BKA-Trojaner eingefangen? (3 Log-Dateien anbei)

janderman · 16.01.2014, 20:50

hallo, wollte mir einen film auf kinox.to anschauen und plötzlich war mein firefox-browser gesperrt, es erschien eine BKA-Seite (polizei.de...) und eine checkbox, in der stand, meine IP sei gespeichert worden und so. kann mir jemand helfen? sobald ich das mit paypal hinbekommen habe, spende ich gern 20 EUR. wenn möglich, tausend dank im voraus!!!!

habe folgendes gemacht:

- Firefox über den Task-Manager geschlossen
- mich hier eingelesen
- die beiden Scans durchlaufen lassen.

das löschen der dateien mit malwarebyte wurde von avira blockiert. die log-datei zeigt aber, daß die dateien in die quaratäne gekommen sind, eine wurde gelöscht.

noch eine wichtige frage: der PC läuft seit dem vorfall ganz normal weiter. kann es sein, daß die echte polizei das war, weil ich politikern böse e-mails schreibe?

schrauber · 17.01.2014, 08:16

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

janderman · 17.01.2014, 09:02

ok, wie gesagt. übrigens war ich gestern nachdem ich das hier gepostet habe, nochmal auf der seite, um zu sehen, ob das tatsächlich der BKA-Trojaner war. Und er war es.
100 EUR wollten die. Allerdings findet Malwarebytes nichts mehr. Avira findet auch nichts.

Hier die Log-Daten:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 03[/B]
Ran by Jan (administrator) on JAN-DELL on 16-01-2014 20:47:40
Running from C:\
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(3CX Ltd) D:\Program Files (x86)\3CX Assistant\tcx.assistant.client.exe
(Geek Software GmbH) D:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(3CX Ltd) D:\Program Files (x86)\3CX Assistant\CRM\3CX Assistant CRM.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Microsoft Corporation) D:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Farbar) C:\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SunJavaUpdateSched] - c:\Program Files\Java\jre6\bin\jusched.exe [170496 2014-01-15] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [avgnt] - D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - d:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [189808 2011-07-31] (Haufe-Lexware GmbH & Co. KG)
HKCU\...\Policies\Explorer: [DisallowRun] 1
Startup: C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://d8n4mx4j/argoweb/aaf001web/Login.aspx
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE2F4D1615D05CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java Systems\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files (x86)\Java Systems\bin\jp2ssv.dll (Oracle Corporation)
Handler: haufereader - No CLSID Value - 
Handler-x32: haufereader - No CLSID Value - 
Tcpip\..\Interfaces\{63D26AE7-4F39-40B0-B427-CE9528B32860}: [NameServer]8.8.8.8,192.168.3.12

FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default
FF user.js: detected! => C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\user.js
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF NetworkProxy: "ftp", "212.144.254.124"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "212.144.254.124"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "212.144.254.124"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "212.144.254.124"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - D:\Program Files (x86)\Java Systems\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - D:\Program Files (x86)\Java Systems\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\searchplugins\dictcc.xml
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\searchplugins\ixquick-https---deutsch.xml
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\searchplugins\metapedia-de.xml
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\searchplugins\wortschatz-deutsch.xml
FF Extension: International Sideboard - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\Extensions\i18nsideboard@fxparlant.net [2013-07-18]
FF Extension: DownloadHelper - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-11-13]
FF Extension: Block site - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2013-08-10]
FF Extension: Stealthy - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\Extensions\stealthyextension@gmail.com.xpi [2013-11-14]
FF Extension: NoScript - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-02-08]
FF Extension: Adblock Plus - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-07]
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files (x86)\Mozilla Firefox\firefox.exe

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (VIS) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab [2014-01-07]
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Jan\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-01-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-06-07] (Adobe Systems)
R2 AntiVirFirewallService; D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1012280 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; D:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 Lexware_Datenbank_Plus; C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe [83248 2010-11-05] (iAnywhere Solutions, Inc.)
R2 MBAMScheduler; d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)

==================== Drivers (Whitelisted) ====================

R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-07-01] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-07-01] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-16 20:39 - 2014-01-16 20:47 - 00011935 _____ C:\FRST.txt
2014-01-16 20:35 - 2014-01-16 20:35 - 02076160 _____ (Farbar) C:\FRST64(1).exe
2014-01-16 19:58 - 2014-01-16 19:58 - 00000294 _____ C:\Windows\PFRO.log
2014-01-16 19:58 - 2014-01-16 19:58 - 00000056 _____ C:\Windows\setupact.log
2014-01-16 19:58 - 2014-01-16 19:58 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 19:07 - 2014-01-16 19:07 - 00000000 ____D C:\FRST
2014-01-16 15:30 - 2014-01-16 15:30 - 00001361 _____ C:\Users\Public\Desktop\Die Macht des Steuerzahlers.lnk
2014-01-15 14:13 - 2014-01-15 14:13 - 00000000 ____D C:\Users\Jan\AppData\Local\Netviewer
2014-01-15 14:11 - 2014-01-15 14:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Haufe Mediengruppe
2014-01-15 14:11 - 2014-01-15 14:11 - 00000000 ____D C:\Users\Jan\AppData\Local\Haufe Mediengruppe
2014-01-15 14:00 - 2014-01-15 14:00 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Lexware
2014-01-15 14:00 - 2014-01-15 14:00 - 00000000 ____D C:\Program Files (x86)\Lexware
2014-01-15 13:59 - 2014-01-15 13:59 - 00000153 _____ C:\Windows\ODBC.INI
2014-01-15 13:58 - 2014-01-15 13:58 - 00000000 ____D C:\Program Files (x86)\Sybase
2014-01-15 13:58 - 2014-01-15 13:58 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-15 13:54 - 2014-01-15 13:54 - 00002319 _____ C:\Users\Public\Desktop\TAXMAN Bibliothek 2012.lnk
2014-01-15 13:52 - 2014-01-16 08:20 - 00002669 _____ C:\Users\Public\Desktop\TAXMAN 2012.lnk
2014-01-15 13:45 - 2014-01-15 15:18 - 00000000 ____D C:\ProgramData\lexware
2014-01-15 13:45 - 2014-01-15 13:45 - 00000000 ____D C:\ProgramData\Haufe
2014-01-15 13:45 - 2014-01-15 13:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2014-01-15 13:45 - 2014-01-15 13:45 - 00000000 ____D C:\Program Files (x86)\Haufe
2014-01-15 13:45 - 2006-06-26 15:58 - 01929216 _____ (Amyuni Technologies
hxxp://www.amyuni.com) C:\Windows\SysWOW64\cdintf250.dll
2014-01-15 13:44 - 2014-01-15 13:44 - 00455680 _____ (Sun Microsystems, Inc.) C:\Windows\system32\deploytk.dll
2014-01-15 13:44 - 2014-01-15 13:44 - 00181760 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaws.exe
2014-01-15 13:44 - 2014-01-15 13:44 - 00165888 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaw.exe
2014-01-15 13:44 - 2014-01-15 13:44 - 00165888 _____ (Sun Microsystems, Inc.) C:\Windows\system32\java.exe
2014-01-15 13:44 - 2014-01-15 13:44 - 00000000 ____D C:\Program Files\Java
2014-01-15 13:42 - 2014-01-15 14:00 - 00000000 ____D C:\Users\Jan\AppData\Local\Lexware
2014-01-15 12:30 - 2014-01-15 12:30 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Thinstall
2014-01-15 12:30 - 2014-01-15 12:30 - 00000000 ____D C:\Users\Jan\AppData\Local\Thinstall
2014-01-15 08:07 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 08:07 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 08:07 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 08:07 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 08:07 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 08:07 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 08:07 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 08:07 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-09 18:05 - 2014-01-09 18:05 - 00000000 ____D C:\Users\Jan\Documents\Steuer-Sparbuch
2014-01-07 12:21 - 2014-01-07 12:21 - 00002003 _____ C:\Users\Public\Desktop\Nitro Reader.lnk
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Nitro
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\FileOpen
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Downloaded Installations
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\ProgramData\Nitro
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\ProgramData\FileOpen
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Program Files\Common Files\Nitro
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Program Files (x86)\Nitro
2014-01-07 12:21 - 2013-07-26 06:57 - 00029712 _____ (Nitro PDF Software) C:\Windows\system32\nitrolocalmon2.dll
2014-01-07 12:21 - 2013-07-26 06:57 - 00017936 _____ (Nitro PDF Software) C:\Windows\system32\nitrolocalui2.dll
2014-01-07 12:12 - 2014-01-07 12:12 - 00118784 _____ C:\Windows\system32\dmusic64.exe
2014-01-07 12:11 - 2014-01-07 12:11 - 00000000 ____D C:\Users\Jan\AppData\Local\Google
2014-01-07 12:10 - 2014-01-07 12:13 - 00000000 ____D C:\Users\Jan\AppData\Local\DownloadGuide
2014-01-07 11:32 - 2014-01-07 11:32 - 00000028 _____ C:\Users\Jan\AppData\Roaming\PhonerLitesettings.ini
2014-01-07 11:32 - 2014-01-07 11:32 - 00000000 ____D C:\Users\Jan\AppData\Roaming\PhonerLite
2014-01-05 23:25 - 2014-01-05 23:25 - 00000049 _____ C:\Users\Jan\Desktop\Fange nie an aufzuhören, höre nie auf anzufangen..txt
2014-01-05 23:17 - 2014-01-05 23:17 - 00000224 _____ C:\Users\Jan\Desktop\Nur, wer auf Reisen geht, lernt neue Leute kennen..txt
2014-01-05 15:47 - 2014-01-05 15:47 - 00001447 _____ C:\Users\Public\Desktop\Weiße Weste durch Umzug.lnk
2014-01-03 23:49 - 2014-01-03 23:50 - 00001204 _____ C:\Users\Jan\Documents\cc_20140103_234954.reg
2014-01-02 14:04 - 2014-01-02 14:04 - 00002786 _____ C:\Users\Jan\Desktop\Notizen Retail.txt
2013-12-23 23:59 - 2013-12-23 23:59 - 00000058 _____ C:\Users\Jan\Desktop\kerzen.txt
2013-12-19 16:27 - 2013-12-19 16:43 - 00001776 _____ C:\Users\Jan\Desktop\Fogal Notizen.txt
2013-12-18 23:33 - 2013-12-18 23:33 - 00000021 _____ C:\Users\Jan\Desktop\linder@futurasport.ch.txt

==================== One Month Modified Files and Folders =======

2014-01-16 20:47 - 2014-01-16 20:39 - 00011935 _____ C:\FRST.txt
2014-01-16 20:35 - 2014-01-16 20:35 - 02076160 _____ (Farbar) C:\FRST64(1).exe
2014-01-16 20:30 - 2013-09-28 07:44 - 01358258 _____ C:\Windows\WindowsUpdate.log
2014-01-16 20:07 - 2009-07-14 05:45 - 00015040 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-16 20:07 - 2009-07-14 05:45 - 00015040 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-16 20:05 - 2009-07-14 18:58 - 00696832 _____ C:\Windows\system32\perfh007.dat
2014-01-16 20:05 - 2009-07-14 18:58 - 00148128 _____ C:\Windows\system32\perfc007.dat
2014-01-16 20:05 - 2009-07-14 06:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-16 20:00 - 2013-02-07 18:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-16 19:58 - 2014-01-16 19:58 - 00000294 _____ C:\Windows\PFRO.log
2014-01-16 19:58 - 2014-01-16 19:58 - 00000056 _____ C:\Windows\setupact.log
2014-01-16 19:58 - 2014-01-16 19:58 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 19:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-16 19:43 - 2013-02-10 17:23 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Winamp
2014-01-16 19:07 - 2014-01-16 19:07 - 00000000 ____D C:\FRST
2014-01-16 15:30 - 2014-01-16 15:30 - 00001361 _____ C:\Users\Public\Desktop\Die Macht des Steuerzahlers.lnk
2014-01-16 15:30 - 2013-12-04 18:39 - 00000000 ____D C:\Program Files (x86)\Rademacher
2014-01-16 08:20 - 2014-01-15 13:52 - 00002669 _____ C:\Users\Public\Desktop\TAXMAN 2012.lnk
2014-01-16 08:07 - 2009-07-14 05:45 - 00552792 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-15 23:30 - 2013-07-28 02:00 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 23:29 - 2013-02-07 16:58 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 16:00 - 2013-02-07 18:10 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-15 16:00 - 2013-02-07 18:09 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-15 16:00 - 2013-02-07 18:09 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-15 15:18 - 2014-01-15 13:45 - 00000000 ____D C:\ProgramData\lexware
2014-01-15 14:13 - 2014-01-15 14:13 - 00000000 ____D C:\Users\Jan\AppData\Local\Netviewer
2014-01-15 14:11 - 2014-01-15 14:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Haufe Mediengruppe
2014-01-15 14:11 - 2014-01-15 14:11 - 00000000 ____D C:\Users\Jan\AppData\Local\Haufe Mediengruppe
2014-01-15 14:00 - 2014-01-15 14:00 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Lexware
2014-01-15 14:00 - 2014-01-15 14:00 - 00000000 ____D C:\Program Files (x86)\Lexware
2014-01-15 14:00 - 2014-01-15 13:42 - 00000000 ____D C:\Users\Jan\AppData\Local\Lexware
2014-01-15 14:00 - 2013-02-07 18:45 - 00146024 _____ C:\Users\Jan\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-15 14:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2014-01-15 13:59 - 2014-01-15 13:59 - 00000153 _____ C:\Windows\ODBC.INI
2014-01-15 13:58 - 2014-01-15 13:58 - 00000000 ____D C:\Program Files (x86)\Sybase
2014-01-15 13:58 - 2014-01-15 13:58 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-15 13:54 - 2014-01-15 13:54 - 00002319 _____ C:\Users\Public\Desktop\TAXMAN Bibliothek 2012.lnk
2014-01-15 13:50 - 2013-03-12 10:45 - 00000000 ____D C:\Users\Jan\AppData\Roaming\InstallShield Installation Information
2014-01-15 13:50 - 2013-02-07 16:19 - 00000000 ___RD C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-15 13:45 - 2014-01-15 13:45 - 00000000 ____D C:\ProgramData\Haufe
2014-01-15 13:45 - 2014-01-15 13:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2014-01-15 13:45 - 2014-01-15 13:45 - 00000000 ____D C:\Program Files (x86)\Haufe
2014-01-15 13:44 - 2014-01-15 13:44 - 00455680 _____ (Sun Microsystems, Inc.) C:\Windows\system32\deploytk.dll
2014-01-15 13:44 - 2014-01-15 13:44 - 00181760 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaws.exe
2014-01-15 13:44 - 2014-01-15 13:44 - 00165888 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaw.exe
2014-01-15 13:44 - 2014-01-15 13:44 - 00165888 _____ (Sun Microsystems, Inc.) C:\Windows\system32\java.exe
2014-01-15 13:44 - 2014-01-15 13:44 - 00000000 ____D C:\Program Files\Java
2014-01-15 12:30 - 2014-01-15 12:30 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Thinstall
2014-01-15 12:30 - 2014-01-15 12:30 - 00000000 ____D C:\Users\Jan\AppData\Local\Thinstall
2014-01-13 13:45 - 2013-02-07 19:13 - 00002222 ____H C:\Users\Jan\Documents\Default.rdp
2014-01-11 21:11 - 2013-11-19 22:32 - 00000654 _____ C:\Users\Jan\Desktop\Worüber alle Bürger klagen.txt
2014-01-11 06:41 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-09 18:05 - 2014-01-09 18:05 - 00000000 ____D C:\Users\Jan\Documents\Steuer-Sparbuch
2014-01-09 17:16 - 2013-03-12 11:55 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH
2014-01-09 17:14 - 2013-03-12 11:55 - 00000981 _____ C:\Windows\wiso.ini
2014-01-09 17:14 - 2013-03-12 10:46 - 00000000 ____D C:\Users\Jan\AppData\Local\Buhl
2014-01-09 15:30 - 2013-06-05 14:00 - 00000000 ____D C:\Users\Public\Documents\Kyocera
2014-01-09 09:06 - 2013-07-17 16:44 - 00000000 ____D C:\Windows\pss
2014-01-07 12:21 - 2014-01-07 12:21 - 00002003 _____ C:\Users\Public\Desktop\Nitro Reader.lnk
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Nitro
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\FileOpen
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Downloaded Installations
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\ProgramData\Nitro
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\ProgramData\FileOpen
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Program Files\Common Files\Nitro
2014-01-07 12:21 - 2014-01-07 12:21 - 00000000 ____D C:\Program Files (x86)\Nitro
2014-01-07 12:13 - 2014-01-07 12:10 - 00000000 ____D C:\Users\Jan\AppData\Local\DownloadGuide
2014-01-07 12:12 - 2014-01-07 12:12 - 00118784 _____ C:\Windows\system32\dmusic64.exe
2014-01-07 12:11 - 2014-01-07 12:11 - 00000000 ____D C:\Users\Jan\AppData\Local\Google
2014-01-07 11:32 - 2014-01-07 11:32 - 00000028 _____ C:\Users\Jan\AppData\Roaming\PhonerLitesettings.ini
2014-01-07 11:32 - 2014-01-07 11:32 - 00000000 ____D C:\Users\Jan\AppData\Roaming\PhonerLite
2014-01-05 23:25 - 2014-01-05 23:25 - 00000049 _____ C:\Users\Jan\Desktop\Fange nie an aufzuhören, höre nie auf anzufangen..txt
2014-01-05 23:17 - 2014-01-05 23:17 - 00000224 _____ C:\Users\Jan\Desktop\Nur, wer auf Reisen geht, lernt neue Leute kennen..txt
2014-01-05 15:47 - 2014-01-05 15:47 - 00001447 _____ C:\Users\Public\Desktop\Weiße Weste durch Umzug.lnk
2014-01-03 23:50 - 2014-01-03 23:49 - 00001204 _____ C:\Users\Jan\Documents\cc_20140103_234954.reg
2014-01-03 23:48 - 2013-05-28 12:49 - 00000000 ____D C:\Program Files\CCleaner
2014-01-03 03:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2014-01-02 14:04 - 2014-01-02 14:04 - 00002786 _____ C:\Users\Jan\Desktop\Notizen Retail.txt
2013-12-23 23:59 - 2013-12-23 23:59 - 00000058 _____ C:\Users\Jan\Desktop\kerzen.txt
2013-12-19 16:43 - 2013-12-19 16:27 - 00001776 _____ C:\Users\Jan\Desktop\Fogal Notizen.txt
2013-12-18 23:39 - 2009-07-14 19:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-18 23:33 - 2013-12-18 23:33 - 00000021 _____ C:\Users\Jan\Desktop\linder@futurasport.ch.txt

Some content of TEMP:
====================
C:\Users\Jan\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-09 12:48

==================== End Of Log ============================

--- --- ---
--- --- ---
--- --- ---
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.16.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Jan :: JAN-DELL [Administrator]

16.01.2014 18:51:32
mbam-log-2014-01-16 (18-51-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|N:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 374266
Laufzeit: 53 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 9
HKCR\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23} (PUP.Optional.BrowseFox.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{cbab673a-a480-4050-bd2b-5de24a7a0282} (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{39fd4ea6-c524-482a-b130-b356bfd5db87} (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{B01A1DA4-813F-44BD-B544-77E5DA7EB5A8} (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBAB673A-A480-4050-BD2B-5DE24A7A0282} (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CBAB673A-A480-4050-BD2B-5DE24A7A0282} (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\ResultsAlpha (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SYSTEM\CurrentControlSet\Services\Update ResultsAlpha (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\ResultsAlpha (PUP.Optional.ResultsAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
D:\Downloads\Betriebe.exe (Malware.Binder.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)[/CODE]

schrauber · 17.01.2014, 20:43

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

janderman · 17.01.2014, 22:25

hallo und danke, hier ist die Log-Datei.
was mir auffällt, ist, daß Firefox startpage.com nicht als startseite speichern will, bzw. immer wieder google als startseite einträgt.

ach ja, avira ließ sich nicht ganz deaktivieren. habe zwar alle optionen deaktiviert, den prozess avguard konnte ich aber nicht beenden. combifix wollte erst nach einem neustart durchlaufen - bei eingeschaltetem avira.

hat combofix alle viren erledigt?

Combofix Logfile:

Code:

ATTFilter

ComboFix 14-01-16.03 - Jan 17.01.2014  22:13:42.1.1 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4030.2956 [GMT 1:00]
ausgeführt von:: c:\users\Jan\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jan\AppData\Local\assembly\tmp
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-17 bis 2014-01-17  ))))))))))))))))))))))))))))))
.
.
2014-01-17 21:17 . 2014-01-17 21:17	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-01-16 22:37 . 2014-01-16 22:37	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2014-01-16 18:07 . 2014-01-16 18:07	--------	d-----w-	C:\FRST
2014-01-15 13:13 . 2014-01-15 13:13	--------	d-----w-	c:\users\Jan\AppData\Local\Netviewer
2014-01-15 13:11 . 2014-01-15 13:11	--------	d-----w-	c:\users\Jan\AppData\Roaming\Haufe Mediengruppe
2014-01-15 13:11 . 2014-01-15 13:11	--------	d-----w-	c:\users\Jan\AppData\Local\Haufe Mediengruppe
2014-01-15 13:00 . 2014-01-15 13:00	--------	d-----w-	c:\users\Jan\AppData\Roaming\Lexware
2014-01-15 13:00 . 2014-01-15 13:00	--------	d-----w-	c:\program files (x86)\Lexware
2014-01-15 13:00 . 2014-01-15 13:00	--------	d-----w-	c:\program files (x86)\Common Files\DataDesign
2014-01-15 12:58 . 2014-01-15 12:58	--------	d-----w-	c:\program files (x86)\Sybase
2014-01-15 12:58 . 2014-01-15 12:58	--------	d-----w-	c:\program files (x86)\Microsoft WSE
2014-01-15 12:54 . 2014-01-15 12:54	--------	d-----w-	c:\program files (x86)\Common Files\Haufe
2014-01-15 12:44 . 2014-01-15 12:44	455680	----a-w-	c:\windows\system32\deploytk.dll
2014-01-15 12:44 . 2014-01-15 12:44	181760	----a-w-	c:\windows\system32\javaws.exe
2014-01-15 12:44 . 2014-01-15 12:44	165888	----a-w-	c:\windows\system32\javaw.exe
2014-01-15 12:44 . 2014-01-15 12:44	165888	----a-w-	c:\windows\system32\java.exe
2014-01-15 12:44 . 2014-01-15 12:44	--------	d-----w-	c:\program files\Java
2014-01-15 12:44 . 2014-01-15 12:44	--------	d-----w-	c:\program files (x86)\Common Files\InstallShield
2014-01-15 12:42 . 2014-01-15 12:59	--------	d-----w-	c:\program files (x86)\Common Files\Lexware
2014-01-15 12:42 . 2014-01-17 19:29	--------	d-----w-	c:\users\Jan\AppData\Local\Lexware
2014-01-15 11:30 . 2014-01-15 11:30	--------	d-----w-	c:\users\Jan\AppData\Roaming\Thinstall
2014-01-15 11:30 . 2014-01-15 11:30	--------	d-----w-	c:\users\Jan\AppData\Local\Thinstall
2014-01-15 07:07 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-15 07:07 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-15 07:07 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-15 07:07 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-15 07:07 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-15 07:07 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-15 07:07 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-15 07:07 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\users\Jan\AppData\Roaming\Nitro
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\users\Jan\AppData\Roaming\FileOpen
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\programdata\FileOpen
2014-01-07 11:21 . 2013-07-26 05:57	29712	----a-w-	c:\windows\system32\nitrolocalmon2.dll
2014-01-07 11:21 . 2013-07-26 05:57	17936	----a-w-	c:\windows\system32\nitrolocalui2.dll
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\programdata\Nitro
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\program files\Common Files\Nitro
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\program files (x86)\Nitro
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\program files (x86)\Common Files\Nitro
2014-01-07 11:21 . 2014-01-07 11:21	--------	d-----w-	c:\users\Jan\AppData\Roaming\Downloaded Installations
2014-01-07 11:12 . 2014-01-07 11:12	118784	----a-w-	c:\windows\system32\dmusic64.exe
2014-01-07 11:11 . 2014-01-07 11:11	--------	d-----w-	c:\users\Jan\AppData\Local\Google
2014-01-07 11:10 . 2014-01-07 11:13	--------	d-----w-	c:\users\Jan\AppData\Local\DownloadGuide
2014-01-07 10:32 . 2014-01-07 10:32	--------	d-----w-	c:\users\Jan\AppData\Roaming\PhonerLite
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-15 22:29 . 2013-02-07 15:58	86054176	----a-w-	c:\windows\system32\MRT.exe
2014-01-15 15:00 . 2013-02-07 17:09	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-15 15:00 . 2013-02-07 17:09	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-12 10:03 . 2013-05-02 08:19	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-12-12 10:03 . 2013-03-27 11:38	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-12 10:03 . 2013-03-27 11:38	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-11-14 13:52 . 2013-03-27 11:38	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-11-12 02:23 . 2013-12-11 07:17	2048	----a-w-	c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-11 07:17	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2013-11-02 02:28 . 2013-12-11 07:17	1188864	----a-w-	c:\windows\system32\wininet.dll
2013-11-02 02:28 . 2013-12-11 07:17	1494528	----a-w-	c:\windows\system32\urlmon.dll
2013-11-02 02:28 . 2013-12-11 07:17	134144	----a-w-	c:\windows\system32\url.dll
2013-11-02 02:26 . 2013-12-11 07:17	9073152	----a-w-	c:\windows\system32\mshtml.dll
2013-11-02 02:26 . 2013-12-11 07:17	97792	----a-w-	c:\windows\system32\mshtmled.dll
2013-11-02 02:26 . 2013-12-11 07:17	735232	----a-w-	c:\windows\system32\msfeeds.dll
2013-11-02 02:25 . 2013-12-11 07:17	64512	----a-w-	c:\windows\system32\jsproxy.dll
2013-11-02 02:25 . 2013-12-11 07:17	247808	----a-w-	c:\windows\system32\ieui.dll
2013-11-02 02:25 . 2013-12-11 07:17	12295168	----a-w-	c:\windows\system32\ieframe.dll
2013-11-02 02:25 . 2013-12-11 07:17	2458112	----a-w-	c:\windows\system32\iertutil.dll
2013-11-02 02:07 . 2013-12-11 07:17	981504	----a-w-	c:\windows\SysWow64\wininet.dll
2013-11-02 01:30 . 2013-12-11 07:17	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2013-11-02 01:13 . 2013-12-11 07:17	1638912	----a-w-	c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"PDFPrint"="d:\program files (x86)\PDF24\pdf24.exe" [2013-07-22 162856]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2011-07-31 189808]
"avgnt"="d:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-12 684600]
.
c:\users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
3CX Assistant.lnk - d:\program files (x86)\3CX Assistant\tcx.assistant.client.exe [2011-1-3 1718784]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys;c:\windows\SYSNATIVE\DRIVERS\avfwot.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirFirewallService;Avira FireWall;d:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe;d:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]
S2 AntiVirMailService;Avira Email Schutz;d:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;d:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;d:\program files (x86)\Avira\AntiVir Desktop\sched.exe;d:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;d:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;d:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 Lexware_Datenbank_Plus;Lexware Datenbank Plus;c:\program files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe;c:\program files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe [x]
S2 MBAMScheduler;MBAMScheduler;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 NitroReaderDriverReadSpool3;NitroPDFReaderDriverCreatorReadSpool3;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [x]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys;c:\windows\SYSNATIVE\DRIVERS\avfwim.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-07 15:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2014-01-15 170496]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://d8n4mx4j/argoweb/aaf001web/Login.aspx
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: d:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
Trusted Zone: argoserver
Trusted Zone: d8n4mx4j
TCP: Interfaces\{63D26AE7-4F39-40B0-B427-CE9528B32860}: NameServer = 8.8.8.8,192.168.3.12
FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de?hl=de&gl=de
FF - prefs.js: keyword.URL - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - prefs.js: network.proxy.ftp - 212.144.254.124
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - 212.144.254.124
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 212.144.254.124
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 212.144.254.124
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 0
FF - user.js: browser.search.defaultenginename - Google
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.startup.homepage - hxxp://www.google.de?hl=de&gl=de
FF - user.js: browser.search.defaulturl - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: keyword.URL - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: browser.urlbar.autoFill - false//;
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6} - c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
ShellIconOverlayIdentifiers-{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD} - c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
ShellIconOverlayIdentifiers-{95DDC869-FC98-4D47-BD34-2EDC9AA09C01} - c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
ShellIconOverlayIdentifiers-{2CDD871E-60EB-40BD-9721-A1CB57042F75} - c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Vermieter_EH - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,90,b6,dd,38,b4,78,bf,4e,a6,4a,48,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,90,b6,dd,38,b4,78,bf,4e,a6,4a,48,\
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.1_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.1_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.4.2"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_14"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_15"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_16"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_17"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_18"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_19"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_20"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_21"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_22"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_23"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_24"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_25"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_26"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_27"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_28"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_29"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0_30"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.5.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_01"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_02"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_03"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_04"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_05"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_06"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_07"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_08"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_09"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_10"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_11"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_12"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0_13"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.6.0"
.
[HKEY_USERS\S-1-5-21-4019943153-3155376754-28934529-1000_Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
@DACL=(02 0000)
@="Java Plug-in 1.3.0_02"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-17  22:18:42
ComboFix-quarantined-files.txt  2014-01-17 21:18
.
Vor Suchlauf: 4.302.557.184 Bytes frei
Nach Suchlauf: 4.169.297.920 Bytes frei
.
- - End Of File - - 25BF45B4FD122F8E9EEEC1C76243955B

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31
[/CODE]

schrauber · 18.01.2014, 09:56

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

janderman · 18.01.2014, 12:26

hallo, hier die log-dateien:

Code:

ATTFilter

 Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.18.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Jan :: JAN-DELL [Administrator]

18.01.2014 10:45:28
mbam-log-2014-01-18 (10-45-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|N:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 376433
Laufzeit: 57 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

JRT Logfile:

Code:

ATTFilter

 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Professional x64
Ran by Jan on 18.01.2014 at 12:03:08,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4019943153-3155376754-28934529-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.01.2014 at 12:10:02,82
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- --- ---
[CODE]

JRT Logfile:

Code:

ATTFilter

 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Professional x64
Ran by Jan on 18.01.2014 at 12:03:08,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4019943153-3155376754-28934529-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.01.2014 at 12:10:02,82
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- --- ---

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.017 - Bericht erstellt am 18/01/2014 um 11:57:12
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Jan - JAN-DELL
# Gestartet von : C:\Users\Jan\Desktop\adwcleaner(1).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Jan\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\Jan\AppData\Local\thinstall
Ordner Gelöscht : C:\Users\Jan\AppData\Roaming\thinstall
Ordner Gelöscht : C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab
Datei Gelöscht : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Mozilla Firefox v22.0 (de)

[ Datei : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\dj1uindl.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1506 octets] - [18/01/2014 11:52:10]
AdwCleaner[S0].txt - [1429 octets] - [18/01/2014 11:57:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1489 octets] ##########

--- --- ---

bei FRST64 kam folgende Fehlermeldung: "error: variable used without being declared"

das FRST konnte also nicht durchlaufen

schrauber · 19.01.2014, 09:33

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

janderman · 19.01.2014, 15:57

hallo, ich habe dir gestern geschrieben, daß FRST bei mir nicht mehr funktioniert. Daher kann ich auch keine FRST-Log-Datei senden. Ansonsten hier die beiden von Dir angeforderten Log-Dateien:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=0b631960e46f6d40b606f113887b70f0
# engine=16706
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-19 02:43:38
# local_time=2014-01-19 03:43:38 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 16628515 141772468 0 0
# scanned=173796
# found=0
# cleaned=0
# scan_time=17258

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.79  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 xp-AntiSpy 3.98-2    
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 45  
 Java version out of Date! 
 Adobe Flash Player 11.9.900.170  
 Adobe Reader XI  
 Mozilla Firefox 22.0 Firefox out of Date!  
 Mozilla Thunderbird (24.2.0) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

und fast hätte ich es vergessen: hier noch die Addition-Datei des FRST-Scans vom Donnerstag, die hatte ich nämlich vergessen:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2014 03
Ran by Jan at 2014-01-16 19:10:46
Running from D:\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 2 (SP2) (x32 Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 2 (SP2) (x32 Version:  - Microsoft) Hidden
3CX Assistant (Version: 9.0.15770 - 3CX Ltd)
Adobe Bridge 1.0 (x32 Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (x32 Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe InDesign CS2 (x32 Version: 004.000.000 - Adobe Systems Incorporated)
Adobe InDesign CS2 (x32 Version: 004.000.000 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Stock Photos 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Advanced Archive Password Recovery (x32 Version: 4.54.48.1338 - Elcomsoft Co. Ltd.)
AntragsManager (x32 Version:  - )
Avira Internet Security (x32 Version: 14.0.2.286 - Avira)
CCleaner (Version: 4.09 - Piriform)
Die Macht der Selbstbeherrschung (x32 Version:  - )
Die Macht des Steuerzahlers (x32 Version:  - )
Free YouTube Download version 3.2.10.812 (x32 Version: 3.2.10.812 - DVDVideoSoft Ltd.)
Google Update Helper (x32 Version: 1.3.21.145 - Google Inc.) Hidden
Haufe iDesk-Browser (x32 Version: 10.10.14.0000 - Haufe-Lexware GmbH & Co. KG)
Haufe iDesk-Service (x32 Version: 11.07.19.8023 - Haufe)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 13 (64-bit) (Version: 6.0.130 - Sun Microsystems, Inc.)
Kyocera Product Library (Version: 2.0.0713 - Kyocera Mita Corporation)
Lexware Admintools Plus (x32 Version: 11.00.00.0066 - Haufe-Lexware GmbH & Co.KG)
Lexware buchhalter 2012 (x32 Version: 17.02.00.0185 - Haufe-Lexware GmbH & Co.KG)
Lexware Datenbank plus 2011 (x32 Version: 11.00.00.0074 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (x32 Version: 11.00.00.0109 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (x32 Version: 2.80.00.0007 - Haufe-Lexware GmbH & Co.KG)
Lexware online banking (x32 Version: 11.00.00.0039 - Haufe-Lexware GmbH & Co.KG)
Lexware reisekosten plus 2011 (x32 Version: 11.22.00.0124 - ) Hidden
Lexware reisekosten plus 2011 (x32 Version: 11.22.00.0124 - Haufe-Lexware GmbH & Co.KG)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office Professional 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6425.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (x32 Version: 4.0.51204.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft-Maus- und Tastatur-Center (Version: 2.0.162.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.0.162.0 - Microsoft Corporation) Hidden
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0 - Mozilla)
Mozilla Firefox 26.0 (x86 de) (HKCU Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 24.2.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla)
Nitro Reader 3 (Version: 3.5.6.5 - Nitro)
PDF24 Creator 5.7.0 (x32 Version:  - PDF24.org)
PhonerLite 1.95 (x32 Version: 1.95 - sipgate GmbH)
SumatraPDF (x32 Version: 2.4 - Krzysztof Kowalczyk)
TAXMAN 2012 (x32 Version: 18.09.00.0004 - Haufe-Lexware GmbH & Co.KG)
TAXMAN Bibliothek 2012 (x32 Version: 18.1.0.0 - Haufe-Lexware GmbH & Co. KG)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft Office Word 2007 (KB974631) (x32 Version:  - Microsoft)
Vermieter-Ratgeber (x32 Version:  - )
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0 - Microsoft Corporation) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version:  - Microsoft Corporation)
VLC media player 1.1.5 (x32 Version: 1.1.5 - VideoLAN)
Weiße Weste durch Umzug (x32 Version:  - )
Winamp (x32 Version: 5.61  - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1 - Nullsoft, Inc)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.00 beta 3 (64-bit) (Version: 4.00.3 - win.rar GmbH)
WISO Hausverwalter 2013 (HKCU Version: 7.00.7718 - Buhl Data Service GmbH)
WISO Sparbuch 2010 (HKCU Version: 17.10.6777 - Buhl Data Service GmbH)
xp-AntiSpy 3.98-2 (x32 Version:  - Christian Taubenheim)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {19E1E6A4-15E5-4081-B990-0617BD4C74E6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-15] (Adobe Systems Incorporated)
Task: {B3A26813-5065-4889-A3B3-742CCDE54634} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {DC668594-341C-4A20-9B8E-E87434ABBF02} - \CreateChoiceProcessTask No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-02-11 09:27 - 2013-07-01 19:26 - 00394824 _____ () D:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-07-01 19:29 - 2013-07-01 19:26 - 00447848 _____ () D:\Program Files (x86)\Avira\AntiVir Desktop\libxml2.dll
2013-07-01 19:29 - 2013-07-01 19:26 - 00060264 _____ () D:\Program Files (x86)\Avira\AntiVir Desktop\cares.dll
2010-11-24 16:00 - 2010-11-24 16:00 - 00019456 _____ () D:\Program Files (x86)\3CX Assistant\3cxtapiclient.dll
2010-11-24 10:46 - 2010-11-24 10:46 - 00024848 _____ () D:\Program Files (x86)\3CX Assistant\avfilters\wavdest.ax
2010-11-24 10:46 - 2010-11-24 10:46 - 00270336 _____ () D:\Program Files (x86)\3CX Assistant\avfilters\lame.ax
2010-11-24 10:46 - 2010-11-24 10:46 - 03843584 _____ () D:\Program Files (x86)\3CX Assistant\ffdshow\ffdshow.ax
2010-11-24 10:46 - 2010-11-24 10:46 - 05210449 _____ () D:\Program Files (x86)\3CX Assistant\ffdshow\libavcodec.dll
2010-11-24 10:46 - 2010-11-24 10:46 - 00901509 _____ () D:\Program Files (x86)\3CX Assistant\ffdshow\xvidcore.dll
2010-11-24 10:46 - 2010-11-24 10:46 - 00962008 _____ () D:\Program Files (x86)\3CX Assistant\ffdshow\ff_x264.dll
2010-11-24 10:46 - 2010-11-24 10:46 - 00100864 _____ () D:\Program Files (x86)\3CX Assistant\ffdshow\ff_wmv9.dll
2010-11-24 10:46 - 2010-11-24 10:46 - 00157184 _____ () D:\Program Files (x86)\3CX Assistant\avfilters\libspeexdsp.dll
2011-07-19 06:26 - 2011-07-19 06:26 - 00071024 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\zlib.pyd
2011-07-19 06:33 - 2011-07-19 06:33 - 00103792 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\pywintypes24.dll
2011-07-19 06:34 - 2011-07-19 06:34 - 00032112 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32process.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00019312 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32event.pyd
2011-07-19 06:27 - 2011-07-19 06:27 - 00054640 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\_socket.pyd
2011-07-19 06:27 - 2011-07-19 06:27 - 00017264 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\_ssl.pyd
2011-07-19 06:21 - 2011-07-19 06:21 - 00832880 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\LIBEAY32.dll
2011-07-19 06:21 - 2011-07-19 06:21 - 00161136 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\SSLEAY32.dll
2011-07-19 06:34 - 2011-07-19 06:34 - 00075120 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32api.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00019312 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32evtlog.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00095600 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32gui.pyd
2011-07-19 06:33 - 2011-07-19 06:33 - 00316784 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\pythoncom24.dll
2011-07-19 06:35 - 2011-07-19 06:35 - 00124272 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32comext\shell\shell.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00011120 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\timer.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00037744 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32service.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00083312 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32file.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00021360 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32pipe.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00107888 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32security.pyd
2011-07-19 06:34 - 2011-07-19 06:34 - 00029552 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Lib\site-packages\win32\servicemanager.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00021360 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\persistent.cPersistence.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00014192 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\persistent.TimeStamp.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00020848 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\persistent.cPickleCache.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00026480 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\Acquisition._Acquisition.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00020848 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\ExtensionClass._ExtensionClass.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00010608 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\ComputedAttribute._ComputedAttribute.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00026992 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\AccessControl.cAccessControl.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00013168 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\Record._Record.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00020336 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\DocumentTemplate.cDocumentTemplate.pyd
2011-07-19 06:26 - 2011-07-19 06:26 - 00140656 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\pyexpat.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00058736 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._OOBTree.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00062832 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._OIBTree.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00062832 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._IOBTree.pyd
2011-07-19 07:49 - 2011-07-19 07:49 - 00062832 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._IIBTree.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00011120 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\Persistence._Persistence.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00010096 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\MethodObject._MethodObject.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00011120 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\Missing._Missing.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00011632 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\MultiMapping._MultiMapping.pyd
2011-07-19 06:26 - 2011-07-19 06:26 - 00013680 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\DLLs\select.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00010096 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\ZODB.winlock.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00010096 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\Products.ZCTextIndex.stopper.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00010096 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\Products.ZCTextIndex.okascore.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00341360 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\_jpype.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00013168 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\TextIndexNG2\normalizer.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00012656 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\TextIndexNG2\indexsupport.pyd
2010-10-14 06:38 - 2010-10-14 06:38 - 00583168 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\OSR32V10.dll
2011-07-19 07:49 - 2011-07-19 07:49 - 00062832 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._fsBTree.pyd
2011-07-19 07:50 - 2011-07-19 07:50 - 00271728 _____ () c:\Program Files (x86)\Haufe\iDesk\iDeskService\Zope\lib\python\M2Crypto.__m2crypto.pyd
2013-04-29 09:50 - 2013-04-29 09:50 - 00876544 _____ () D:\Program Files (x86)\Lexware\taxman\2012\Base.dll
2013-04-29 09:48 - 2013-04-29 09:48 - 00357888 _____ () D:\Program Files (x86)\Lexware\taxman\2012\Steuer.Interop.Base.dll
2013-04-29 08:51 - 2013-04-29 08:51 - 00167424 _____ () D:\Program Files (x86)\Lexware\taxman\2012\AfaCalc.dll
2013-04-29 08:50 - 2013-04-29 08:50 - 00363008 _____ () D:\Program Files (x86)\Lexware\taxman\2012\Steuer.Interop.DataAccess.dll
2013-04-29 08:47 - 2013-04-29 08:47 - 00081920 _____ () D:\Program Files (x86)\Lexware\taxman\2012\Assert.dll
2013-04-29 08:53 - 2013-04-29 08:53 - 00439808 _____ () D:\Program Files (x86)\Lexware\taxman\2012\BkgEnv.dll
2013-04-29 08:52 - 2013-04-29 08:52 - 00672256 _____ () D:\Program Files (x86)\Lexware\taxman\2012\Common.dll
2013-04-29 08:52 - 2013-04-29 08:52 - 00216576 _____ () D:\Program Files (x86)\Lexware\taxman\2012\DataAccess.dll
2013-04-29 09:00 - 2013-04-29 09:00 - 01374720 _____ () D:\Program Files (x86)\Lexware\taxman\2012\ECVar.dll
2013-04-29 10:01 - 2013-04-29 10:01 - 01968640 _____ () D:\Program Files (x86)\Lexware\taxman\2012\EstCalc.dll
2013-04-29 08:52 - 2013-04-29 08:52 - 00481280 _____ () D:\Program Files (x86)\Lexware\taxman\2012\FEC.Mediator.dll
2013-04-29 08:50 - 2013-04-29 08:50 - 00278528 _____ () D:\Program Files (x86)\Lexware\taxman\2012\Steuer.Interop.UI.Windows.dll
2013-04-29 08:47 - 2013-04-29 08:47 - 01595904 _____ () D:\Program Files (x86)\Lexware\taxman\2012\SteuerRes.dll
2013-04-29 08:47 - 2013-04-29 08:47 - 02089472 _____ () D:\Program Files (x86)\Lexware\taxman\2012\LookT.dll
2009-07-13 22:03 - 2009-07-14 02:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll
2013-04-29 08:50 - 2013-04-29 08:50 - 00110592 _____ () D:\Program Files (x86)\Lexware\taxman\2012\LxActiveCtrl.dll
2009-02-14 05:04 - 2009-02-14 05:04 - 00756040 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2011-03-22 19:38 - 2013-02-10 17:24 - 00410624 _____ () D:\Program Files (x86)\Winamp\nsutil.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00079360 _____ () D:\Program Files (x86)\Winamp\nde.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00047616 _____ () D:\Program Files (x86)\Winamp\zlib.dll
2014-01-16 15:59 - 2014-01-16 15:59 - 00010752 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\auth.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00069120 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\burnlib.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00013824 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\dsp_sps.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00009728 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\enc_aacplus.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\enc_flac.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005632 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\enc_lame.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\enc_vorbis.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\enc_wav.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00006144 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\enc_wma.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00023552 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_classicart.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00007168 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_crasher.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00023040 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_ff.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_find_on_disk.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00011264 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_hotkeys.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00041984 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_jumpex.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00021504 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_ml.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00009216 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_nopro.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00007168 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_orgler.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00011776 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_skinmanager.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00010240 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_timerestore.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00008192 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_tray.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00010752 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\gen_undo.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005120 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_avi.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00014336 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_cdda.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00006656 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_dshow.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005632 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_flac.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003584 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_flv.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003584 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_linein.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00020480 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_midi.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004608 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_mkv.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00018944 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_mod.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00023040 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_mp3.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005120 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_mp4.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00011776 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_nsv.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003584 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_swf.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00011264 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_vorbis.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00006656 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_wav.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005632 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_wave.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00015360 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_wm.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004608 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\in_wv.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003584 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_addons.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00006656 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_autotag.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005120 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_bookmarks.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00008704 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_devices.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00047616 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_disc.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00009728 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_downloads.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004608 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_enqplay.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00008704 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_history.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005120 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_impex.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00056320 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_local.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003584 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_nowplaying.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00014336 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_online.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_orb.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00012800 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_playlists.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00034816 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_plg.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00047104 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_pmp.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00005120 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_rg.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00008192 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_transcode.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00014848 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ml_wire.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00036352 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\ombrowser.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00006144 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\out_disk.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00016384 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\out_ds.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00007680 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\out_wave.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003072 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\playlist.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004608 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_activesync.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00020480 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_android.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00036864 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_ipod.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00003584 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_njb.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_p4s.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00011776 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_usb.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00039424 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\pmp_wifi.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00006144 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\tagz.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00088064 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\vis_avs.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00155648 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\vis_milk2.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00007680 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\vis_nsfs.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00205312 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\winamp.lng
2014-01-16 15:59 - 2014-01-16 15:59 - 00004096 _____ () C:\Users\Jan\AppData\Local\Temp\WLZD908.tmp\winampa.lng
2011-03-22 19:38 - 2013-02-10 17:24 - 00023040 _____ () D:\Program Files (x86)\Winamp\System\albumart.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00174080 _____ () D:\Program Files (x86)\Winamp\System\auth.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00019456 _____ () D:\Program Files (x86)\Winamp\System\bmp.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00044544 _____ () D:\Program Files (x86)\Winamp\System\devices.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00016896 _____ () D:\Program Files (x86)\Winamp\System\dlmgr.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00014336 _____ () D:\Program Files (x86)\Winamp\System\filereader.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00019456 _____ () D:\Program Files (x86)\Winamp\System\gif.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00016384 _____ () D:\Program Files (x86)\Winamp\System\gracenote.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00623616 _____ () D:\Program Files (x86)\Winamp\System\jnetlib.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00154624 _____ () D:\Program Files (x86)\Winamp\System\jpeg.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00084480 _____ () D:\Program Files (x86)\Winamp\System\playlist.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00103936 _____ () D:\Program Files (x86)\Winamp\System\png.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00013824 _____ () D:\Program Files (x86)\Winamp\System\primo.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00021504 _____ () D:\Program Files (x86)\Winamp\System\tagz.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00035328 _____ () D:\Program Files (x86)\Winamp\System\timer.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00090112 _____ () D:\Program Files (x86)\Winamp\System\xml.w5s
2011-03-22 19:38 - 2013-02-10 17:24 - 00068608 _____ () D:\Program Files (x86)\Winamp\Plugins\in_avi.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00102400 _____ () D:\Program Files (x86)\Winamp\Plugins\in_cdda.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00072192 _____ () D:\Program Files (x86)\Winamp\Plugins\in_dshow.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00060928 _____ () D:\Program Files (x86)\Winamp\Plugins\in_flac.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00043008 _____ () D:\Program Files (x86)\Winamp\Plugins\in_flv.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00109568 _____ () D:\Program Files (x86)\Winamp\Plugins\in_midi.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00049152 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mkv.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00165376 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mod.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00288768 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mp3.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00050688 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mp4.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00074752 _____ () D:\Program Files (x86)\Winamp\Plugins\in_nsv.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00023552 _____ () D:\Program Files (x86)\Winamp\Plugins\in_swf.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00252416 _____ () D:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00016896 _____ () D:\Program Files (x86)\Winamp\Plugins\in_wave.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00253440 _____ () D:\Program Files (x86)\Winamp\libsndfile.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00313344 _____ () D:\Program Files (x86)\Winamp\Plugins\in_wm.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00022528 _____ () D:\Program Files (x86)\Winamp\Plugins\out_disk.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00052224 _____ () D:\Program Files (x86)\Winamp\Plugins\out_ds.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00018432 _____ () D:\Program Files (x86)\Winamp\Plugins\out_wave.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 01737728 _____ () D:\Program Files (x86)\Winamp\Plugins\gen_ff.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00083968 _____ () D:\Program Files (x86)\Winamp\tataki.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00340992 _____ () D:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac
2011-03-22 19:38 - 2013-02-10 17:24 - 00180224 _____ () D:\Program Files (x86)\Winamp\libmp4v2.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00027648 _____ () D:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll
2010-11-10 18:29 - 2013-02-10 17:24 - 00183808 _____ () D:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00312832 _____ () D:\Program Files (x86)\Winamp\Plugins\gen_ml.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00293888 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_local.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00082944 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00126464 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_online.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00250368 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_devices.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00200704 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_disc.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00240640 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00060928 _____ () D:\Program Files (x86)\Winamp\Plugins\pmp_android.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00171008 _____ () D:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00020480 _____ () D:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00118272 _____ () D:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00053760 _____ () D:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00113152 _____ () D:\Program Files (x86)\Winamp\Plugins\pmp_wifi.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00027648 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00052224 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_history.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00028672 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00057344 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_impex.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00083456 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_plg.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00033792 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_rg.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00031744 _____ () D:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00057344 _____ () D:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll
2011-03-22 19:38 - 2013-02-10 17:24 - 00025600 _____ () D:\Program Files (x86)\Winamp\Plugins\gen_tray.dll
2013-12-20 11:40 - 2013-12-20 11:40 - 03559024 _____ () D:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/16/2014 08:57:32 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "asmv2:clrClassInvocation1". Fehler in Manifest- oder Richtliniendatei "asmv2:clrClassInvocation2" in Zeile asmv2:clrClassInvocation3.
Das asmv2:clrClassInvocation-Element wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^entryPoint-Elements angezeigt, das von dieser Windows-Version nicht unterstützt wird.

Error: (01/15/2014 11:27:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EXCEL.EXE, Version: 12.0.6425.1000, Zeitstempel: 0x49d64dd6
Name des fehlerhaften Moduls: EXCEL.EXE, Version: 12.0.6425.1000, Zeitstempel: 0x49d64dd6
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000761bb
ID des fehlerhaften Prozesses: 0x1278
Startzeit der fehlerhaften Anwendung: 0xEXCEL.EXE0
Pfad der fehlerhaften Anwendung: EXCEL.EXE1
Pfad des fehlerhaften Moduls: EXCEL.EXE2
Berichtskennung: EXCEL.EXE3

Error: (01/15/2014 05:18:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EXCEL.EXE, Version: 12.0.6425.1000, Zeitstempel: 0x49d64dd6
Name des fehlerhaften Moduls: EXCEL.EXE, Version: 12.0.6425.1000, Zeitstempel: 0x49d64dd6
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000131a6
ID des fehlerhaften Prozesses: 0x1278
Startzeit der fehlerhaften Anwendung: 0xEXCEL.EXE0
Pfad der fehlerhaften Anwendung: EXCEL.EXE1
Pfad des fehlerhaften Moduls: EXCEL.EXE2
Berichtskennung: EXCEL.EXE3

Error: (01/15/2014 01:54:54 PM) (Source: MsiInstaller) (User: Jan-Dell)
Description: Produkt: TAXMAN Bibliothek 2012 -- Festplatte voll: Nicht genügend freier Speicher auf der Festplatte -- Laufwerk: "c:"; benötigter Speicher: 481.401 KB; verfügbarer Speicher: 302.664 KB. Geben Sie einigen Festplattenspeicher frei und wiederholen Sie den Vorgang.

Error: (01/15/2014 01:52:13 PM) (Source: MsiInstaller) (User: Jan-Dell)
Description: Produkt: TAXMAN 2012 -- Festplatte voll: Nicht genügend freier Speicher auf der Festplatte -- Laufwerk: "C:"; benötigter Speicher: 390.278 KB; verfügbarer Speicher: 376.328 KB. Geben Sie einigen Festplattenspeicher frei und wiederholen Sie den Vorgang.

Error: (01/15/2014 01:47:50 PM) (Source: MsiInstaller) (User: Jan-Dell)
Description: Produkt: TAXMAN 2012 -- Festplatte voll: Nicht genügend freier Speicher auf der Festplatte -- Laufwerk: "C:"; benötigter Speicher: 390.278 KB; verfügbarer Speicher: 376.328 KB. Geben Sie einigen Festplattenspeicher frei und wiederholen Sie den Vorgang.

Error: (01/15/2014 01:47:48 PM) (Source: MsiInstaller) (User: Jan-Dell)
Description: Produkt: TAXMAN 2012 -- Festplatte voll: Nicht genügend freier Speicher auf der Festplatte -- Laufwerk: "C:"; benötigter Speicher: 390.278 KB; verfügbarer Speicher: 344.728 KB. Geben Sie einigen Festplattenspeicher frei und wiederholen Sie den Vorgang.

Error: (01/15/2014 01:47:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0x1288
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (01/13/2014 06:23:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "asmv2:clrClassInvocation1". Fehler in Manifest- oder Richtliniendatei "asmv2:clrClassInvocation2" in Zeile asmv2:clrClassInvocation3.
Das asmv2:clrClassInvocation-Element wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^entryPoint-Elements angezeigt, das von dieser Windows-Version nicht unterstützt wird.

Error: (01/12/2014 02:56:00 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0xc80
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3


System errors:
=============
Error: (01/16/2014 09:03:43 AM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/16/2014 08:07:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/16/2014 08:05:43 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/15/2014 01:55:13 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/15/2014 01:45:29 PM) (Source: DCOM) (User: )
Description: C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe -Embedding740{E9513610-F218-4DDA-B954-2C7E6BA7CABB}

Error: (01/15/2014 08:01:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/14/2014 06:42:53 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/13/2014 03:26:17 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/13/2014 09:13:47 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/12/2014 06:50:33 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (01/15/2014 11:27:43 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 49748 seconds with 4680 seconds of active time.  This session ended with a crash.

Error: (10/24/2013 08:09:57 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 39672 seconds with 420 seconds of active time.  This session ended with a crash.

Error: (10/22/2013 10:54:33 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 49925 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (10/18/2013 01:59:01 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8371 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (10/14/2013 01:54:01 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 20834 seconds with 360 seconds of active time.  This session ended with a crash.

Error: (09/22/2013 00:34:11 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 101 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (09/15/2013 09:45:28 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/22/2013 03:04:15 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 18990 seconds with 1440 seconds of active time.  This session ended with a crash.

Error: (07/07/2013 11:19:14 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7520 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (07/01/2013 08:34:42 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1996 seconds with 0 seconds of active time.  This session ended with a crash.

schrauber · 20.01.2014, 12:59

Java und Firefox updaten. Noch Probleme?

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).

Doppelklick auf die OTL.exe
Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimal Ausgabe
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

janderman · 20.01.2014, 13:27

hallo und Danke! Hier die beiden log-dateien. Allerdings verbindet sich Firefox nicht mehr korrekt mit dem Netz. DuckDuckGo geht ganz langsam und zäh, google garnicht mehr. IE dagegen schon. Hat vll. was mit dem Java-Update zu tun, das ich vorher runtergeladen habe. Wenn ich außerdem Youtube-Videos anschaue, stoppt nach wie manchmal vor das Plugin und Firefox hängt für ca. eine 1/2 Minute.

OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 20.01.2014 13:09:27 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Jan\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,94 Gb Total Physical Memory | 2,60 Gb Available Physical Memory | 66,17% Memory free
7,87 Gb Paging File | 6,09 Gb Available in Paging File | 77,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 50,78 Gb Total Space | 2,79 Gb Free Space | 5,50% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 49,27 Gb Free Space | 72,08% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive G: | 3,73 Gb Total Space | 3,55 Gb Free Space | 95,10% Space Free | Partition Type: FAT32
Drive N: | 465,65 Gb Total Space | 385,91 Gb Free Space | 82,88% Space Free | Partition Type: FAT32
 
Computer Name: JAN-DELL | User Name: Jan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "d:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "d:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "d:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "d:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B0F82C7-C69C-4F64-9B66-85A69E14CE35}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{230EAA96-BB8A-464B-9780-CED79258E042}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{51223AA4-2A0D-4693-9BD1-C246E38CF96B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{68F42C8A-2542-4ECB-9CF0-6376C67A937E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6C1961A3-257B-462F-B0FB-F13E492F2ABF}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{6C2167CB-B1BF-40D9-B9CD-BD73CE331003}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{7841CED6-4ABB-45AA-BF22-7069652F1902}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{86FF26C7-3091-4591-AEB7-CB0AD916DEB7}" = lport=6004 | protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office12\outlook.exe | 
"{8F050D59-D63C-47E4-94FA-609EEE6E477C}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A226A35E-A37C-4C47-AF38-50A9821BE9B8}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{DA304FBD-7FFD-4CEB-AC2C-5D126777EA6F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{25FD692F-474D-4F58-81CB-1BDD10AE0709}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{2CACBBB0-958B-4F6D-8298-64D4487BA77F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{2D159253-5FB7-4F83-82CC-5E972B715F42}" = protocol=17 | dir=in | app=d:\program files (x86)\voipcheapcom\voipcheapcom.exe | 
"{32EF9AA5-4C43-47AE-A2B5-DFFBD7D1DE39}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{41F9F877-D934-46ED-972E-536B47EBCDDD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{48C97AF7-FF54-4F82-B07F-EA8CD74E2D0F}" = protocol=17 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe | 
"{57CD38FF-3952-4C0F-B9C3-EA87A977DAF9}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{611EF8AF-5904-4722-BFEB-030FBC0D9531}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6AF61486-98AA-44D7-92AC-2AD1F967C4D1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{6EEFA939-A8BC-49D3-A6F6-13BB7E03EF96}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{6EFB79AB-91B6-43AD-8DCB-1A99969E064E}" = protocol=6 | dir=out | app=system | 
"{6F4F3120-DE14-4222-AD46-6C5578D90F06}" = dir=in | app=d:\program files (x86)\apowersoft\video converter studio\video converter studio.exe | 
"{7207A22B-5233-4302-9C52-E76352A712AF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8844117C-C63F-4DB1-934C-65DA2EFE94EF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{908D7F3E-9C21-44FA-9F15-194748E5B113}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{91E1878B-E43F-4DFA-A29C-61F6E98B9CCA}" = protocol=6 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe | 
"{A2F39696-5D7B-4F38-9A36-CE74398231EB}" = protocol=6 | dir=in | app=d:\program files (x86)\voipcheapcom\voipcheapcom.exe | 
"{BEE60F2C-AA7F-4371-868F-3302074307F0}" = dir=out | app=d:\program files (x86)\apowersoft\video converter studio\video converter studio.exe | 
"{C520B71B-9D4B-4BCE-93E4-97AABA7D8464}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D6EA83EB-FD8F-4207-87FC-AEDDCCB16140}" = protocol=6 | dir=in | app=d:\program files (x86)\3cx assistant\tcx.assistant.client.exe | 
"{E38A18D4-D14B-4A21-8289-1F35121E911F}" = protocol=17 | dir=in | app=d:\program files (x86)\3cx assistant\tcx.assistant.client.exe | 
"{E7D3FC64-EE59-40BD-8B89-CA77BB95F162}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{EF7D9D0F-0F6D-4460-98EA-04EE3C0F2218}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{0A6D6695-DEAD-45E5-B9C6-0F8AA56AED68}D:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=d:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{113DAE7D-C063-46C2-8681-1B3B8683D40E}D:\program files (x86)\phonerlite\phonerlite.exe" = protocol=6 | dir=in | app=d:\program files (x86)\phonerlite\phonerlite.exe | 
"TCP Query User{15BE4A88-7628-48CB-A3B7-CBEA98F6A67D}D:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe" = protocol=6 | dir=in | app=d:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe | 
"TCP Query User{3648D3E6-187F-405F-AA78-4DBEF653C89A}D:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe" = protocol=6 | dir=in | app=d:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe | 
"TCP Query User{372CDD52-5CF4-45E5-9C17-44E255AD6BEA}D:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=d:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{5CE8FD73-C737-49AD-9FD7-54DBADDC54EE}D:\program files (x86)\microsoft office\office12\outlook.exe" = protocol=6 | dir=in | app=d:\program files (x86)\microsoft office\office12\outlook.exe | 
"TCP Query User{61373FF2-30C3-4F03-9463-554C3CDFD7B0}D:\program files (x86)\voipcheapcom\voipcheapcom.exe" = protocol=6 | dir=in | app=d:\program files (x86)\voipcheapcom\voipcheapcom.exe | 
"TCP Query User{644866F9-2264-4451-A9F3-F0413D7B54EB}D:\program files (x86)\3cx assistant\3cxphone.exe" = protocol=6 | dir=in | app=d:\program files (x86)\3cx assistant\3cxphone.exe | 
"TCP Query User{B29DE417-14DD-4709-A5E7-75CAEBD5AFBD}C:\users\jan\appdata\local\thinstall\cache\stubs\5a7088e26595d67a19d0cab498e66a24f88a6cba\wswc.exe" = protocol=6 | dir=in | app=c:\users\jan\appdata\local\thinstall\cache\stubs\5a7088e26595d67a19d0cab498e66a24f88a6cba\wswc.exe | 
"TCP Query User{BA6A620C-02B1-49B1-83CE-8CD9DB9F9FF6}D:\program files (x86)\java systems\bin\java.exe" = protocol=6 | dir=in | app=d:\program files (x86)\java systems\bin\java.exe | 
"TCP Query User{C667FD74-514A-4E50-91D2-68CA9739EED1}D:\program files (x86)\3cx assistant\3cxphone.exe" = protocol=6 | dir=in | app=d:\program files (x86)\3cx assistant\3cxphone.exe | 
"UDP Query User{17336AE4-BF92-470A-8DAF-A1D3E43519F1}D:\program files (x86)\voipcheapcom\voipcheapcom.exe" = protocol=17 | dir=in | app=d:\program files (x86)\voipcheapcom\voipcheapcom.exe | 
"UDP Query User{188F2E16-3D17-478F-AE41-E9734C860350}D:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=d:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{3466B1AA-DCEC-41B6-9929-6878865256C8}D:\program files (x86)\java systems\bin\java.exe" = protocol=17 | dir=in | app=d:\program files (x86)\java systems\bin\java.exe | 
"UDP Query User{34D28EBF-EA3D-4ED6-BCB3-863D1DFC1D9E}C:\users\jan\appdata\local\thinstall\cache\stubs\5a7088e26595d67a19d0cab498e66a24f88a6cba\wswc.exe" = protocol=17 | dir=in | app=c:\users\jan\appdata\local\thinstall\cache\stubs\5a7088e26595d67a19d0cab498e66a24f88a6cba\wswc.exe | 
"UDP Query User{3695AB65-468D-41CF-A453-F58BAB154EF8}D:\program files (x86)\phonerlite\phonerlite.exe" = protocol=17 | dir=in | app=d:\program files (x86)\phonerlite\phonerlite.exe | 
"UDP Query User{75E9348B-77A7-4CAC-B50A-144BE5CEDF64}D:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=d:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{B2F08A0F-41E0-4473-89DB-264F9E6693FA}D:\program files (x86)\3cx assistant\3cxphone.exe" = protocol=17 | dir=in | app=d:\program files (x86)\3cx assistant\3cxphone.exe | 
"UDP Query User{E2927027-ABA4-47FD-9DC0-0623D2923F69}D:\program files (x86)\microsoft office\office12\outlook.exe" = protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office12\outlook.exe | 
"UDP Query User{FAC80BFC-603A-41DD-9DF8-0BA7EF492F0B}D:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe" = protocol=17 | dir=in | app=d:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe | 
"UDP Query User{FBB884CE-E98B-4F6E-8A6D-442CD6BD6D53}D:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe" = protocol=17 | dir=in | app=d:\program files (x86)\3cx assistant\crm\3cx assistant crm.exe | 
"UDP Query User{FDA54CFC-DB7C-40B9-937F-4DB546BAA052}D:\program files (x86)\3cx assistant\3cxphone.exe" = protocol=17 | dir=in | app=d:\program files (x86)\3cx assistant\3cxphone.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86416013FF}" = Java(TM) 6 Update 13 (64-bit)
"{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}" = Nitro Reader 3
"{54D5AEEB-EBD9-4C0D-930D-98712597320C}" = 3CX Assistant
"{7AB6F8D7-7804-4662-BE8C-1AFCCD602D9F}" = Microsoft-Maus- und Tastatur-Center
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Kyocera Product Library" = Kyocera Product Library
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Mouse and Keyboard Center" = Microsoft-Maus- und Tastatur-Center
"WinRAR archiver" = WinRAR 4.00 beta 3 (64-bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01011662-76A8-41E8-B1A8-4F8821570AC5}" = Advanced Archive Password Recovery
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{0197D136-598D-4968-BEEA-91C1B764F05D}" = Lexware buchhalter 2012
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{1923679F-C14B-4790-BC54-EFA3FCDE147B}" = Lexware Elster
"{1D081AB0-B1CC-11E0-80C0-005056B12123}" = Haufe iDesk-Service
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 51
"{37BC8FCE-15B1-456E-A62C-EEB175B71340}" = Lexware reisekosten plus 2011
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50FC30FE-9758-3B08-B886-7BAABC047B61}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 6.2.0
"{89196F9A-2E0B-4197-A3DF-6EF78731EB35}" = Lexware online banking
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer
"{90120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PRO_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_PRO_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_PRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.06) - Deutsch
"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0
"{C1C50448-C067-454A-80B2-334ECAC8F414}" = Lexware Admintools Plus
"{D34A78EB-78F2-48ab-8CAE-5D4DC255A491}" = Lexware reisekosten plus 2011
"{DAF15921-FA90-4427-82A2-1852A9BAC99A}" = Lexware Datenbank plus 2011
"{DF344785-0900-471E-B9F5-6F28C89AF638}" = TAXMAN Bibliothek 2012
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}" = Lexware Info Service
"{FA3FDB06-3368-4579-B2F2-5AE8AD6E7871}" = TAXMAN 2012
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe InDesign CS2 - {7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2
"AntragsManager_is1" = AntragsManager
"Avira AntiVir Desktop" = Avira Internet Security
"Die Macht der Selbstbeherrschung_is1" = Die Macht der Selbstbeherrschung
"Die Macht des Steuerzahlers_is1" = Die Macht des Steuerzahlers
"Free YouTube Download_is1" = Free YouTube Download version 3.2.10.812
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"Mozilla Thunderbird 24.2.0 (x86 de)" = Mozilla Thunderbird 24.2.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PhonerLite_is1" = PhonerLite 1.95
"PRO" = Microsoft Office Professional 2007
"SumatraPDF" = SumatraPDF
"Vermieter_EH" = Vermieter-Ratgeber
"VirtualKeyboard" = Virtual Keyboard 4.0.1
"VLC media player" = VLC media player 1.1.5
"Weiße Weste durch Umzug_is1" = Weiße Weste durch Umzug
"Winamp" = Winamp
"xp-AntiSpy" = xp-AntiSpy 3.98-2
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{46B70DEB-97B3-4E38-B746-EC16905E6A8F}" = WISO Sparbuch 2010
"{BAA9D87C-DA6A-48D0-BC07-135E5B2DE5A2}" = WISO Hausverwalter 2013
"Mozilla Firefox 26.0 (x86 de)" = Mozilla Firefox 26.0 (x86 de)
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 18.01.2014 09:03:14 | Computer Name = Jan-Dell | Source = Microsoft-Windows-User Profiles Service | ID = 1511
Description = Das lokale Benutzerprofil wurde nicht gefunden. Sie werden mit einem
 temporären Benutzerprofil angemeldet. Änderungen, die Sie am Benutzerprofil vornehmen,
 gehen bei der Abmeldung verloren.
 
Error - 18.01.2014 09:03:14 | Computer Name = Jan-Dell | Source = Microsoft-Windows-User Profiles Service | ID = 1500
Description = Sie konnten nicht angemeldet werden, da das lokal gespeicherte Profil
 nicht geladen werden konnte. Überprüfen Sie, ob eine Netzwerkverbindung besteht
 und das Netzwerk ordnungsgemäß funktioniert.      Details - Nur ein Teil der ReadProcessMemory-
 oder WriteProcessMemory-Anforderung wurde abgeschlossen.  
 
Error - 18.01.2014 20:35:56 | Computer Name = Jan-Dell | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087,
 Zeitstempel: 0x52a0d273  Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087,
 Zeitstempel: 0x52a0d20a  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0014e1a8  ID des fehlerhaften
 Prozesses: 0x1324  Startzeit der fehlerhaften Anwendung: 0x01cf145d4bafde98  Pfad der
 fehlerhaften Anwendung: D:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: D:\Program Files (x86)\Mozilla Firefox\xul.dll  Berichtskennung:
 a83c9707-80a1-11e3-bfda-0019d12a83a4
 
Error - 19.01.2014 05:54:21 | Computer Name = Jan-Dell | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "D:\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 19.01.2014 08:31:04 | Computer Name = Jan-Dell | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "D:\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 19.01.2014 10:50:36 | Computer Name = Jan-Dell | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files
 (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 19.01.2014 14:23:30 | Computer Name = Jan-Dell | Source = SideBySide | ID = 16842824
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Program Files
 (x86)\3CX Assistant\CRM\3CX Assistant Microsoft Outlook Addin\3CX Assistant Microsoft
 Outlook Addin.dll.Manifest". Fehler in Manifest- oder Richtliniendatei "D:\Program
 Files (x86)\3CX Assistant\CRM\3CX Assistant Microsoft Outlook Addin\3CX Assistant
 Microsoft Outlook Addin.dll.Manifest" in Zeile 4.  Das asmv2:clrClassInvocation-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^entryPoint-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 20.01.2014 08:08:26 | Computer Name = Jan-Dell | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: e44    Startzeit: 
01cf15d7f01165c3    Endzeit: 16    Anwendungspfad: C:\Users\Jan\Desktop\OTL.exe    Berichts-ID:
   
 
[ OSession Events ]
Error - 01.07.2013 03:34:42 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1996
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 07.07.2013 06:19:14 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7520
 seconds with 180 seconds of active time.  This session ended with a crash.
 
Error - 22.08.2013 10:04:15 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 18990
 seconds with 1440 seconds of active time.  This session ended with a crash.
 
Error - 15.09.2013 16:45:28 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 22.09.2013 07:34:11 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 101
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 14.10.2013 08:54:01 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 20834
 seconds with 360 seconds of active time.  This session ended with a crash.
 
Error - 18.10.2013 08:59:01 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8371
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 22.10.2013 17:54:33 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 49925
 seconds with 180 seconds of active time.  This session ended with a crash.
 
Error - 24.10.2013 15:09:57 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 39672
 seconds with 420 seconds of active time.  This session ended with a crash.
 
Error - 15.01.2014 18:27:43 | Computer Name = Jan-Dell | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 49748
 seconds with 4680 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 18.01.2014 09:02:59 | Computer Name = Jan-Dell | Source = DCOM | ID = 10010
Description = 
 
Error - 19.01.2014 06:41:10 | Computer Name = Jan-Dell | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 19.01.2014 06:55:54 | Computer Name = Jan-Dell | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist
 bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 19.01.2014 18:11:42 | Computer Name = Jan-Dell | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
 
< End of report >

--- --- ---

Code:

ATTFilter

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 20.01.2014 13:09:27 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Jan\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,94 Gb Total Physical Memory | 2,60 Gb Available Physical Memory | 66,17% Memory free
7,87 Gb Paging File | 6,09 Gb Available in Paging File | 77,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 50,78 Gb Total Space | 2,79 Gb Free Space | 5,50% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 49,27 Gb Free Space | 72,08% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive G: | 3,73 Gb Total Space | 3,55 Gb Free Space | 95,10% Space Free | Partition Type: FAT32
Drive N: | 465,65 Gb Total Space | 385,91 Gb Free Space | 82,88% Space Free | Partition Type: FAT32
 
Computer Name: JAN-DELL | User Name: Jan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
PRC - D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Lexware\LxWebAccess\LxWebAccess.exe (Lexware GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
PRC - D:\Program Files (x86)\3CX Assistant\tcx.assistant.client.exe (3CX Ltd)
PRC - D:\Program Files (x86)\3CX Assistant\CRM\3CX Assistant CRM.exe (3CX Ltd)
PRC - C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe (iAnywhere Solutions, Inc.)
PRC - D:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation)
PRC - D:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\6ebbfafc5521934f7e1c154937a2788b\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\08d05898be584065b797a6dd48d9ad56\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\71d887ce964fb69b7f03c4fe7a3f28ff\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\e40d894a772b2cff5ffd5a84ef20d2d4\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9de08286f7db6f78a1505f51d8342ef6\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9a1bc983c28c695729b3e46acdc6933e\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\c9786062fbb311c543497e28c1e1a0c5\CustomMarshalers.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\de6ee26de5e4f343509de7e92ab48ba6\CustomMarshalers.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Common.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Outlook.dll ()
MOD - C:\Windows\assembly\GAC\office\12.0.0.0__71e9bce111e9429c\office.dll ()
MOD - C:\Windows\assembly\GAC\Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Outlook.dll ()
MOD - D:\Program Files (x86)\3CX Assistant\3CXTAPIClient.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ()
MOD - C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll ()
MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL ()
MOD - D:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll ()
MOD - D:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- D:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirFirewallService) -- D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirService) -- D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (NitroReaderDriverReadSpool3) -- C:\Programme\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe (Nitro PDF Software)
SRV - (MBAMService) -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (Lexware_Datenbank_Plus) -- C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe (iAnywhere Solutions, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avfwot) -- C:\Windows\SysNative\drivers\avfwot.sys (Avira GmbH)
DRV:64bit: - (avfwim) -- C:\Windows\SysNative\drivers\avfwim.sys (Avira GmbH)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6232e.sys (Intel Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://d8n4mx4j/argoweb/aaf001web/Login.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E2 F4 D1 61 5D 05 CE 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://duckduckgo.com/"
FF - prefs.js..extensions.enabledAddons: i18nsideboard%40fxparlant.net:3.0
FF - prefs.js..extensions.enabledAddons: stealthyextension%40gmail.com:2.5
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21
FF - prefs.js..extensions.enabledAddons: %7Bdd3d7613-0246-469d-bc65-2a3cc1668adc%7D:1.1.8
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.8.12
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q="
FF - prefs.js..network.proxy.ftp: "193.254.236.205"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.http: "193.254.236.205"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "193.254.236.205"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "193.254.236.205"
FF - prefs.js..network.proxy.ssl_port: 3128
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: D:\Program Files (x86)\Java Systems\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: D:\Program Files (x86)\Java Systems\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: D:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: D:\Program Files (x86)\Mozilla Firefox\plugins [2014.01.16 20:00:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.2.0\extensions\\Components: d:\Program Files (x86)\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.2.0\extensions\\Plugins: d:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: D:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: D:\Program Files (x86)\Mozilla Firefox\plugins [2014.01.16 20:00:16 | 000,000,000 | ---D | M]
 
[2014.01.15 14:11:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\Extensions
[2014.01.15 14:11:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de
[2014.01.17 12:39:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\Firefox\Profiles\dj1uindl.default\extensions
[2013.11.13 11:08:31 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Jan\AppData\Roaming\mozilla\Firefox\Profiles\dj1uindl.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.08.10 11:52:52 | 000,000,000 | ---D | M] (Block site) -- C:\Users\Jan\AppData\Roaming\mozilla\Firefox\Profiles\dj1uindl.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2013.07.18 12:27:43 | 000,000,000 | ---D | M] (International Sideboard) -- C:\Users\Jan\AppData\Roaming\mozilla\Firefox\Profiles\dj1uindl.default\extensions\i18nsideboard@fxparlant.net
[2013.11.14 16:31:07 | 000,185,839 | ---- | M] () (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\extensions\stealthyextension@gmail.com.xpi
[2014.01.15 13:59:26 | 000,536,648 | ---- | M] () (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2014.01.17 12:39:25 | 000,940,775 | ---- | M] () (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.12.23 09:45:30 | 000,001,981 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\searchplugins\dictcc.xml
[2014.01.20 12:17:45 | 000,010,316 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\searchplugins\duckduckgo.xml
[2014.01.07 12:13:35 | 000,003,623 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\searchplugins\Google.xml
[2014.01.19 10:47:28 | 000,001,839 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\searchplugins\ixquick-https---deutsch.xml
[2013.12.23 09:44:27 | 000,002,080 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\searchplugins\metapedia-de.xml
[2013.12.23 09:44:58 | 000,000,983 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\dj1uindl.default\searchplugins\wortschatz-deutsch.xml
 
O1 HOSTS File: ([2014.01.17 22:17:05 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java Systems\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files (x86)\Java Systems\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [avgnt] D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [PDFPrint] d:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - Startup: C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\SearchScopes present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java-Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - D:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: argoserver ([]https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: d8n4mx4j ([]http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: d8n4mx4j ([]https in Vertrauenswürdige Sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63D26AE7-4F39-40B0-B427-CE9528B32860}: NameServer = 8.8.8.8,192.168.3.12
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014.01.20 13:08:33 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014.01.20 13:08:27 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014.01.20 13:08:27 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014.01.20 13:08:27 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014.01.20 13:05:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jan\Desktop\OTL.exe
[2014.01.19 18:58:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2014.01.18 13:51:33 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Andrej_Koch
[2014.01.18 13:51:23 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virtual Keyboard
[2014.01.18 13:51:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Keyboard
[2014.01.18 12:03:08 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014.01.18 11:52:02 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014.01.17 22:18:47 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014.01.17 22:03:59 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014.01.17 22:03:59 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014.01.17 22:03:59 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014.01.17 22:03:54 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014.01.17 22:03:46 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2014.01.16 23:37:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2014.01.16 19:07:32 | 000,000,000 | ---D | C] -- C:\FRST
[2014.01.16 15:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Macht des Steuerzahlers
[2014.01.15 14:13:58 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Netviewer
[2014.01.15 14:11:40 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Haufe Mediengruppe
[2014.01.15 14:11:40 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Haufe Mediengruppe
[2014.01.15 14:00:43 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Lexware
[2014.01.15 14:00:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lexware
[2014.01.15 14:00:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DataDesign
[2014.01.15 13:58:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sybase
[2014.01.15 13:58:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft WSE
[2014.01.15 13:54:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Haufe
[2014.01.15 13:52:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware
[2014.01.15 13:45:55 | 000,000,000 | ---D | C] -- C:\ProgramData\lexware
[2014.01.15 13:45:49 | 001,929,216 | ---- | C] (Amyuni Technologies
Amyuni | Quality PDF Developer Tools for .NET, Silverlight, 64-bit SDK, Citrix Ready) -- C:\Windows\SysWow64\cdintf250.dll
[2014.01.15 13:45:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Haufe
[2014.01.15 13:45:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Haufe
[2014.01.15 13:45:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2014.01.15 13:45:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2014.01.15 13:44:49 | 000,455,680 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\deploytk.dll
[2014.01.15 13:44:49 | 000,181,760 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaws.exe
[2014.01.15 13:44:49 | 000,165,888 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaw.exe
[2014.01.15 13:44:49 | 000,165,888 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\java.exe
[2014.01.15 13:44:43 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2014.01.15 13:44:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2014.01.15 13:42:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Lexware
[2014.01.15 13:42:01 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Lexware
[2014.01.15 13:35:03 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\Amazon Downloader Logs
[2014.01.15 08:07:16 | 000,325,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbport.sys
[2014.01.15 08:07:16 | 000,007,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbd.sys
[2014.01.09 18:05:59 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\Steuer-Sparbuch
[2014.01.07 12:21:53 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Nitro
[2014.01.07 12:21:53 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\FileOpen
[2014.01.07 12:21:53 | 000,000,000 | ---D | C] -- C:\ProgramData\FileOpen
[2014.01.07 12:21:39 | 000,029,712 | ---- | C] (Nitro PDF Software) -- C:\Windows\SysNative\nitrolocalmon2.dll
[2014.01.07 12:21:39 | 000,017,936 | ---- | C] (Nitro PDF Software) -- C:\Windows\SysNative\nitrolocalui2.dll
[2014.01.07 12:21:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Nitro
[2014.01.07 12:21:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nitro
[2014.01.07 12:21:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nitro
[2014.01.07 12:21:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nitro
[2014.01.07 12:21:12 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Downloaded Installations
[2014.01.07 12:11:09 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Google
[2014.01.07 11:32:30 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\PhonerLite
[2014.01.05 15:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Weiße Weste durch Umzug
[2014.01.03 23:48:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
 
========== Files - Modified Within 30 Days ==========
 
[2014.01.20 13:05:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jan\Desktop\OTL.exe
[2014.01.20 13:00:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.01.20 08:45:51 | 000,015,040 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.01.20 08:45:51 | 000,015,040 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.01.20 08:42:45 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014.01.20 08:42:45 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2014.01.20 08:42:45 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014.01.20 08:42:45 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2014.01.20 08:42:45 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014.01.20 08:37:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.01.20 08:37:53 | 3169,259,520 | -HS- | M] () -- C:\hiberfil.sys
[2014.01.19 18:58:38 | 000,000,774 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk
[2014.01.19 18:58:37 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Creator.lnk
[2014.01.18 13:51:23 | 000,000,771 | ---- | M] () -- C:\Users\Jan\Desktop\Virtual Keyboard.lnk
[2014.01.17 22:17:05 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014.01.17 20:29:22 | 000,002,222 | -H-- | M] () -- C:\Users\Jan\Documents\Default.rdp
[2014.01.17 20:19:36 | 000,155,070 | ---- | M] () -- C:\Users\Jan\Desktop\shopping-ecco-store-zuerich-limmatquai.jpg
[2014.01.17 17:01:08 | 001,444,399 | ---- | M] () -- C:\Users\Jan\Desktop\Standortsuche Street One 2013.pdf
[2014.01.16 15:30:23 | 000,001,361 | ---- | M] () -- C:\Users\Public\Desktop\Die Macht des Steuerzahlers.lnk
[2014.01.16 08:20:49 | 000,002,669 | ---- | M] () -- C:\Users\Public\Desktop\TAXMAN 2012.lnk
[2014.01.16 08:07:07 | 000,552,792 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014.01.15 16:00:25 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014.01.15 16:00:25 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014.01.15 13:59:36 | 000,000,153 | ---- | M] () -- C:\Windows\ODBC.INI
[2014.01.15 13:54:59 | 000,002,319 | ---- | M] () -- C:\Users\Public\Desktop\TAXMAN Bibliothek 2012.lnk
[2014.01.15 13:44:44 | 000,455,680 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\deploytk.dll
[2014.01.15 13:44:44 | 000,181,760 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaws.exe
[2014.01.15 13:44:44 | 000,165,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaw.exe
[2014.01.15 13:44:44 | 000,165,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\java.exe
[2014.01.09 17:14:58 | 000,000,981 | ---- | M] () -- C:\Windows\wiso.ini
[2014.01.07 12:21:38 | 000,002,003 | ---- | M] () -- C:\Users\Public\Desktop\Nitro Reader.lnk
[2014.01.07 12:12:05 | 000,118,784 | ---- | M] () -- C:\Windows\SysNative\dmusic64.exe
[2014.01.07 11:32:30 | 000,000,028 | ---- | M] () -- C:\Users\Jan\AppData\Roaming\PhonerLitesettings.ini
[2014.01.05 15:47:34 | 000,001,447 | ---- | M] () -- C:\Users\Public\Desktop\Weiße Weste durch Umzug.lnk
[2014.01.03 23:50:02 | 000,001,204 | ---- | M] () -- C:\Users\Jan\Documents\cc_20140103_234954.reg
[2014.01.03 12:41:04 | 000,027,417 | ---- | M] () -- C:\Users\Jan\Desktop\Unbenannt.JPG
[2014.01.02 13:40:20 | 000,123,019 | ---- | M] () -- C:\Users\Jan\Desktop\LC Waikiki- Doch keine Deutschlandsexpansion- « fabeau.pdf
 
========== Files Created - No Company Name ==========
 
[2014.01.19 18:58:38 | 000,000,774 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk
[2014.01.19 18:58:37 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Creator.lnk
[2014.01.18 13:51:23 | 000,000,771 | ---- | C] () -- C:\Users\Jan\Desktop\Virtual Keyboard.lnk
[2014.01.17 22:03:59 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014.01.17 22:03:59 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014.01.17 22:03:59 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014.01.17 22:03:59 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014.01.17 22:03:59 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014.01.17 20:19:36 | 000,155,070 | ---- | C] () -- C:\Users\Jan\Desktop\shopping-ecco-store-zuerich-limmatquai.jpg
[2014.01.17 17:01:04 | 001,444,399 | ---- | C] () -- C:\Users\Jan\Desktop\Standortsuche Street One 2013.pdf
[2014.01.16 15:30:23 | 000,001,361 | ---- | C] () -- C:\Users\Public\Desktop\Die Macht des Steuerzahlers.lnk
[2014.01.15 13:59:36 | 000,000,153 | ---- | C] () -- C:\Windows\ODBC.INI
[2014.01.15 13:54:59 | 000,002,319 | ---- | C] () -- C:\Users\Public\Desktop\TAXMAN Bibliothek 2012.lnk
[2014.01.15 13:52:37 | 000,002,669 | ---- | C] () -- C:\Users\Public\Desktop\TAXMAN 2012.lnk
[2014.01.07 12:21:38 | 000,002,499 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Reader 3.lnk
[2014.01.07 12:21:38 | 000,002,003 | ---- | C] () -- C:\Users\Public\Desktop\Nitro Reader.lnk
[2014.01.07 12:12:05 | 000,118,784 | ---- | C] () -- C:\Windows\SysNative\dmusic64.exe
[2014.01.07 11:32:30 | 000,000,028 | ---- | C] () -- C:\Users\Jan\AppData\Roaming\PhonerLitesettings.ini
[2014.01.05 15:47:34 | 000,001,447 | ---- | C] () -- C:\Users\Public\Desktop\Weiße Weste durch Umzug.lnk
[2014.01.03 23:49:56 | 000,001,204 | ---- | C] () -- C:\Users\Jan\Documents\cc_20140103_234954.reg
[2014.01.02 13:40:26 | 000,123,019 | ---- | C] () -- C:\Users\Jan\Desktop\LC Waikiki- Doch keine Deutschlandsexpansion- « fabeau.pdf
[2013.06.17 18:13:26 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.06.17 18:12:17 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.06.17 18:12:17 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013.06.17 18:12:17 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2013.06.11 14:34:10 | 000,805,537 | ---- | C] () -- C:\Users\Jan\AppData\Local\census.cache
[2013.06.11 14:33:56 | 000,097,923 | ---- | C] () -- C:\Users\Jan\AppData\Local\ars.cache
[2013.06.11 13:57:22 | 000,000,036 | ---- | C] () -- C:\Users\Jan\AppData\Local\housecall.guid.cache
[2013.03.12 11:55:46 | 000,000,981 | ---- | C] () -- C:\Windows\wiso.ini
[2013.02.07 18:50:20 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.02.07 18:16:40 | 000,007,593 | ---- | C] () -- C:\Users\Jan\AppData\Local\Resmon.ResmonCfg
[2012.02.27 09:41:52 | 000,202,240 | ---- | C] () -- C:\Windows\SysWow64\LXPrnUtil10.dll
[2012.02.27 09:40:44 | 000,304,128 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll
[2012.02.27 09:38:36 | 000,133,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll
[2012.02.27 09:38:18 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Files - Unicode (All) ==========
[2013.10.17 06:37:27 | 101,413,064 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\瑺�‹
[2013.10.17 06:37:27 | 101,413,064 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\瑺�‹

< End of report >

--- --- ---

schrauber · 21.01.2014, 09:49

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten. Reste entfernen lassen, neu installieren.

Besser?

janderman · 21.01.2014, 10:01

hallo, ich hatte nur ein plugin drin, das ich deaktivieren musste.

ich hatte noch ältere malwarebytes-funde von mitte 2013. müsstest Du die auch noch sehen, damit Du sagen kannst, ob mein PC sauber ist oder waren die log-dateien in diesem thread jetzt ausreichend?

wie gesagt, firefox hängt sich beim abspielen von youtube-videos manchmal für ca. 30 sekunden auf und gestern ist auch der IE mal abgestürzt.

schrauber · 21.01.2014, 17:34

Zitat:

hallo, ich hatte nur ein plugin drin, das ich deaktivieren musste.

Hast Du FF komplett zurück gesetzt oder nicht?

janderman · 21.01.2014, 17:56

habe firefox komplett neu installiert.

21.01.2014, 09:49	#12
schrauber /// the machine /// TB-Ausbilder	BKA-Trojaner eingefangen? (3 Log-Dateien anbei) Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten. Reste entfernen lassen, neu installieren. Besser? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

BKA-Trojaner eingefangen? (3 Log-Dateien anbei)

Log-Analyse und Auswertung: BKA-Trojaner eingefangen? (3 Log-Dateien anbei)