x86)\Lame For Audacity\lame.exe
2013-05-20 16:49:18	AFF5265F0BBF32E460F8CDE4DF367A7F	34626	----a-w-	C:\Program Files (x86)\OpenSource Flash Video Splitter\uninst.exe
2013-05-20 16:47:53	F3B0C98896F84228251E10D1890AC8B4	774080	----a-w-	C:\Users\***\Downloads\CodecPack.exe
2013-05-20 12:59:10	0E8F2F37A37C95DF90D462C93A648B0E	1769152	----a-w-	C:\Users\***\AppData\Local\Temp\6F103A1A-BAB0-7891-ABB3-342675CDD1B6\Latest\MyBabylonTB.exe
2013-05-20 07:38:34	89505DACB8B6A97A448F3409DAB18BCD	395248	----a-w-	C:\Users\***\AppData\Local\Temp\6F103A1A-BAB0-7891-ABB3-342675CDD1B6\Latest\GUninstaller.exe
2013-05-15 18:33:25	C26BB2535C1B20DEAFAEB12634BF4DC9	781592	----a-w-	C:\Users\***\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateSetup.exe
2013-05-15 18:33:25	8F11F0321ED84B1533FC1384AC71AC8D	59784	----atw-	C:\Users\***\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateBroker.exe
2013-05-15 18:33:25	00F714CA28A01FACB709486D6DA306A8	59784	----atw-	C:\Users\***\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateOnDemand.exe
2013-05-15 18:33:19	76B35CB0F3A4E69D6DFF27F542B9F856	216968	----atw-	C:\Users\***\AppData\Local\Google\Update\1.3.21.145\GoogleCrashHandler.exe
2013-05-15 18:33:19	506708142BC63DABA64F2D3AD1DCD5BF	116648	----atw-	C:\Users\***\AppData\Local\Google\Update\1.3.21.145\GoogleUpdate.exe
2013-05-15 18:33:19	4E252E85E5DC31BD645E809222AFAF27	287624	----atw-	C:\Users\***\AppData\Local\Google\Update\1.3.21.145\GoogleCrashHandler64.exe
2013-05-15 18:33:18	C26BB2535C1B20DEAFAEB12634BF4DC9	781592	----a-w-	C:\Users\***\AppData\Local\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.21.145\GoogleUpdateSetup.exe
2013-05-15 18:11:35	E948D1D42DC68923ABD75EEB5BCCD1D3	111448	----a-w-	C:\Windows\System32\consent.exe
=== C: other files ==
2013-05-21 17:43:52	F9C2939AF32A7D4868DA1EAD1390AD39	66656	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win8\avnetflt.sys
2013-05-21 17:43:52	D50FBA68163BC498F2C136E0E5BA8E2F	135136	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp\avipbb.sys
2013-05-21 17:43:52	CB8741CD7B126499FED40C9B197F6AC5	37352	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp\avkmgr.sys
2013-05-21 17:43:52	9999869ADA8EE3DED96947B2A385EDF3	83160	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win864\avnetflt.sys
2013-05-21 17:43:52	87425709A251386064C99B684BF96F72	84744	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp\avgntflt.sys
2013-05-21 17:43:52	751EFA9A72105EC4F980CB1923C7BCCF	66656	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win7\avnetflt.sys
2013-05-21 17:43:52	4BDDB42CB6BF46452FA7155EA5381576	83160	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win764\avnetflt.sys
2013-05-21 17:43:52	490FA25161BF3E51993EB724ECF0ACEB	28600	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp64\avkmgr.sys
2013-05-21 17:43:52	490FA25161BF3E51993EB724ECF0ACEB	28600	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win864\avkmgr.sys
2013-05-21 17:43:52	490FA25161BF3E51993EB724ECF0ACEB	28600	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\vista64\avkmgr.sys
2013-05-21 17:43:52	488486DAD09A5B6C6DBB8B990A8B2307	130016	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp64\avipbb.sys
2013-05-21 17:43:52	488486DAD09A5B6C6DBB8B990A8B2307	130016	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win864\avipbb.sys
2013-05-21 17:43:52	488486DAD09A5B6C6DBB8B990A8B2307	130016	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\vista64\avipbb.sys
2013-05-21 17:43:52	09E6069EF94B345061B4BD3CEBD974C8	100712	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\xp64\avgntflt.sys
2013-05-21 17:43:52	09E6069EF94B345061B4BD3CEBD974C8	100712	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\win864\avgntflt.sys
2013-05-21 17:43:51	E274C96E2175C7DF97DCB255E406A900	1478	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ProductReleaseNotes.zip
2013-05-21 17:43:51	A36EE93698802CD899F98BFD553D8185	28520	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ssmdrv.sys
2013-05-21 17:43:51	7B9BBBDBCBBF2B3F347037DE5538367B	2453117	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\ManualUninstallConfig.zip
2013-05-21 17:43:51	516B8C03BBBDACF1E655303219E84E69	11371	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\QATestedProducts.zip
2013-05-21 17:43:51	09E6069EF94B345061B4BD3CEBD974C8	100712	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\vista64\avgntflt.sys
2013-05-21 17:43:50	E310FCBA8884EEBD9017C3D01B6D0BCF	100680	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\de-de\sweb.zip
2013-05-21 17:43:49	2BFC29F303019878349248A2FB75FC2E	27044	----a-w-	C:\Windows\Temp\AVSETUP_519bb254\AVSDKList.zip
2013-05-20 18:31:15	0BB97D43299910CBFBA59C461B99B910	25928	----a-w-	C:\Windows\System32\drivers\mbam.sys
2013-05-20 16:50:13	E2FE0500427A8E892A034A20A850C58D	150	----a-w-	C:\Users\***\AppData\LocalLow\Microsoft\Silverlight\OutOfBrowser\index\portal.qtrax.com
2013-05-20 16:50:12	3467E7ED6970663F5ED01710D717A79A	246	----a-w-	C:\Users\***\Qtrax\Player\temp.bat
2013-05-20 16:49:30	F0176ACEBF968B6F6DF8743C26258D0F	2967	----a-w-	C:\Program Files (x86)\Xvid\Xvid_Quant_Matrices.zip
2013-05-20 16:49:30	F0176ACEBF968B6F6DF8743C26258D0F	2967	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory1\C\Program Files (x86)\Xvid\Xvid_Quant_Matrices.zip
2013-05-20 16:49:30	F0176ACEBF968B6F6DF8743C26258D0F	2967	----a-w-	C:\Program Files (x86)\Xvid\rollbackBackupDirectory\C\Program Files (x86)\Xvid\Xvid_Quant_Matrices.zip
2013-05-20 16:49:22	A68D2841F69D19C8B5E73DF72B090482	42	----a-w-	C:\Users\***\AppData\Roaming\LavFilters\install_audio.bat
2013-05-20 16:49:22	837B6A02B10F2AEA2F9995CBC8BA9D69	42	----a-w-	C:\Users\***\AppData\Roaming\LavFilters\install_video.bat
2013-05-20 16:49:22	812239ED42BE242DFA021C54AAA2FBE3	42	----a-w-	C:\Users\***\AppData\Roaming\LavFilters\uninstall_video.bat
2013-05-20 16:49:22	3B8D9245C90B82535C218EFD563E1851	42	----a-w-	C:\Users\***\AppData\Roaming\LavFilters\uninstall_audio.bat
2013-05-20 16:49:22	188026412D1AC9AD4C9B132791D87E48	45	----a-w-	C:\Users\***\AppData\Roaming\LavFilters\uninstall_splitter.bat
2013-05-20 16:49:22	179F7AA6CFEED6A865ABD9926552A82E	45	----a-w-	C:\Users\***\AppData\Roaming\LavFilters\install_splitter.bat
2013-05-15 18:11:44	AF2E16242AA723F68F461B6EAE2EAD3D	983400	----a-w-	C:\Windows\System32\drivers\dxgkrnl.sys
2013-05-15 18:11:44	1F04CFB79DD5FB7694468CE3FB3DCC31	265064	----a-w-	C:\Windows\System32\drivers\dxgmms1.sys
2013-05-15 18:11:25	A11523523B31086DD760C0189C763359	3153920	----a-w-	C:\Windows\System32\win32k.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-2366262021-3429744855-3110590674-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"Google Update"="C:\Users\***\AppData\Local\Google\Update\GoogleUpdate.exe /c"
"RESTART_STICKY_NOTES"="C:\Windows\System32\StikyNot.exe"
"GoogleChromeAutoLaunch_695ED7311A5ACE24E055F47B43C91B38"="C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe --no-startup-window"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndicatorUtility"="C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe"
"snp2uvc"="C:\Windows\vsnp2uvc.exe"
"AIS_RegApp"="C:\Program Files (x86)\Fujitsu\AIS Connect\regapp\RegApp.exe"
"UCam_Menu"="C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\CyberLink\YouCam UpdateWithCreateOnce Software\CyberLink\YouCam\3.0"
"YouCam Mirror Tray icon"="C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe /s"
"Garmin Lifetime Updater"="C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized"
"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"
"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"DivXMediaServer"="C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe"
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AVSetupPending"="C:\Windows\TEMP\AVSETUP_519bb254\SetupPending.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"Google Update"="C:\Users\***\AppData\Local\Google\Update\GoogleUpdate.exe /c"
"RESTART_STICKY_NOTES"="C:\Windows\System32\StikyNot.exe"
"GoogleChromeAutoLaunch_695ED7311A5ACE24E055F47B43C91B38"="C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe --no-startup-window"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BTMTrayAgent"="rundll32.exe C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll,TrayApp"
"LoadFUJ02E3"="C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe"
"FDM7"="C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe"
"PSUTility"="C:\Program Files\Fujitsu\PSUtility\TrayManager.exe"
"PfNet"="C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe /r"
"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe"
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe"
"Persistence"="C:\WINDOWS\system32\igfxpers.exe"
"IntelWireless"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe /tf Intel Wireless Tray"
"snp2uvc"="C:\Windows\vsnp2uvc.exe"
"LoadFujitsuQuickTouch"="C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe"
"LoadBtnHnd"="C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe"
"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe "

==== Startup Folders ======================

2012-01-21 03:41:57	1105	----a-w-	C:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk
2012-01-21 03:38:21	2041	----a-w-	C:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk
2012-01-21 03:41:57	1105	----a-w-	C:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk
2012-01-21 03:38:21	2041	----a-w-	C:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk
2012-11-13 11:14:20	1221	----a-w-	C:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:6C:\ProgramC:FilesC:x86\Google\Update\GoogleUpdate.exe []
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [20.01.2012 21:43]
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2366262021-3429744855-3110590674-1000Core.job --a------ C:\Users\***\AppData\Local\Google\Update\GoogleUpdate.exe [20.01.2012 21:49]
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2366262021-3429744855-3110590674-1000UA.job --a------ C:\Users\***\AppData\Local\Google\Update\GoogleUpdate.exe [20.01.2012 21:49]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
eooncjejnppfjjklapaamhcdmjbilmde - C:\Users\***\AppData\Roaming\BabSolution\CR\Delta.crx[]
gnbcopcndefcccgdofjadnafjljgofam - C:\Program Files (x86)\LyricsFinder\Chrome.crx[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
nikpibnbobmbdbheedjfogjlikpgpnhp - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx[12.12.2012 19:51]

Context - *** - Default\Extensions\aalnjolghjkkogicompabhhbbkljnlka
YouTube - *** - Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - *** - Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Delta Toolbar - *** - Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde
Lyrics Finder - *** - Default\Extensions\gnbcopcndefcccgdofjadnafjljgofam
SearchPreview - *** - Default\Extensions\hcjdanpjacpeeppdjkppebobilhaglfo
Purple flowers - *** - Default\Extensions\kgplpejojljhgndghinonhjpmbdmjamk
DVDVideoSoft Browser Extension - *** - Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Gmail - *** - Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chrome Fix ======================

C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde deleted successfully
C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnbcopcndefcccgdofjadnafjljgofam deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www1.delta-search.com/?affID=119357&tt=gc_190513_215&babsrc=HP_ss&mntrId=9C42AC72897C590D"
"Default_Page_URL"="hxxp://ts.fujitsu.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{96522675-C420-4DD3-826A-82602BEBCF9A}"
{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} Delta Search Url="hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_190513_215&babsrc=SP_ss&mntrId=9C42AC72897C590D"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{96522675-C420-4DD3-826A-82602BEBCF9A} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSG_deDE467"

==== Deleting CLSID Registry Keys ======================

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{398C01F1-E584-46AD-A649-4F78B435DCFE} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{398C01F1-E584-46AD-A649-4F78B435DCFE} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} deleted successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\gnbcopcndefcccgdofjadnafjljgofam deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\***\AppData\Local\Temp\OICE_1E334E04-FA59-4C1D-A78E-17E5031A8AE9.0\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\***\AppData\Local\Temp\OICE_2D100526-9EA3-4159-891D-06C8604FB88F.0\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\***\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\users\***\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\users\***\AppData\Local\Google\Chrome\User Data\Default\Application Cache\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\***\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.settings"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22"  not found
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23"  not found
"C:\ProgramData\BrowserProtect"  not found

==== EOF on 21.05.2013 at 20:14:23,60 ======================
         

Meine Meinung nach muss es jetzt schon einige Verbesserung zu spüren sein

• Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen.
• Starte die Zoek.exe mit einem Doppelklick (nur Windows XP-Benutzer).
• Windows Vista/7 Benutzer starten das Tool bitte per Rechtsklick auf das Icon und wählen "Als Administrator starten".
• Kopiere untenstehende Code in das Textfeld:
  

  chrdefaults;
           

• Nun klicke auf "Run script" und warte geduldig, bis der Scan durchgelaufen ist.
• Wenn das Tool fertig ist, wird sich Notepad mit dem Logfile öffnen (ggfs. erst nach einem Neustart).
  Nachträglich kannst Du den Bericht unter c:\zoek-results.log einsehen.
• Poste mir das Log File zoek-results.log

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Hallo,
ich konnte tatsächlich ein Verbesserung feststellen. Super=)
hier die Log-File:

Zoek.exe Version 4.0.0.2 Updated 21-May-2013
Tool run by *** on 21.05.2013 at 21:54:31,49.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected

==== Older Logs ======================

C:\zoek-results21.05.2013-2014.log	65026 bytes

==== Reset Google Chrome ======================

C:\users\***\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\users\***\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== EOF on 21.05.2013 at 21:55:11,76 ======================
         

und die von Adw-Cleaner:

AdwCleaner Logfile:

# AdwCleaner v2.301 - Datei am 21/05/2013 um 22:00:53 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : *** - ***-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\***\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Users\***\AppData\Roaming\dvdvideosoftiehelpers

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\5255dadbe739ed40
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltadskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltadskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.deltaESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.deltaESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5255dadbe739ed40
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v27.0.1453.93

Datei : C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [7105 octets] - [21/05/2013 22:00:53]

########## EOF - C:\AdwCleaner[S1].txt - [7165 octets] ##########
         

--- --- ---

Es sieht schon wieder ziemlich sauber aus

Ich bin gespannt ob der nächsten Scan noch etwas findet:

Lade das Setup des ESET Online Scanners herunter und speichere es auf den Desktop.

• Schliesse evtl. vorhandene externe Festplatten und USB-Sticks an den Rechner an.
• Deaktiviere jetzt temporär für diesen Scan dein Antivirenprogramm und die Firewall.
  (Danach nicht vergessen, sie wieder einzuschalten.)
• Starte nun die heruntergeladene esetsmartinstaller_enu.exe.
• Setze den Haken bei Yes, I accept the Terms of Use und drücke Start.
• Warte bis die Komponenten heruntergeladen sind.
• Setze den Haken bei Scan archives.
• Gehe sicher, dass bei Remove found Threats kein Haken gesetzt ist.
• Drücke dann auf Start.
• Die Signaturen werden heruntergeladen und der Scan startet automatisch.
  Hinweis: Dieser Scan kann unter Umständen ziemlich lange dauern!
• Falls nach Beendigung des Scans Funde angezeigt werden, dann:
  • Drücke auf List of found threats.
  • Klicke dann auf Export to text file... und speichere die Textdatei als ESET.txt auf den Desktop.
  • Drücke danach auf << Back.
• Schliesse nun den Scanner mit einem Klick auf Finish.

Poste bitte den Inhalt der ESET.txt oder teile mir mit, wenn es keine Funde gegeben hat.

Der Scan kann sehr lange (einige Stunden) dauern!


Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Hallo Smeenk,
ich habe das Gefühl, dass tatsächlich wieder alles beim "Alten" ist. Die nervige Werbung erscheint nicht mehr und die Internetverbindung ist wieder wie gewohnt im alten Tempo. :-)
Es konnten keine weiteren Funde nach dem ESET Online Scan festgestellt werden. Nach dem Security Check habe ich folgende Datei erhalten:

  Results of screen317's Security Check version 0.99.63  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 9  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Adobe Reader XI  
 Google Chrome 26.0.1410.64  
 Google Chrome 27.0.1453.93  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

Also ich bin echt wahnsinnig überrascht, dass die ganze "Aufräumaktion" so schnell und problemlos und so einfach ablief, das hätte ich wirklich nicht gedacht. Vielen, lieben Dank für deine schnelle Hilfe!!!! =) Danke, danke, danke!!! =)

Liebe Grüße,
Emisch

Wir helfen Dir gerne hier auf Trojaner-Board

Diese letzte Log sieht auch Prima aus

Wir räumen jetzt noch ein wenig auf und dann habe ich am Ende etwas Lesestoff für dich.


Tools deinstallieren

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: jetzt auf re-enable klicken.
2. Downloade Dir bitte auf jeden Fall delfix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.
3. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Abschließend noch Tipps zu folgenden Themen:

• Systemupdates
• Softwareupdates
• Sicherheitssoftware
• Sicheres Surfen

Lesestoff:
Systemupdates
Man kann es gar nicht oft genug erwähnen, wie wichtig es ist, sein System aktuell zu halten. Dein Auto bringst du ja auch regelmässig zur Inspektion in die Werkstatt. Stelle also bitte sicher, dass die Systemupdates aktiviert sind:

• Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt:
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.

Lesestoff:
Softwareupdates
Ebenso wichtig wie die Systemprogramme ist auch die Software, die du täglich nutzt. Die folgende Liste gibt dir einen kleinen Überblick mit Links zu den Updates, welche Programme dringend aktuell gehalten werden müssen (falls du sie überhaupt installiert hast und nutzt), weil durch deren Sicherheitslücken oft Malware auf die Computer gelangen kann:

• Adobe Reader (Adobe - Adobe Reader herunterladen - Alle Versionen => Kein Haken bei "Ja, McAfee ...")
• Flash Plugin (Adobe - Adobe Flash Player installieren => Kein Haken bei "Ja, McAfee ...")
• Java (Download der kostenlosen Java-Software -> Kein Haken für die ASK-Toolbar während der Installation)
• Dein Browser inklusive aller Add-Ons. Das Trojaner-Board bietet dir auch einen Browser-Check.

Auch nicht gelistete Programme sind natürlich wichtig. Ob es für diese eine neue Version gibt, kannst du auf deren Herstellerwebseite oder ganz bequem mit diesen Tools überprüfen:

• Secunia Online Software
• FileHippo-Update-Checker

Lesestoff:
Sicherheitssoftware
Würde dich jemand nackt auf dem Motorrad auf der Autobahn überholen würdest du auch den Kopf schütteln. Dein Computer braucht auch einen Schutz vor den täglichen kleinen Angriffen durch Schädlinge. Neben hervorragenden kommerziellen Anti-Viren-Lösungen gibt es auch durchaus gute Schutzprogramme, die kostenfrei mit reduziertem Funktionsumfang erhältlich sind. Aber vorsicht, hier gilt nicht "je mehr desto besser". Was du brauchst ist genau einen Virenscanner mit Hintergrundwächter. Nicht mehr und nicht weniger. Es gibt hier viele Produkte auf dem Markt, die einem gute Dienste leisten. Ich persönlich empfehle dir Avast Free Antivirus. Es bietet relativ guten Schutz, bei wenig nerviger Werbung und installiert dir ein Browserplugin, das dich vor gefährlichen Webseiten warnt.

• Wenn du deine Antivirenlösung wechseln solltest, findest du hier Tools mit denen du die Überreste nach der Deinstallation deines alten Scanners entfernen kannst.
• Installiere niemals mehr als einen Virenscanner. Deren Hintergrundwächter würden sich gegenseitig behindern und dein System ausbremsen.
• Ein Browserplugin, das dich vor betrügerischen Webseiten schützt, kann dir gute Dienste leisten, wenn du dich nicht gut auskennst (siehe oben).
• Sorge dafür, dass deine Sicherheitslösung ständig up-to-date ist und sich automatisch Updates besorgt. Wenn du auf manuelle Updates setzt bist du meistens zu spät, da die Virendatenbanken oft täglich sogar mehrfach erneuert werden.
• Einen zusätzlichen Schutz (und dieser wäre auch erlaubt) bietet ein spezieller Malwarescanner. Hier empfehle ich dir dringend Malwarebytes und einmal wöchentlich damit zu scannen. In der kostenpflichtigen Version hat es sogar einen Hintergrundwächter. Hierfür haben wir eine Anleitung für dich.

Zuletzt empfehle ich dir deine Daten regelmässig (am besten automatisch) zu sichern. Dies kann eine professionelle Backuplösung, externe Festplatten, Brennen auf DVDs oder Überspielen auf ein Online-Laufwerk wie z.B. Dropbox sein. Erzeuge so viele Kopien wie möglich und halte sie aktuell. Nur so bist du auf den schlimmsten Fall vorbereitet, wenn dein Computer - wodurch auch immer - unbrauchbar werden sollte. Leider passiert das ja immer unangekündigt und immer dann wenn man ihn am Nötigsten braucht. Also sorge vor!

Lesestoff:
Sicheres Surfen
Zunächst muss man sagen, dass es üblicherweise immer der menschliche Faktor ist, der es Malware ermöglicht auf einen Computer zu gelangen. Kaufst du Leuten, die an deiner Haustür klingeln, auch sofort ohne nachzudenken irgendwelches Zeug ab? Gewöhne dir daher zunächst einige Verhaltensregeln beim Surfen im Internet an:

• Klicke nicht irgendwo hin, nur weil es bunt ist und leuchtet, in einer Ecke aufpoppt oder so aussieht, als wäre es eine Systemmeldung.
• Lade dir keine illegale Software, keine Cracks, keine Keygens, keine Gametrainer usw ... die Webseiten, die so etwas anbieten, sind meist nicht seriös und die angeblichen Helfer sind meist verseuchter als du es dir ausmalen würdest. Es spielt dabei keine Rolle, ob du diese Dateien über einen Browser oder Filesharingprogramme beziehst.
• Öffne keine Emailanhänge von Leuten, die du nicht kennst, Emails mit seltsamen Rechtschreibfehlern oder starte Dateien, die dir eine Webseite anbietet, ohne dass du sie wolltest.
• Lasse niemand an deinem Computer surfen, der diese Regeln nicht auch befolgt.
• Verlasse dich nicht darauf, dass dein Virenscanner schon alles findet. Keine Sicherheitslösung ist 100% sicher!

Aber selbst bei der peinlichen Einhaltung dieser Regeln kann es dennoch zu einer sogenannten Drive-By-Infektion kommen, bei der ein Schädling aus dem Schutzmechanismus des Webbrowsers ausbricht. Um die Sicherheit noch weiter zu erhöhen gibt es spezielle Schutzsoftware, die deinen Browser noch weiter absichert.

• WOT (Web of trust) Dieses Add-On warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst. Hinweis: Avast enthält ein solches Plugin bereits.
• Sandboxie schafft eine zusätzliche isolierte Programmumgebung, damit dein Browser wie ein Kleinkind im Sandkasten sicher ist. (Anleitung: Sandboxie)
• Securebanking ist ein Software, die Verbindungen untersucht und dir meldet, wenn jemand "mithört". Wie der Name sagt, wurde es entwickelt, damit Onlinebanking wirklich sicher ist. Mehr Infos auf der Homepage: Secure Banking

Zuletzt denke bitte über die Benutzung eines alternativen Browsers nach. Programme, die nicht so oft verwendet werden, sind auch nicht so sehr im Focus der "bösen Jungs". D.h. du bist mit einem exotischen Browser eher auf der sicheren Seite. Grundsätzlich bist du erst einmal deutlich sicherer, wenn du nicht den Internet Explorer benutzt.

• Firefox, Opera, Chrome, ...
• ... mehr findest du auf Microsofts eigener Browserauswahlwebseite.

Damit wünsche ich dir noch viel Spaß beim Surfen im Internet

... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Grüße
Smeenk

Super!! Danke für die Tipps!! =)

Gerne gemacht

Grüße
Smeenk