| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Was kann ich tun, um den ihavenet Trojaner loszuwerden?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
01.06.2013, 23:38
| #1 |
| |  Was kann ich tun, um den ihavenet Trojaner loszuwerden? Hallo, ich habe mir auf meinem PC den ihavenet-Trojaner eingefangen. Bei Suchen über Google im Firefox wird nicht die richtige Seite angezeigt, sondern eine Weiterleitung auf eine andere Seite. Ich habe bereits AdwCleaner ausgeführt und entsprechende Einträge gelöscht. Da wird jetzt nichts mehr angezeigt, das Problem besteht aber immer noch. Was kann ich tun, um den ihavenet Trojaner loszuwerden? Vielen Dank im Voraus für die Hilfe. Hier der Report von OTL: Code:
ATTFilter OTL logfile created on: 6/1/2013 11:56:39 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\UserName\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16576) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.97 Gb Total Physical Memory | 2.48 Gb Available Physical Memory | 62.51% Memory free 7.93 Gb Paging File | 6.11 Gb Available in Paging File | 77.02% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 153.22 Gb Total Space | 75.41 Gb Free Space | 49.21% Space Free | Partition Type: NTFS Drive D: | 297.44 Gb Total Space | 254.24 Gb Free Space | 85.48% Space Free | Partition Type: NTFS Computer Name: UserName-NOTEBOOK | User Name: UserName | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013/06/01 23:39:09 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\UserName\Downloads\OTL.exe PRC - [2013/05/23 07:44:09 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe PRC - [2013/02/05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe PRC - [2013/02/04 21:42:54 | 000,239,968 | ---- | M] () -- C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe PRC - [2012/08/08 21:39:47 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012/05/02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012/05/02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011/03/14 17:27:28 | 000,236,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe PRC - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe PRC - [2009/11/12 14:48:56 | 000,071,096 | ---- | M] () -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe PRC - [2009/10/22 10:27:28 | 000,053,248 | ---- | M] (HP) -- C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe PRC - [2009/09/12 14:26:50 | 000,834,560 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe PRC - [2009/09/07 12:42:04 | 000,093,184 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe PRC - [2009/08/06 09:46:06 | 002,242,048 | ---- | M] (SEC) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe PRC - [2009/06/01 10:26:34 | 000,136,192 | ---- | M] (HP) -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe PRC - [2009/04/14 11:50:26 | 000,487,992 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Print View Software\HP Print View Resource Center\HPPrintViewResourceCenter.exe PRC - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () -- C:\Windows\SysWOW64\Rezip.exe PRC - [2008/10/24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe PRC - [2008/01/16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe ========== Modules (No Company Name) ========== MOD - [2013/05/30 15:21:08 | 014,340,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\066b13fa55730501c5e0878ce3fb6650\PresentationFramework.ni.dll MOD - [2013/05/30 15:20:43 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll MOD - [2013/05/30 15:20:34 | 001,806,848 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\33125250f48dd834dde012979858b39f\System.Deployment.ni.dll MOD - [2013/05/30 15:20:30 | 012,237,824 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\f42c285cad88c39e520614502430f205\PresentationCore.ni.dll MOD - [2013/05/30 15:20:14 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll MOD - [2013/05/30 15:19:57 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll MOD - [2013/05/23 07:44:07 | 000,393,168 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll MOD - [2013/05/23 07:43:59 | 004,051,408 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll MOD - [2013/05/23 07:43:06 | 000,599,504 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\libglesv2.dll MOD - [2013/05/23 07:43:05 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\libegl.dll MOD - [2013/05/23 07:43:03 | 001,597,392 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ffmpegsumo.dll MOD - [2013/03/09 18:11:50 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7366a39c36523a084bc11c230929ff92\Microsoft.VisualBasic.ni.dll MOD - [2013/03/09 18:07:22 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll MOD - [2013/03/09 18:07:14 | 011,833,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll MOD - [2013/01/31 08:42:18 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d7d20811a7ce7cc589153648cbb1ce5c\PresentationFramework.Aero.ni.dll MOD - [2013/01/31 08:41:58 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll MOD - [2013/01/31 08:41:29 | 000,310,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\eb4fa29ea9ab56d453b36696edbe6423\System.Runtime.Serialization.Formatters.Soap.ni.dll MOD - [2013/01/31 08:41:20 | 001,592,832 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll MOD - [2013/01/31 08:40:59 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\520a80ddcdd1084993516f4d42a73e05\System.Xml.ni.dll MOD - [2013/01/31 08:40:54 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013/01/31 08:40:48 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2010/11/13 01:26:08 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009/10/28 23:30:24 | 000,110,592 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll MOD - [2009/10/28 23:29:55 | 000,397,312 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Deployment.resources.dll MOD - [2009/10/22 10:26:28 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\HPFaxUtilities.dll MOD - [2009/10/22 10:26:26 | 000,835,584 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\Alerts.dll MOD - [2009/10/22 10:26:14 | 000,840,192 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\PLSDMXMLObjects.dll MOD - [2009/10/22 10:26:14 | 000,516,096 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\HPAppTools.dll MOD - [2009/10/22 10:26:12 | 000,674,816 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\LEDMXMLObjects.dll MOD - [2009/10/22 10:26:12 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\AppConstants.dll MOD - [2009/10/22 10:26:10 | 000,130,560 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\DMBaseObjects.dll MOD - [2009/10/22 10:26:08 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\HPToolkit.dll MOD - [2009/10/22 10:26:08 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\HPTools.dll MOD - [2009/10/15 09:25:30 | 000,364,544 | ---- | M] () -- C:\Program Files (x86)\HP\ToolboxFX\bin\nativeutils.dll MOD - [2006/08/12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll ========== Services (SafeList) ========== SRV:64bit: - [2009/09/28 09:22:00 | 000,496,128 | ---- | M] (Marvell) [Auto | Running] -- C:\Windows\SysNative\yk62x64.dll -- (yksvc) SRV:64bit: - [2009/09/02 09:55:44 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2009/03/28 04:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio) SRV - [2013/02/05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService) SRV - [2013/02/04 21:42:54 | 000,239,968 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe -- (Mobile Partner. RunOuc) SRV - [2012/05/02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012/05/02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/03/14 17:27:34 | 000,346,976 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\HWDeviceService64.exe -- (HWDeviceService64.exe) SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/11/12 14:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU) SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/06/01 10:26:34 | 000,136,192 | ---- | M] (HP) [Auto | Running] -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe -- (HP LaserJet Service) SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\Rezip.exe -- (Rezip) SRV - [2008/10/24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService) SRV - [2008/01/16 10:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013/02/04 21:42:54 | 000,421,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbwwan.sys -- (ewusbmbb) DRV:64bit: - [2013/02/04 21:42:54 | 000,221,312 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:64bit: - [2013/02/04 21:42:54 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:64bit: - [2013/02/04 21:42:54 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:64bit: - [2012/05/02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012/04/27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012/04/25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011/05/27 07:20:32 | 002,750,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/11/20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2009/11/12 14:48:56 | 000,005,504 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\windows\SysNative\drivers\StarOpen.sys -- (StarOpen) DRV:64bit: - [2009/09/28 09:22:00 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009/09/02 10:31:48 | 006,204,416 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009/08/06 00:24:16 | 000,061,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2009/07/22 00:03:34 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem) DRV:64bit: - [2009/07/15 01:16:34 | 000,273,456 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/06/10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009/06/10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009/06/04 11:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009/05/28 08:38:04 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI) DRV:64bit: - [2007/07/16 23:29:33 | 000,023,064 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hpfx64fax.sys -- (HPFXFAX) DRV:64bit: - [2007/07/16 23:29:23 | 000,020,504 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hpfx64bulk.sys -- (HPFXBULK) DRV - [2009/11/12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\windows\SysWow64\drivers\StarOpen.sys -- (StarOpen) DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\..\SearchScopes\{E477C509-3405-4051-A642-6F99B170DF3A}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} IE - HKU\S-1-5-21-691484766-175042921-2864471598-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..extensions.enabledAddons: %7B888d99e7-e8b5-46a3-851e-1ec45da1e644%7D:17.0.0 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:6.0.0 FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:5.8 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31 FF - prefs.js..network.proxy.http_port: 80 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\windows\system32\npdeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@innoplus.de/inoPanoViewer: C:\Program Files (x86)\innoPlus\Rundum-Betrachter-innoPlus\npirsviewer.dll (INNOVA-engineering GmbH Dresden) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/05/22 08:59:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/05/22 08:59:26 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/10/18 22:39:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/05/22 08:59:31 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/05/22 08:59:26 | 000,000,000 | ---D | M] [2010/08/14 00:22:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\UserName\AppData\Roaming\mozilla\Extensions [2010/01/11 23:31:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\UserName\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010/08/14 00:22:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\UserName\AppData\Roaming\mozilla\Extensions\prism@developer.mozilla.org [2013/06/01 22:23:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\UserName\AppData\Roaming\mozilla\Firefox\Profiles\ubmwqxtu.default\extensions [2012/12/25 01:25:30 | 000,030,502 | ---- | M] () (No name found) -- C:\Users\UserName\AppData\Roaming\mozilla\firefox\profiles\ubmwqxtu.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2013/05/29 10:37:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013/05/22 08:59:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013/05/22 08:59:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013/05/22 08:59:31 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2011/04/14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR - homepage: hxxp://www.google.de/ CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: ActiveTouch General Plugin Container (Enabled) = C:\Users\UserName\AppData\Roaming\Mozilla\plugins\npatgpc.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Rundum-Betrachter-innoPlus Plugin (Enabled) = C:\Program Files (x86)\innoPlus\Rundum-Betrachter-innoPlus\npirsviewer.dll CHR - Extension: SKiD Racer = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhoaojooagiaaiidlnfhkkafjpbbnnno\0.0.0.37_0\ CHR - Extension: YouTube = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Google-Suche = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: Ultimate Flash Sonic = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmgmfbijldhdncjcipeocgkgbjhaecfp\1.0_0\ CHR - Extension: Fast Car = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilnilkflnlkekeioahamkfjcklliecpf\1.5_0\ CHR - Extension: Plants vs Zombies = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmcegpfdgcoclcdfkjahiimlikdpnina\1.0.5_0\ CHR - Extension: Galactic Titans = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\oelcgelgojkledbkgfbjmbhojbfkmhbh\1.0_0\ CHR - Extension: Greyscale = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\penkfbldfkaelnnhblmfmajlggdielfm\1.0_0\ CHR - Extension: Google Mail = C:\Users\UserName\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL File not found O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2:64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found. O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [HP Color LaserJet CM1312 MFP Series Fax] C:\Program Files (x86)\HP\HP Color LaserJet CM1312 MFP Series\hppfaxprintersrv.exe (Hewlett-Packard Company) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [iSaverCtrl] C:\Program Files (x86)\iSaver\iSaverCtrl.exe (infoMantis GmbH) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [ToolBoxFX] C:\Program Files (x86)\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-691484766-175042921-2864471598-1001..\Run: [KYIGNVZKQ] C:\Users\UserName\AppData\Roaming\pcauiy.dll () O4 - HKLM..\RunOnce: [awde7zip23052] C:\Users\UserName\AppData\Local\Temp\BI_RunOnce.exe (Somoto Ltd.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\UserName\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HP Print View Resource Center.lnk = C:\Program Files (x86)\Hewlett-Packard\HP Print View Software\HP Print View Resource Center\HPPrintViewResourceCenter.exe (Hewlett-Packard) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 () O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{469358A3-F7B6-4CCA-94B6-7258214C12C1}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7F8266EC-61F7-43AA-9475-092D1558D160}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8A4C10B8-87C6-4ED1-A05D-A74FAD7DE00E}: NameServer = 193.189.244.206 193.189.244.225 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{eaca6dcd-6ef2-11e2-a327-00245419b7ab}\Shell - "" = AutoRun O33 - MountPoints2\{eaca6dcd-6ef2-11e2-a327-00245419b7ab}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{eaca6ddb-6ef2-11e2-a327-00245419b7ab}\Shell - "" = AutoRun O33 - MountPoints2\{eaca6ddb-6ef2-11e2-a327-00245419b7ab}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f778eac3-bb1b-11df-82ae-00245419b7ab}\Shell - "" = AutoRun O33 - MountPoints2\{f778eac3-bb1b-11df-82ae-00245419b7ab}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true O33 - MountPoints2\{faf9b294-6fb5-11e2-9677-00245419b7ab}\Shell - "" = AutoRun O33 - MountPoints2\{faf9b294-6fb5-11e2-9677-00245419b7ab}\Shell\AutoRun\command - "" = F:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013/06/01 23:50:55 | 000,000,000 | ---D | C] -- C:\windows\ERUNT [2013/06/01 23:50:46 | 000,000,000 | ---D | C] -- C:\JRT [2013/05/22 08:59:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013/05/15 21:23:08 | 000,000,000 | ---D | C] -- C:\Users\UserName\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ELFE 1-6 [2013/05/15 21:23:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ELFE 1-6 [2013/05/15 21:23:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ELFE 1-6 ========== Files - Modified Within 30 Days ========== [2013/06/01 23:55:00 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2013/06/01 22:54:11 | 000,013,936 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/06/01 22:54:11 | 000,013,936 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/06/01 22:51:52 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013/06/01 22:25:12 | 001,675,450 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2013/06/01 22:25:12 | 000,721,524 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2013/06/01 22:25:12 | 000,671,712 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2013/06/01 22:25:12 | 000,159,316 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2013/06/01 22:25:12 | 000,128,510 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2013/06/01 22:22:24 | 000,001,760 | ---- | M] () -- C:\Users\UserName\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HP Print View Resource Center.lnk [2013/06/01 22:21:47 | 000,001,104 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2013/06/01 22:19:10 | 3193,393,152 | -HS- | M] () -- C:\hiberfil.sys [2013/05/30 15:13:39 | 000,492,392 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2013/05/24 14:31:53 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013/05/20 22:12:52 | 000,425,984 | RHS- | M] () -- C:\Users\UserName\AppData\Roaming\pcauiy.dll [2013/05/15 21:23:08 | 000,001,007 | ---- | M] () -- C:\Users\UserName\Desktop\ELFE 1-6.lnk ========== Files Created - No Company Name ========== [2013/05/20 22:12:52 | 000,425,984 | RHS- | C] () -- C:\Users\UserName\AppData\Roaming\pcauiy.dll [2013/05/15 21:23:08 | 000,001,007 | ---- | C] () -- C:\Users\UserName\Desktop\ELFE 1-6.lnk [2012/07/25 07:17:20 | 000,007,597 | ---- | C] () -- C:\Users\UserName\AppData\Local\Resmon.ResmonCfg [2012/07/15 14:10:21 | 000,000,786 | ---- | C] () -- C:\windows\SysWow64\AZSPELL.INI [2012/07/15 14:10:16 | 001,037,824 | ---- | C] () -- C:\windows\SysWow64\H5KRNL32.DLL [2012/07/15 14:10:16 | 000,252,768 | ---- | C] () -- C:\windows\SysWow64\capicom.dll [2012/07/15 14:10:16 | 000,188,928 | ---- | C] () -- C:\windows\SysWow64\H5ICON32.DLL [2012/07/15 14:10:16 | 000,175,616 | ---- | C] () -- C:\windows\SysWow64\H5MENU32.DLL [2012/07/15 14:10:16 | 000,114,176 | ---- | C] () -- C:\windows\SysWow64\H5DLG32.DLL [2012/07/15 14:10:16 | 000,094,208 | ---- | C] () -- C:\windows\SysWow64\H5RTF32.DLL [2012/07/15 14:10:16 | 000,051,200 | ---- | C] () -- C:\windows\SysWow64\H5TOOL32.DLL [2012/04/16 19:30:16 | 000,000,074 | ---- | C] () -- C:\windows\tm.ini [2011/12/05 21:53:47 | 000,000,917 | ---- | C] () -- C:\Users\UserName\.recently-used.xbel [2010/11/15 23:12:52 | 000,001,672 | ---- | C] () -- C:\Users\UserName\AppData\Roaming\dvdae.config [2010/08/14 00:33:11 | 000,007,503 | ---- | C] () -- C:\Users\UserName\NeueZeichnung.edf ========== ZeroAccess Check ========== [2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2010/01/07 11:41:13 | 000,000,000 | -HSD | M] -- C:\Users\UserName\AppData\Roaming\.# [2010/05/01 15:41:19 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\1morebee [2011/02/27 22:15:05 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\7Wonders [2012/09/07 21:33:51 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\8floor [2011/04/20 22:08:05 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Age of Japan [2011/06/11 22:34:35 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Akhra [2011/01/01 14:22:51 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\AlawarSouthpoint [2012/08/21 22:59:46 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\aliasworlds [2011/01/12 21:22:31 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Anarchy [2012/04/02 20:42:58 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Anuman [2011/02/26 22:25:39 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Artifact Quest [2011/09/07 21:15:44 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Artifex Mundi [2011/10/03 20:22:47 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Ashampoo [2010/05/20 23:48:43 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Ashampoo Cover Studio [2010/01/05 22:59:12 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Ashtons Family Resort [2010/01/15 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Atari [2012/04/09 22:00:06 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Awem [2013/04/23 19:38:18 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Azureus [2011/04/17 21:53:40 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Babylonia [2012/08/07 22:51:29 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\BarbarianGames [2011/02/19 22:11:28 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Batovi [2010/01/04 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\BeachPartyCraze [2013/02/11 20:52:20 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\BlamGames [2012/01/07 22:04:03 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\blg [2012/12/30 23:35:51 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\BlooBuzz [2011/01/05 21:39:01 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Boolat Games [2010/03/31 19:39:11 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Boomzap [2012/10/06 21:09:33 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Camel101 [2010/02/09 22:05:29 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Canneverbe Limited [2011/03/02 19:21:21 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\CannyGames [2012/12/30 19:28:51 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\casualArts [2011/08/26 21:09:11 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Clockwork Pixels [2010/03/21 15:34:15 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\CupcakeCafe [2011/04/16 22:37:05 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\DeepVoyage [2011/03/18 20:41:51 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Divo Games [2010/03/28 11:48:59 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\EleFun Games [2012/04/17 20:38:01 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\elsterformular [2011/03/04 20:32:30 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\EnchantedCavern [2011/01/16 22:05:16 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\ERS G-Studio [2011/03/04 17:37:50 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Family Farm [2013/02/21 19:44:31 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Farm Girl am Nil [2010/05/02 21:17:19 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Farm Mania [2012/04/05 23:34:40 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Farm Mania 2 [2012/01/04 20:26:02 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Farm Mania 2.1 [2010/05/15 20:24:29 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\FarmerJane [2012/12/28 23:37:52 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\FarmFables [2011/01/02 13:21:59 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\freshgames [2011/09/08 21:19:49 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Friday's games [2010/01/06 20:06:20 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\game [2010/01/06 15:31:09 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\gamehouse [2011/06/02 21:11:16 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\GameInvest [2010/01/06 18:57:34 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Gamelab [2010/05/30 20:47:37 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Go Go Gourmet [2011/08/30 21:07:26 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\GreenSauceGames [2011/09/13 21:35:00 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\gtk-2.0 [2012/03/31 21:36:20 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Happy Chef [2011/06/10 21:32:16 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\iMaxGen [2010/11/15 21:53:54 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\ImTOO [2011/06/03 18:55:11 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\InImages [2010/05/29 20:34:14 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\ITTNord [2010/01/05 14:08:36 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Jane s Hotel [2011/06/03 19:06:46 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Jane s Hotel 3 [2011/02/13 21:44:34 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Jewel Keepers Easter Island [2011/04/15 20:25:31 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Jewel Match 3 [2011/03/19 22:01:16 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\JewelMatch2 [2012/09/08 20:48:22 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Jumb-O-Fun Games [2010/01/15 21:36:54 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Leadertech [2010/02/19 21:28:42 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Magic Seeds [2011/03/22 23:02:17 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\MagicTale [2011/04/21 22:06:39 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\MBT [2011/04/19 22:05:55 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\md studio [2012/01/07 21:32:54 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Mean Hamster [2010/04/05 20:58:46 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\MegaplexMadnessSummerBlockbuster [2013/02/24 14:35:42 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Meridian93 [2010/05/14 20:39:54 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\NevoSoft Games [2011/10/03 22:22:52 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Notepad++ [2013/02/23 22:04:55 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Oberon Games [2010/06/27 13:56:33 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\OpenOffice.org [2011/06/17 20:36:44 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Orneon [2013/03/03 00:04:45 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\PetShowCraze [2011/06/23 19:35:32 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Ph03nixNewMedia [2013/02/24 16:54:20 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\PlayFirst [2012/01/08 20:03:05 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\playmink [2012/12/29 23:33:23 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Playrix Entertainment [2010/08/14 00:21:54 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\prism [2011/10/03 20:53:34 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\QSGames [2012/12/28 20:14:18 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Rainbow [2011/01/22 20:20:50 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Sahmon Games [2011/01/02 19:38:46 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Sandlot Games [2012/12/05 23:40:52 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\ScreeNet iSaver [2011/08/28 13:21:19 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\ShamanGS [2010/06/03 21:05:47 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Shape games [2011/02/23 22:54:57 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Skunk Studios [2010/02/26 21:08:00 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Softland [2012/10/03 20:41:13 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\SulusGames [2011/04/26 20:28:28 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\TFS2 [2013/02/17 00:11:25 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\thejoyoffarming [2010/01/11 23:31:02 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Thunderbird [2011/03/06 20:29:38 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Try2 [2010/03/12 21:05:55 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1 [2011/06/03 20:35:02 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\URSE Games [2013/01/02 21:09:29 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Valusoft [2013/02/13 22:05:28 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\ViquaSoft [2011/01/22 20:50:37 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Vogat Interactive [2011/01/12 20:08:19 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\webex [2012/12/29 00:28:42 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\YoudaGames [2010/01/03 19:10:28 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Zylom [2010/01/06 16:25:20 | 000,000,000 | ---D | M] -- C:\Users\UserName\AppData\Roaming\Zylom DressUpRush ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 98 bytes -> C:\ProgramData\Temp:FFD42BAF @Alternate Data Stream - 98 bytes -> C:\ProgramData\Temp:E07230CC @Alternate Data Stream - 98 bytes -> C:\ProgramData\Temp:A0C7D68A @Alternate Data Stream - 96 bytes -> C:\ProgramData\Temp:A3E39C6A @Alternate Data Stream - 96 bytes -> C:\ProgramData\Temp:213AFE42 @Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:6D635C5B @Alternate Data Stream - 94 bytes -> C:\ProgramData\Temp:ADF0A5DD @Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:DA18D4E3 @Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:B1E64E47 @Alternate Data Stream - 216 bytes -> C:\ProgramData\Temp:2216A431 @Alternate Data Stream - 205 bytes -> C:\ProgramData\Temp:4F96D8E6 @Alternate Data Stream - 153 bytes -> C:\ProgramData\Temp:4B70A9FA @Alternate Data Stream - 152 bytes -> C:\ProgramData\Temp:639BB5E9 @Alternate Data Stream - 152 bytes -> C:\ProgramData\Temp:3A4C8FE7 @Alternate Data Stream - 151 bytes -> C:\ProgramData\Temp:6AD65294 @Alternate Data Stream - 149 bytes -> C:\ProgramData\Temp:5A15BCD4 @Alternate Data Stream - 149 bytes -> C:\ProgramData\Temp:2D3CB929 @Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:FD38E906 @Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:8C81B36D @Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:3B07E6F4 @Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:10873493 @Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:102394C6 @Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:04ADB7A6 @Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:F53B274A @Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:56F368C9 @Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:393F7B1E @Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:2ABB51D4 @Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:2077FAC7 @Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:8DD36B71 @Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:1E288DA3 @Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:8B3C3098 @Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:5CE65446 @Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:14D29229 @Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:30E0D641 @Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:2B856118 @Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:0DFE2AE1 @Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:014BC3B4 @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:F43B7E8F @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:F2327E82 @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:E9900C74 @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:C82210DD @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:7EABF26C @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:76466F4C @Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:64170090 @Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:4B244549 @Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:436BE28C @Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:C43C957E @Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:9B2BD056 @Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:966CEAE7 @Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:17F7AEA3 @Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:FEE00EB9 @Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:B790962B @Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:9CF728A6 @Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:03D08225 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:FBE5FDB9 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:DD95E6D9 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:D4D3884D @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:D4BB0AD6 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:BBF60A29 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:A5CD91DF @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:A4076A3B @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:751D6870 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:6301CE40 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:571CCF8E @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:3FE1A827 @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:2C8C1CCD @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:073139EC @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:F9EDCFB0 @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:F65A2273 @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:B2112CA5 @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:706B1D1A @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:5BB7898D @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:4EE323A4 @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:0988A428 @Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:7425C891 @Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:661DC753 @Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:2E9900EE @Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:F7FFE8AF @Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:92D91D7E @Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:7D288858 @Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:07D64CD9 @Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:9C337CCE @Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:6E11933F @Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:00AA4B31 @Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:EA701346 @Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:DE892EFB @Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:BE6DC701 @Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:5FD47318 @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:BA24E689 @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:1709732A @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:07C99568 @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:02B823FE @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:F52DB269 @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:F19A4790 @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:EB68CA55 @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:A2B3764A @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:3C0887BF @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:2E45FA8F @Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:0860D6D6 @Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:E07EA07E @Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:9331E9D2 @Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:43E95997 @Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:2775F9E2 @Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:85376176 @Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:5AE41FFB @Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:3C6860C5 @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:EC0279DC @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:D02FBAEC @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:7AF9CAEB @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:4149A170 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:AC0528D9 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:56C17A93 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:45F3AD49 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:1B9E79B3 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:059167AF @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:F986CC21 @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:DDEB08FD @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:CE6885F1 @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:57B374AB @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:490BCC52 @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:16A4620C @Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:10D45FC3 @Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:AC95B5ED @Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:35A81752 @Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:2D1AE3BE @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E2CB42C9 @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:B3942462 @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:89A5891E @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:84CFEE62 @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:6FD36C4B @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:56C66609 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1D818F7 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:C35B4B19 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:97B3B270 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:6FDE1666 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:43AA121F @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:09708CB7 @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:CFF6B3FF @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:9D03192E @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:969C0C96 @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:9290C91C @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:6E3C585B @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:3815BC84 @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:3473F385 @Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:0E636D62 @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:F1175E1D @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:E855BDCF @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:BC1F7CAE @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:A7B70C4E @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:A2C4E5BC @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:592D7272 @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:4A966CC2 @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:217A2A36 @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:FEEEFFAD @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:CFDE7852 @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:CB0FEE2B @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:C7857F06 @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:A1023D41 @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:6A9EDD31 @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:658DE22A @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:4C49306C @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:1D8AAA7B @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:B285A50E @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:A2907225 @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:69D59C23 @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:66FC2E6F @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:3A6BC948 @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:151760F0 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:EB4FEEF5 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:E0848D16 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:CD6DF7CC @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:C74009E5 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:BACB6B6C @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:B6285236 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:883EDFB5 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:8140CB50 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:7CEDF9F3 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:6C049F97 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:66AA0486 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:63B38619 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:439E3411 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:413E2927 @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:35C78DCC @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:32FFF2D1 @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:FC2E567F @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:F3029A65 @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:D5DAEF21 @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:AA004D25 @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:6E2A6B4A @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:329BA65B @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:169E7AC5 @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:122B409D @Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:FECEF728 @Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:AE2EA3C2 @Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:8CCDAB14 @Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:69FD6BF0 @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:CA99FD89 @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:B67A5784 @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:9E50C1C9 @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:6C031E3E @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:6677D85A @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:627B7F7C @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:561568A4 @Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:5216EF84 @Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:B1FBA7E1 @Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:99A29126 @Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:97995ED4 @Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:33611CFB @Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:C3C72D5F @Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:A688EF17 @Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:47FE7AB7 @Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:B12D1A7D @Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:FD2BFC89 @Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:E4E43015 @Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:9547F1DB @Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:537E6E55 @Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:1A4BF204 @Alternate Data Stream - 111 bytes -> C:\ProgramData\Temp:097FF903 @Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:F2AF86D9 @Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:63F8EC77 @Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:639F0420 @Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:EB5BDBB0 @Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:AA60673F @Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:79A70C33 @Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:10D98D98 @Alternate Data Stream - 107 bytes -> C:\ProgramData\Temp:B321E944 @Alternate Data Stream - 107 bytes -> C:\ProgramData\Temp:5FBC2BC4 @Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:EF4FB3C5 @Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:E41267F2 @Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:D8DB81DC @Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:603FD11D @Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:1CE87230 @Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:C7B98566 @Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:BFAD7A5D @Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:1A8BB29B @Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:126591AF @Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:F0AB86C0 @Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:71FA8B7F @Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:67BA17B9 @Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:554C6431 @Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:D1713795 @Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:880F0FEF @Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:52E1DB1D @Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:3991CD7D @Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:31F2397C @Alternate Data Stream - 100 bytes -> C:\ProgramData\Temp:BDF08FAF @Alternate Data Stream - 100 bytes -> C:\ProgramData\Temp:A745DB5D @Alternate Data Stream - 100 bytes -> C:\ProgramData\Temp:9E2BD6A9 @Alternate Data Stream - 100 bytes -> C:\ProgramData\Temp:8F067037 < End of report > Code:
ATTFilter OTL Extras logfile created on: 6/1/2013 11:56:39 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\UserName\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.97 Gb Total Physical Memory | 2.48 Gb Available Physical Memory | 62.51% Memory free
7.93 Gb Paging File | 6.11 Gb Available in Paging File | 77.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 153.22 Gb Total Space | 75.41 Gb Free Space | 49.21% Space Free | Partition Type: NTFS
Drive D: | 297.44 Gb Total Space | 254.24 Gb Free Space | 85.48% Space Free | Partition Type: NTFS
Computer Name: UserName-NOTEBOOK | User Name: UserName | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-691484766-175042921-2864471598-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1 -- ()
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1 -- ()
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1 -- ()
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1 -- ()
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1DD95DD3-3D9A-4822-AE08-F8E13F6E1415}" = lport=138 | protocol=17 | dir=in | app=system |
"{1ECEBEB7-A1D7-4552-9B1E-AE08486A9B89}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{264C39FD-C99E-4910-A95C-C74E02894819}" = rport=139 | protocol=6 | dir=out | app=system |
"{2D9B68FA-844B-4E1B-BD54-35C7169AC5B4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{337B86D8-BF59-4C9E-BFFF-D1FBECB572CD}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{36B6C2FD-EA39-4201-83AF-581C1FEC2E4C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{3C145BC6-5110-46A4-B528-DD4C82ACBF3E}" = lport=137 | protocol=17 | dir=in | app=system |
"{4F321C93-7CCD-4C8F-B9AF-74B80079584E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{668899C5-B9E0-496F-978B-06A6CC6335A3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{77EAC2CF-BF11-4408-9970-DCB1F4A1E703}" = rport=445 | protocol=6 | dir=out | app=system |
"{834D9FBD-FD4C-4F79-ACC2-914FDAB75ED7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{90FE5A6F-6AC8-47A0-ABC2-961230A5F51D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9893F1AA-6DBD-427C-AEA5-6723D66841DF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{A78D07CF-08D8-4829-A46D-4702FE0E14DF}" = rport=138 | protocol=17 | dir=out | app=system |
"{AC33B80E-F429-4553-AD13-46B98D25021C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AE26FF80-A089-44CF-B429-186E5E613AEC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AE570187-D27A-471F-8375-61D7CF35FB0A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B773B257-74B8-49B6-9E43-6D7738FA369A}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{BEDCC8AE-847F-47D7-A8D7-6E22A41F8C3E}" = lport=139 | protocol=6 | dir=in | app=system |
"{C0E74389-F1AD-42DF-8E66-4B2986AD4B58}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C3E05889-2B6F-4741-A69A-6DA90246CF96}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CD1F8B1A-B6CD-44FC-89B8-805AFA42F33E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D5E6322A-33CF-44EC-B3D9-C16F37A4213F}" = rport=137 | protocol=17 | dir=out | app=system |
"{EAA30746-1F44-4FE8-86AC-23D07F5B3AEA}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F20EFCD9-66C0-44FC-AE9F-BB7CA719E4DA}" = lport=445 | protocol=6 | dir=in | app=system |
"{FF5C1A4B-4E81-4319-9792-3226EB54FAAB}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06B134C7-8D9D-4AB9-A665-ABB8B336E418}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{13E493E1-E92E-4D98-A35A-183BAF295B7A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{29E8E9C0-EE93-41E6-AAB4-4F0B07A7DF08}" = dir=in | app=c:\program files (x86)\common files\mcafee\mna\mcnasvc.exe |
"{2ED8FD3D-088A-4F53-9E51-CCFE3DBBFCDE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2EE950E5-F765-448F-A7DA-B7E9195882C9}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{327255B0-7B1E-4996-B1A1-8142A651AFC2}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{34BF8994-A1DA-4E9D-8F0D-2DAFE1707426}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{362A68BD-0756-4561-A54F-1B774B601A4A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{5E089E02-DE8C-4C55-A636-2BAF51CE09AA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5FFE080B-10CB-4443-BF7D-7F47BFDC0D75}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{6EEF6A2A-441C-4AEB-95B0-EF42254ACB2F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{741C4DA5-BDAD-42B4-9F92-E736CB97A670}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{74AD2628-769E-47DB-AF45-BA156BE0981F}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{85D60E08-B419-44B6-A3FA-FA02E0AFC7F7}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{88B8020E-0209-47D7-BA6E-540C77CB7123}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9E5CB71B-6A0C-4D5C-ABAC-001F25B4468B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B82108CF-3AB2-41AA-9526-81A88BE505C3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C982B798-3BA6-47DB-B3CD-466A40AAFC69}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D3BA8D3E-15FC-4E46-BF8B-0A824374A8E5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D66BCC81-EB4B-4FDE-84EE-445240D0F01C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{DF453DAC-C505-43B0-91EC-4BB13C290710}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{E18F413F-E6CF-4715-8C56-C33C55DA501E}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{E20811AA-EE15-46B5-BFA2-49EA9C445F69}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E563AB75-63BE-4F3B-9EBF-20981ABAC76D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E7EA616C-3704-4F61-9CDB-7CC86A4DE2F4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F1F9F20C-0E2D-42C9-A8D3-9A87E9B3780F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F42AA2BE-07F2-4D07-92FF-B32AF9849668}" = protocol=6 | dir=out | app=system |
"{F9246127-C16E-495C-A357-CE517C4688BC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F9A29131-CE76-4DC7-B88F-65C0A31A6F46}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"TCP Query User{573397CF-9E13-46C8-9541-72A94DCB5158}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |
"TCP Query User{5BF4DC1A-F726-4BDB-949D-C2F705E5A60E}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{AEA9D843-A771-410D-9B33-FAA971FBB5E7}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{F07A70EB-82E1-4C11-A23E-E5EB0C5D8A69}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1FBEA8BA-D40B-48BC-85BC-EE2D5575F27C}" = Microsoft SQL Server VSS Writer
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{2C7079FF-145F-55D4-1798-8F142C8CE52D}" = ccc-utility64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3A44C087-94C4-CEA2-70EF-CFF112F451EA}" = ATI Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{7C39E0D1-E138-42B1-B083-213EC2CF7692}" = Microsoft SQL Server Native Client
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EEDB90E-6ABC-42bb-AD4C-39DEE05E3EEA}" = HP Color LaserJet CM1312 MFP Series 5.1
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BE83E4A4-A678-4211-AF2B-2EC8ECC0AC73}" = HP Print View Software
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F0A36649-873E-4832-A5F1-BF5DF8600BDB}" = Windows Live Family Safety
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"doPDF 7 printer_is1" = doPDF 7.1 printer
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"LSI Soft Modem" = LSI HDA Modem
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{0613F79E-C012-BC98-6E9C-5A47AEE6D37A}" = CCC Help Korean
"{0626C86E-5A8F-4A6D-8C0A-5FF38BD2DA3A}" = hppFaxUtilityCM1312
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{07B85EEC-05BD-4E6A-AAEB-502FB2473DFA}" = hppCLJCM1312
"{0A8CE3AA-99F2-5632-A8D2-636BE6CFE856}" = Catalyst Control Center Core Implementation
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4
"{1664EB8B-057B-0E23-7245-ECE92849FF4C}" = ccc-core-static
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1DBD8607-39EE-B7F3-CDE6-A2095B0EE0C9}" = CCC Help Chinese Traditional
"{1E728246-95D5-4E72-8A9A-AC62602F39D8}_is1" = ANSTOSS 3
"{20167022-64F2-4836-B9C9-1DBAA6721FD4}" = CCC Help Hungarian
"{204DD5C2-441A-DADC-E765-595B5C1EDE88}" = CCC Help Norwegian
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{218E2C0C-4740-DBCB-C8E8-D67201A6500A}" = CCC Help English
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2D30D92F-AD5C-428F-8029-5A913104F262}" = hppTLBXFXCM1312
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{325D1D94-4F34-46A7-A489-737C801B931D}" = hppusgCM1312
"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009
"{3501AF2D-A97E-F6DB-521A-4E64EAEF5BDC}" = CCC Help Thai
"{3A7C46AC-060B-6CBF-1862-969F79A5B758}" = CCC Help French
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3EB37B26-432C-467C-9FBC-9BDA0E6FBDD7}" = Catalyst Control Center InstallProxy
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{411429D5-83D1-2F9B-9F53-4524DCE99E6D}" = CCC Help Portuguese
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{484A13AB-A4C1-41FD-87E0-EBE2DA01250E}" = hppSendFaxCM1312
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{4D2121FE-5CCC-4D47-B3A0-BF56045A5099}" = Samsung Support Center
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{54FBC914-82D7-E646-2916-B3C6D320E0B4}" = Catalyst Control Center Graphics Previews Vista
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{583EDB12-4CEA-48B5-A7BA-88069DD47BA2}" = hppQFolderCM1312
"{5A67EE53-2CE7-40CD-BA31-70F0C801A189}" = TV-Guide
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{5D221DF2-F206-681F-75FE-1C7620BE69A7}" = CCC Help Greek
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B9EFC04-713D-F238-E388-F3CDA52E7880}" = Catalyst Control Center Graphics Light
"{6CB778E6-693F-7A2A-C5AD-C7743500D249}" = CCC Help Turkish
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7985C7FA-B151-4BA7-B19E-1577A7B527F1}" = hppFaxDrvCM1312
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D88074D-4378-C049-4264-EB3EE8AC155C}" = CCC Help Japanese
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_PROHYBRIDR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}" = ChargeableUSB
"{93E42FF5-065E-0D52-2777-8A1849CB8574}" = CCC Help Swedish
"{94D5097B-46D0-A1D9-8983-284E3C675CA9}" = Catalyst Control Center Localization All
"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{961B4059-D1C0-43C8-095B-75A18BD0F8C8}" = CCC Help Polish
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B84A151-81CC-6133-D844-A189FDA1C34F}" = CCC Help Chinese Standard
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F5FD796-86F0-4360-85F8-D54C0F5411EB}" = Steuer-Spar-Erklärung 2011
"{A2C60BF1-82E3-493C-911D-14AD50471F2F}" = Rundum-Betrachter-innoPlus
"{A7285D92-27EE-4D91-AB57-5EF326B572C6}" = hpzTLBXFX
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.5 - Deutsch
"{AE86495C-42F9-F5BE-E878-7798456A509A}" = CCC Help Spanish
"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager
"{B59ACF5E-0FF7-44D2-B57D-E516F334AC2E}" = hppScanToCM1312
"{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}" = Easy Network Manager
"{B6D8DC8C-F077-4631-A221-4D5E1D8E87E7}" = Catalyst Control Center - Branding
"{B7493783-F638-BEAE-C8C7-665C5A03E652}" = CCC Help Dutch
"{B82ABF2C-CBD3-5528-26DF-F1161A2B34BF}" = Catalyst Control Center Graphics Full New
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{B9B1B5D9-F96D-0257-A23C-8EA9ACCCF8CB}" = CCC Help Czech
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}" = Steuer-Spar-Erklärung 2008
"{C3181764-B8F3-A705-5362-86E37C476710}" = Catalyst Control Center Graphics Full Existing
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}" = Steuer-Spar-Erklärung 2012
"{CE246151-F0E8-ABC8-AEB2-7F3E188EFBF5}" = TweetDeck
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D371F551-0DB9-4CEC-844B-4C90CE91EA0B}" = hppLaserJetService
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010
"{DA146D61-5542-2F55-C5E4-49D26EBAAA5B}" = CCC Help Russian
"{DB0EF3C1-8AF4-1E28-267E-024999C11828}" = CCC Help Finnish
"{DBB62E6B-66F5-09D2-D2CC-C1877CDD9A8B}" = CCC Help Italian
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E5141E62-8A90-D9A1-EB2D-C4D0D9940D90}" = CCC Help German
"{EBC3147B-36BE-4846-9A3D-0C6292B78350}" = hppPQVideoCM1312
"{ED498DD7-FBC1-4C67-8D9B-C9218FBC818D}" = hppManualsCM1312
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F293A67D-04BB-6960-5D13-13F158796960}" = CCC Help Danish
"{F2BC3383-F000-410C-A038-3846ADBE8D90}" = REALTEK Wireless LAN Software
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"1PLUS_2007.i_is1" = 1PLUS_2007.i (Portable Version, unabhängig von der BDE)
"1PLUS_2007.k_is1" = 1PLUS_2007.k (Portable Version, unabhängig von der BDE)
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Alice Greenfingers 2" = Alice Greenfingers 2 (remove only)
"Ashampoo Burning Studio Elements_is1" = Ashampoo Burning Studio Elements 10.0.9
"Ashampoo Cover Studio_is1" = Ashampoo Cover Studio 1.01
"Avira AntiVir Desktop" = Avira Free Antivirus
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"BFG-7 Wonders II" = 7 Wonders II
"BFG-A Dwarf's Story" = A Dwarf's Story
"BFG-A Pirate's Legend" = A Pirate's Legend
"BFG-Alice und die magischen Gaerten" = Alice und die magischen Gärten
"BFG-Amelies Cafe - Sommerspass" = Amelies Cafe - Sommerspaß
"BFG-Amelie's Restaurant - Das Weihnachtswunder" = Amelie's Restaurant: Das Weihnachtswunder
"BFG-Anne's Dream World" = Anne's Dream World
"BFG-Antique Shop" = Antique Shop
"BFG-Aquitania" = Aquitania
"BFG-Artifact Quest" = Artifact Quest
"BFG-Atlantis Quest" = Atlantis Quest
"BFG-Azkend 2 - The World Beneath" = Azkend 2: The World Beneath
"BFG-Babylonia" = Babylonia
"BFG-Babysitting Mania" = Babysitting Mania
"BFG-Bejeweled 2 Deluxe" = Bejeweled 2 Deluxe
"BFG-Bistro Boulevard" = Bistro Boulevard
"BFG-Boutique Boulevard" = Boutique Boulevard
"BFG-Burger Bustle" = Burger Bustle
"BFG-Burger Bustle - Ellies Bio-Burger" = Burger Bustle: Ellie's Bio-Burger
"BFG-Burger Fiesta" = Burger Fiesta
"BFGC" = Big Fish Games: Game Manager
"BFG-Cake Mania 2" = Cake Mania 2
"BFG-Cake Mania 3" = Cake Mania 3
"BFG-Cake Mania Main Street" = Cake Mania Main Street
"BFG-Campgrounds" = Campgrounds
"BFG-Caribbean Pirate Quest" = Caribbean Pirate Quest
"BFG-Cave Quest" = Cave Quest
"BFG-Christmas Puzzle" = Christmas Puzzle
"BFG-Cooking Dash 3 - Thrills and Spills Sammleredition" = Cooking Dash 3: Thrills and Spills Sammleredition
"BFG-Cradle of Egypt" = Cradle of Egypt
"BFG-Dancing Craze" = Dancing Craze
"BFG-Das Spiel des Lebens" = Das Spiel des Lebens
"BFG-Das Spukhotel" = Das Spukhotel
"BFG-Das Strandimperium" = Das Strandimperium
"BFG-Deep Voyage" = Deep Voyage
"BFG-Der Dorfmagier" = Der Dorfmagier
"BFG-Der Ideale Baum" = Der Ideale Baum
"BFG-Die verzauberten Inseln" = Die verzauberten Inseln
"BFG-Dolphin Dice Slots" = Dolphin Dice Slots
"BFG-Dream Builder - Erlebnispark" = Dream Builder: Erlebnispark
"BFG-Dreams of a Geisha" = Dreams of a Geisha
"BFG-Enigma 7" = Enigma 7
"BFG-Erntezeit" = Erntezeit
"BFG-Fairy Island" = Fairy Island
"BFG-Family Farm - Fresh Start" = Family Farm: Fresh Start
"BFG-Farm Fables" = Farm Fables
"BFG-Farm Frenzy - Das antike Rom" = Farm Frenzy: Das antike Rom
"BFG-Farm Frenzy - Helden der Wikinger" = Farm Frenzy: Helden der Wikinger
"BFG-Farm Frenzy 2" = Farm Frenzy 2
"BFG-Farm Frenzy 3 - Russisches Roulette" = Farm Frenzy 3: Russisches Roulette
"BFG-Farm Girl am Nil" = Farm Girl am Nil
"BFG-Farm Mania - Hot Vacation" = Farm Mania: Hot Vacation
"BFG-Farm Mania 2" = Farm Mania 2
"BFG-Farm Quest" = Farm Quest
"BFG-Farm Tribe" = Farm Tribe
"BFG-Farmers Market" = Farmers Market
"BFG-Farmington Tales" = Farmington Tales
"BFG-Farmscapes" = Farmscapes
"BFG-Fashion Fortune" = Fashion Fortune
"BFG-Fever Frenzy" = Fever Frenzy
"BFG-First Class Flurry" = First Class Flurry
"BFG-Fishdom 3 Sammleredition" = Fishdom 3 Sammleredition
"BFG-Fisher's Family Farm" = Fisher's Family Farm
"BFG-Flower Shop - Big City Break" = Flower Shop - Big City Break
"BFG-Froehlicher Koch" = Fröhlicher Koch
"BFG-Garden Dash" = Garden Dash
"BFG-Garden Rescue" = Garden Rescue
"BFG-Garden Rescue - Weihnachtsedition" = Garden Rescue: Weihnachtsedition
"BFG-Go-Go Gourmet" = Go-Go Gourmet
"BFG-Gourmania" = Gourmania
"BFG-Gourmania 3 - Mein Zoo" = Gourmania 3: Mein Zoo
"BFG-Hobby Farm" = Hobby Farm
"BFG-Holiday Bonus" = Holiday Bonus
"BFG-Hot Dish" = Hot Dish
"BFG-Hotel Dash - Suite Success" = Hotel Dash: Suite Success
"BFG-Ice Cream Craze" = Ice Cream Craze
"BFG-Ice Cream Mania" = Ice Cream Mania
"BFG-Jar of Marbles" = Jar of Marbles
"BFG-Jessica's Cupcake Cafe" = Jessica's Cupcake Cafe
"BFG-Jet Set Go" = Jet Set Go
"BFG-Jewel Match 2" = Jewel Match 2
"BFG-Jewel Quest - The Sleepless Star" = Jewel Quest: The Sleepless Star
"BFG-Jos grober Traum - Mein eigenes Cafe" = Jos großer Traum: Mein eigenes Cafe
"BFG-Katy and Bob - Way Back Home" = Katy and Bob: Way Back Home
"BFG-Lost City of Aquatica" = Lost City of Aquatica
"BFG-Lovely Kitchen" = Lovely Kitchen
"BFG-Magic Farm 2 - Feenland" = Magic Farm 2 - Feenland
"BFG-Magic Tale" = Magic Tale
"BFG-Megaplex Madness - Now Playing" = Megaplex Madness: Now Playing ™
"BFG-Megastore Madness" = Megastore Madness
"BFG-Mein Landleben" = Mein Landleben
"BFG-Mein Landleben 2" = Mein Landleben 2
"BFG-Monument Builders - Titanic" = Monument Builders: Titanic
"BFG-Nanny Mania 2" = Nanny Mania 2
"BFG-Orchard" = Orchard
"BFG-Ostereierspektakel" = Ostereierspektakel
"BFG-Parking Dash" = Parking Dash
"BFG-Party Down" = Party Down
"BFG-Pet Show Craze" = Pet Show Craze
"BFG-Pets Fun House" = Pets Fun House
"BFG-Pflanzen gegen Zombies" = Pflanzen gegen Zombies
"BFG-Pizza Chef" = Pizza Chef
"BFG-Puppy Sanctuary" = Puppy Sanctuary
"BFG-Puzzle Hero" = Puzzle Hero
"BFG-Puzzle Park" = Puzzle Park
"BFG-Rainbow Web" = Rainbow Web
"BFG-Rainbow Web 3" = Rainbow Web 3
"BFG-Ranch Rush" = Ranch Rush
"BFG-Ranch Rush 2 - Sara's Island Experiment" = Ranch Rush 2: Sara's Island Experiment
"BFG-Restaurant Rush" = Restaurant Rush
"BFG-Restoring Rhonda" = Restoring Rhonda
"BFG-Roller Rush" = Roller Rush
"BFG-Royal Envoy" = Royal Envoy
"BFG-Sally's Spa" = Sally's Spa
"BFG-Season Match 3 - Der Fluch der Kraehe" = Season Match 3 - Der Fluch der Krähe
"BFG-Shop It Up!" = Shop It Up!
"BFG-Shop n Spree - Einkaufsparadies" = Shop n Spree: Einkaufsparadies
"BFG-Shop-n-Spree-Familienimperium" = Shop-n-Spree-Familienimperium
"BFG-Simplz Zoo" = Simplz Zoo
"BFG-Spa Mania 2" = Spa Mania 2
"BFG-Spooky Mall" = Spooky Mall
"BFG-Stand O Food 2" = Stand O' Food 2
"BFG-Supermarket Management 2" = Supermarket Management 2
"BFG-Supermarket Mania" = Supermarket Mania
"BFG-Temple of Jewels" = Temple of Jewels
"BFG-The Great Chocolate Chase" = The Great Chocolate Chase
"BFG-The Joy of Farming" = The Joy of Farming
"BFG-The Legend of the Golden Tome" = The Legend of the Golden Tome
"BFG-The TimeBuilders - Pyramid Rising 2" = The TimeBuilders: Pyramid Rising 2
"BFG-Tiki Boom Boom" = Tiki Boom Boom
"BFG-Tory's Shop N' Rush" = Tory's Shop N' Rush
"BFG-Treasure Pyramid" = Treasure Pyramid
"BFG-Tropical Mania" = Tropical Mania
"BFG-Turbo Fiesta" = Turbo Fiesta
"BFG-Turbo Pizza" = Turbo Pizza
"BFG-Turbo Subs" = Turbo Subs
"BFG-Villa Banana" = Villa Banana
"BFG-Virtual Farm 2" = Virtual Farm 2
"BFG-Wedding Salon" = Wedding Salon
"BFG-Weihnachtswunderland 3" = Weihnachtswunderland 3
"BFG-Wild West Story - The Beginning" = Wild West Story: The Beginning
"BFG-Wizard Land" = Wizard Land
"BFG-Woodville Chronicles" = Woodville Chronicles
"BFG-World Voyage" = World Voyage
"BFG-Ye Olde Sandwich Shoppe" = Ye Olde Sandwich Shoppe
"BFG-Yeti Quest - Crazy Penguins" = Yeti Quest: Crazy Penguins
"BFG-Youda Jewel Shop" = Youda Jewel Shop
"BFG-Yumsters! 2" = Yumsters! 2
"BFG-Zauberhut" = Zauberhut
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"Cooking Academy" = Cooking Academy
"DSGPlayer" = DEUTSCHLAND SPIELT GAME CENTER
"DVD Audio Extractor_is1" = DVD Audio Extractor 5.2.1
"ELFE 1-6" = ELFE 1-6 1.4.1
"ElsterFormular 13.2.0.8623p" = ElsterFormular
"ElsterFormular 2008 - 2009 2008-2009" = ElsterFormular 2008 - 2009
"Farm Craft 2" = Farm Craft 2
"FarmFrenzy Pizza Party" = FarmFrenzy Pizza Party
"Fiona Finch" = Fiona Finch
"Garten-Glück" = Garten-Glück
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Marketing Resources" = HP Print View Software
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"JPG to PDF Converter" = JPG to PDF Converter 1.0
"Marvell Miniport Driver" = Marvell Miniport Driver
"McAfee Security Scan" = McAfee Security Scan Plus
"Meine kleine Farm" = Meine kleine Farm
"Meine kleine Farm 3: American Pie" = Meine kleine Farm 3: American Pie
"Meine kleine Farm 3: Russisches Roulette" = Meine kleine Farm 3: Russisches Roulette
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mobile Partner" = Mobile Partner
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"Mozilla Thunderbird (7.0.1)" = Mozilla Thunderbird (7.0.1)
"Notepad++" = Notepad++
"OpenAL" = OpenAL
"OpenTTD" = OpenTTD 1.2.1
"Plants vs. Zombies" = Plants vs. Zombies
"PROHYBRIDR" = 2007 Microsoft Office system
"Ranch Rush" = Ranch Rush
"RIT Zeugnis GS 7.1" = RIT Zeugnis GS 7.1
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Sandlot Games Client Services 1.2.2_is1" = Sandlot Games Client Services 1.2.2
"Sweet Home 3D_is1" = Sweet Home 3D version 2.2
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-691484766-175042921-2864471598-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ActiveTouchMeetingClient" = WebEx
"Adobe Acrobat Connect Add-in" = Adobe Acrobat Connect Add-in
"Adobe Connect Add-in" = Adobe Connect Add-in
"Ranch Rush Deluxe" = Ranch Rush Deluxe
========== Last 20 Event Log Errors ==========
[ OSession Events ]
Error - 3/29/2010 5:12:23 PM | Computer Name = UserName-Notebook | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 9776
seconds with 5400 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 6/1/2013 5:56:54 PM | Computer Name = UserName-Notebook | Source = DCOM | ID = 10010
Description =
< End of report >
|
| Themen zu Was kann ich tun, um den ihavenet Trojaner loszuwerden? |
| 7-zip, antivir, autorun, avira, cdburnerxp, converter, desktop, error, firefox, flash player, google, hewlett packard, home, iexplore.exe, install.exe, installation, logfile, microsoft office 2003, phishing, plug-in, problem, realtek, registry, rundll, scan, security, senden, software, somoto, svchost.exe, trojaner, windows |
Baum-Darstellung