Hallo ihr Lieben,

ich habe mir den Trojaner Win32.Agent.fbx eingefangen und bekomme ihn durch nichts wieder runter vom Pc. wer kann helfen?
danke

ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "run Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt

OTL EXTRAS Logfile:

OTL Extras logfile created on: 23.06.2010 15:17:20 - Run 2
OTL by OldTimer - Version 3.2.6.1     Folder = C:\Users\Elke\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 42,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 576,15 Gb Total Space | 424,95 Gb Free Space | 73,76% Space Free | Partition Type: NTFS
Drive D: | 20,01 Gb Total Space | 11,16 Gb Free Space | 55,76% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ELKE-PC
Current User Name: Elke
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [SCHLECKER Foto Digital Service] -- "C:\Program Files\SCHLECKER\SCHLECKER Foto Digital Service\SCHLECKER Foto Digital Service.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0548E526-ECBE-4FE2-8BC7-051FD99E4476}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{062769F2-4185-418D-A450-F72F477E8C41}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{0729AE92-BFD5-45A9-90BD-94DDB1948A49}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{0F0DF4BF-DA85-4534-A3C0-C4359A3A34E6}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{16654A06-4ABD-417D-B972-FC22EDA96ABC}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=c:\windows\system32\svchost.exe | 
"{1668D2A2-8BDE-4C96-9A3D-018924D28D4F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{173F2AD5-3A0F-4053-9304-F4EA98724D7E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{1777C8D3-5B1F-4F86-8DB2-2421893AF647}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{19933623-022D-44EE-A1D5-9CA4879F3685}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{19B389B0-C5B2-4A6D-8D29-6AA4140244C8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{1BEE1A0B-8AA9-4DFB-89A7-D62B8A0D2DE5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{1F7EF35F-7651-4D47-B169-A2DD74521977}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{24F50E83-33B9-4051-805C-CCA110EC18B9}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{26E168BB-70A5-476F-8ED1-4D7EDC43CD57}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{2752B98C-64EA-4769-9406-89CBC94D91CB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{288F9AC8-D169-4B6F-8015-A2757DFF7F52}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{2B18E3BE-F11A-43D7-BDAE-BCDD051BD319}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{2BF595EB-D7BE-4C00-BB1C-F048E7A4D835}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2D6AFAB5-8A22-4005-8511-F7421ABB7A29}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{2EBCCBD0-EA60-4EFE-8213-8D8A5258EE98}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{30262989-4AAC-4105-8C5F-CCC2D606498C}" = rport=445 | protocol=6 | dir=out | app=system | 
"{3169CB36-57BC-49F8-8326-D6C6A6A52C18}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{320FFF5B-DD63-4DCB-AB1C-F052326C489C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{32718C02-C473-464B-866E-189F3B5C09DD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{330AFD44-19D4-4EC7-8FA3-6547BF0C84D7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{336FA2E6-F511-4D06-9CD0-BBEFBDF626F8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{3AFDADAE-79D8-4112-809B-7320AD0F790D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=c:\windows\system32\svchost.exe | 
"{3B0B4EB5-093C-466B-B633-23F8170F0643}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3BD028EB-C86A-4F1D-A50D-4F69362E77DA}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3D613073-06EE-4388-8BE1-49425642038E}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3DAEC6AB-FD56-404F-8786-E08947E633EF}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=c:\windows\system32\svchost.exe | 
"{428381D5-CE13-453D-B9C1-45249FA6A24B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{42A4FD36-75BD-465C-9303-414AD3107B1A}" = rport=137 | protocol=17 | dir=out | app=system | 
"{44656CF0-F0D3-4EE1-8564-E64E4C85BC1E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{451E9EEB-E684-495B-AAB6-C77DACC9E436}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{47214621-38C0-4A0F-A5B6-3695909C6E83}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{47A8E9FB-26C2-4432-BD0C-8F55EB6C3681}" = lport=138 | protocol=17 | dir=in | app=system | 
"{4B1402BA-03EF-4443-AFCB-D1570188BF32}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{4B6D3498-8FEF-4CDD-B343-F987DA219FA6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{4CE6CE8A-0946-433B-9C4E-56D1C8BAFA4F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{4F5D0759-F473-4324-AAD8-B205E69A600E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{514CA63D-175B-430D-83BB-DBEA79F78D65}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{518E3488-2F31-44A7-891F-16685E514E6C}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{550ADD7A-0B57-469B-92DC-E574A4E0FE04}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{571CE7B1-496B-4AA9-9712-324BB163BA61}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{594E15AA-98B6-437B-8AB4-9B250B0F6D7F}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{5AA5FDE4-58A3-466A-B05C-B74CA7F7968C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{5B35FEB0-0177-4189-9099-38D9F4F73037}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{5F0A8C68-1F8E-47C7-B60C-3365436EAD6B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{5F59825D-963C-43F9-BF83-CAE491F4481F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{63F8FACB-1D35-4AA5-B0A4-D5AB8B261798}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{65A270AB-AD6D-4E57-9947-D1AC2F942494}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{66CCEAAD-8386-4502-9408-C0C9ED897198}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{67259432-AC0A-444E-B042-848EF7CD3DF2}" = lport=137 | protocol=17 | dir=in | app=system | 
"{69F423D8-7621-47B1-9E01-96532CD7A5FF}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{6CF27CCF-3ABB-43C8-922C-70DE160206A3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{6FB4D6C9-4593-41BB-8F43-E3DDD18B1310}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{70962A06-713F-42CB-AB07-7F68CFF62677}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{70DEAC92-8270-4433-BE9D-934B59F75622}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{712488C9-82CA-44D6-A4F2-5B7628944B8E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7186902E-DFE9-4CEA-86A8-07F344CA6556}" = rport=138 | protocol=17 | dir=out | app=system | 
"{7231DD68-7296-4773-831E-CBEE5E6AFCA4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{73ACE7A7-0B72-4783-A5DD-1C05C807C9E6}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8486EDD7-5FCB-44C7-8DF7-618A53F8B431}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{853F20F6-5026-4AD4-8B2E-163FF913FE42}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{868247C1-D7DA-410A-B6A2-2765DF251425}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{86EFC901-59F2-4396-9EF6-22CDEB18A6B1}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{8B1B79FD-B37C-44E6-894E-5D893347A5FF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{8D733992-E174-493E-9DD5-E06C4FC3ACB3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{8DDB41F1-4C8B-476A-80D3-0FDCF2BED142}" = rport=139 | protocol=6 | dir=out | app=system | 
"{91BE2161-A3F4-4FB7-B6E1-31FC71464303}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{95DF48FB-312A-4ECB-AF8D-DFD08FC9CD91}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{96D9274E-A665-4008-BFB2-DFEA051AECC1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{9A453FAB-7009-4109-8148-5C94771B0875}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{9D48623B-812B-4601-ADFC-41B314FE83CE}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A032CB5B-124A-4A98-B44A-542A666FA4A5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{A03C458E-17F6-4F10-B6EB-405B1D4395E3}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A53643BD-0B87-4052-B8F3-A60638CDABF2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{A92EF42D-9050-42FD-9151-1E4D2679FBED}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{AEA89DA9-4E85-425D-91A4-381BE3299478}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{AEFD8C4C-E10D-4D88-AB0F-60033F78C2C2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B0A9A398-F7EC-46EE-815B-4050175C558A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B0EF68B6-66FC-4E12-8460-A23D4DE141CB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{B1E5BDA2-0A82-4B69-A58D-731A72C0F778}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{B2BE0D43-AE31-43A0-B0FD-D9A7316A181B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B3B36982-B35F-4301-9031-29C569A9B2FB}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=c:\windows\system32\svchost.exe | 
"{B5905934-331D-4F13-92AC-6ADC72380A74}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B6831AB1-7AD6-48B3-8587-62FD0A9E1B44}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{B7FE715D-5B51-4A8E-9564-AD49D276B835}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BA442B45-B52F-4AFC-BE18-957B3A269D39}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{BE5500BA-02DF-4870-BB2C-B79948F7E475}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{BE86AED2-D217-4E47-9AAF-1F05C90F1D97}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{C12D83E2-E5FD-4F18-A34D-522999440E57}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{C2F9A2A1-9382-4C43-B5AF-D5EA45FAA789}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C43606EF-E028-4D90-AF83-F2E73F0A0D55}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C688F0BB-5F17-4D83-8076-7B8704B835ED}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{CC679345-CDF9-48A8-8746-F5C809CAFD2E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{CC89EEE2-9040-4C59-AB8B-C69E0013CCCF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{CEF9563C-B0FF-4EE3-B4EE-C1D856E7137E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{D138475C-A314-4886-889F-12EEDE76E169}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{DB201310-7FDD-4F0C-B32C-CFE4E1D043FB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{DBE11EA7-19FC-4F5B-ACF6-E247942DFA77}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{DD7997F7-E2FB-4351-A701-20AA0496F50F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{DEEAA66B-F8C7-45AC-865A-3EF72DD70A5A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{E297E965-052B-44F8-B759-3C651897CA65}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{E3760342-E2A8-4D3E-843A-5D2E58457292}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{E4F5D724-298F-4A65-8449-4129C4BA2D75}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{E58291CF-3050-4F51-8282-56742692850C}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E59C00C4-F38B-4744-99A3-C3EC9A6ABCB3}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=c:\windows\system32\svchost.exe | 
"{E59CD847-0C53-4802-8458-7386AC151AE3}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E6FF1BFC-280F-4B1F-9D00-F74243BD93C8}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E889C7D5-9A44-4800-9AE1-18ED46900BF9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{EEA15E86-479C-4C95-87F8-C47C5C4218C5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F2AF9D43-5DD7-434B-B7A8-F575AC39053F}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F418E597-95FA-4F83-877B-385E8186D894}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F48ACA24-67CB-437C-AB97-F418DD755209}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F6C10FE2-3242-4270-8A3E-6AB4168AE203}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=c:\windows\system32\svchost.exe | 
"{F81AEBC6-A8FE-4A34-A5FD-F77DC37FBE2B}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{F999F78D-7C23-4E0A-BA66-21345FE56F33}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FB51AB09-A0C6-4C8F-A436-493D4208B286}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{FBE647EF-865D-4349-9583-FCA947F70DE3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{007AB11F-C590-4519-A20B-CC7858188C4C}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{01247087-4578-44CB-951C-05294E8DB57C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{049B42CB-9FE0-4161-BBDD-5C84A9F08341}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{04A74F1E-4CF0-43B1-B9ED-AF59E176BBA5}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{057092B9-C747-444F-AA2E-327E149B246C}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{06F295D9-6DB0-4E63-B18B-16ADB168AA8F}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe | 
"{088B5491-8263-49F1-A791-0F23DD9BFFF8}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{0A9F4098-F929-4A58-9DFF-2B4CFFDAFF83}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{0AA3FA79-A971-42C2-81BC-A4AF5AE22BDD}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{0C36BA9A-0A09-44B7-927E-E6BDCD3EAF7A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{0FBA79F6-9B20-4E69-860A-F0C4926BD3A8}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{107C143E-79A6-4207-BD81-04F5E19373DE}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{11C8FD29-FF54-4CE5-9858-D3E576362AA2}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{155FE8D7-56AA-4DEE-9FB0-B3BF46B3153F}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe | 
"{17243505-CD3C-4702-8530-3AE494CAF054}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{181E50D4-D994-405E-BCCF-FF9FAEE61D1A}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{18A5A4D3-352A-4AA7-86C6-CA3CF30D3A54}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{1BEB7D86-E18E-4DAC-978C-663FD5DE5E11}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe | 
"{1C1EA18C-51E8-4167-B2D5-6C729C6BE5E6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{1EC1E7F2-4467-44FD-B010-BD80E66E9338}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{1F02CE93-B911-40F1-9F2D-F0153F366157}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{2024947B-C28F-4636-8A1F-C9D4023E90BD}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe | 
"{224152CA-3104-4211-A48A-DA110D04700C}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{22E7F78F-D2D9-40A9-9AF9-F7F9AE75AADA}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{266A0A92-8405-4A61-9B7F-3DD54F4D57F2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{266A1601-778A-4A2E-91B4-77FC0872A3D3}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{26B94D3E-361A-450A-8F8F-DF6E9BCFB982}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{29AA18AB-82BB-4519-B6D2-0634DF774503}" = protocol=6 | dir=in | app=c:\program files\netlog music tool\netlogmusictool.exe | 
"{2A1E6E9E-ADA5-4485-9B83-A5E991B58500}" = protocol=6 | dir=in | app=c:\program files\netlog 24\notifier\netlog24notifier.exe | 
"{3082682F-61C6-4998-A956-4A8901808A58}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{318BCEDD-617C-462F-8093-BBD1C072FDCE}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{36E8B82F-764D-4E7E-A539-DAB2A403A27B}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{38B4915D-3E30-49FF-AE32-952D4A41384D}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{39D867BA-A7C8-4483-81C1-DD518A83157E}" = protocol=17 | dir=in | app=c:\program files\netlog music tool\netlogmusictool.exe | 
"{3BE46E2A-777A-433B-B032-B4B9FD3AEDFC}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{3DA1284E-E44C-40EF-9E20-8B5F0C2F3DA1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4173E7D1-A3AA-445D-ABD5-F1411F4F6A1E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{4194DE84-CE2B-4B1D-99BD-195A4BA04677}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{42586CC3-EC7E-4F6B-B4A6-FA3B02F34B94}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{48B1DC5F-6522-4797-9D2F-78D38D04A3BC}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{48BE4501-E709-4EBF-B3B3-E017B19F0A94}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{4C7C7DDC-9F70-4ABC-B8E7-8E6CFED9CB67}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{4F2864D9-0F13-4F4F-9067-1B1516DBBF10}" = protocol=17 | dir=in | app=c:\program files\netlog 24\notifier\netlog24notifier.exe | 
"{501C9B18-D431-42B0-85FD-DDF99165D15A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{50803337-CF58-4F02-97FE-8701235B051A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{50E440D4-EBD8-453F-805C-13498DD436E2}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe | 
"{51CB2A29-E7C3-4972-B590-480AC8226B3C}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{523EDBD9-3CD3-4C92-AE6D-0A8E871AC177}" = protocol=6 | dir=out | app=system | 
"{53533139-AE0F-4485-802B-E834C46D7415}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{56AA13CA-3068-4EA2-9656-53DEBBFA3F22}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{57B31CB8-B8DC-4109-8B51-56B3E007F52F}" = protocol=6 | dir=in | app=c:\program files\nokia\nokia home media server\media server\twonkymediaserver.exe | 
"{58BF9829-B963-4AFF-8737-71658F39FD96}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe | 
"{5A96F52B-B705-4353-80C4-1B43C785082D}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{5B1FD652-983E-4725-984F-A564B84DD0A9}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{5BC3CBBC-5DE9-480D-A27C-A0A93D37513B}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"{5DF97D43-DD09-4513-A671-3CD55ADAEC34}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{5F3FD8EF-A170-4E67-A12B-3A4D269927CB}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{6182187A-BBCE-4D71-996C-E7592974949D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{62656C8F-0DED-41B1-A52D-1763BD02D637}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{631A642C-3826-4808-80B2-749B91959A46}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{64A8CCA1-36AE-444E-B265-2837F969EB64}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{67232DFC-2F09-44E4-844A-7B7B86C28A97}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{676767FC-F34A-493D-8BCE-8DFE1B13D505}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{676F7400-B86D-49E9-8E1F-3559A83CED98}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{69BC67A8-974B-49BE-9FEE-838E85044A65}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{6C96D057-C642-4598-BFAD-2EBBFE2DD3A8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{6E4EAE08-A264-4ED1-A978-E3720FA45AAD}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{73F570FB-A6F8-467D-B199-B127226CF988}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{76F9EE11-6E69-49C0-AC72-652639B3AF0A}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{77E2FB7D-F711-44CE-AF8F-ADDE0BD61E1C}" = protocol=6 | dir=in | app=c:\program files\nokia\nokia home media server\media server\twonkymedia.exe | 
"{79D87894-27A5-4C06-B100-CA5BBFA9D9A1}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{79F182A1-2DC1-4F1D-86D4-6A69A6B83EA0}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{7A88E7B6-AC6B-45D1-B915-8128DF73ED77}" = protocol=17 | dir=in | app=c:\program files\nokia\nokia home media server\media server\twonkymedia.exe | 
"{7AFADF90-A333-49C8-88BE-7874BF993A21}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{7D2231ED-D41A-405D-AD57-89D9EA0EEEEA}" = protocol=17 | dir=in | app=c:\program files\nokia\nokia home media server\media server\twonkymediaserver.exe | 
"{80DD506C-2000-453B-B62B-B2232F76D1D9}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{80E0DCED-C196-4CCC-AD53-7F71CEC3BBB0}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{80F8D223-CEA0-416D-B12D-3AFEB0FD2FA3}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{8645160D-2503-4DD4-8782-D31ADB237C2F}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{8723506D-BE74-475D-B6DB-C1359B235484}" = dir=in | app=c:\program files\home cinema\powerdirector\pdr.exe | 
"{889F4961-F875-415B-8454-B72CBDF8E77B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{89899E69-013C-4CD0-8A7F-B99ED1CD103B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{89E3A665-6132-4690-B5C2-07ACB5E6EEA9}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe | 
"{8D06E8DA-E38E-4F26-9DDF-F09AC2FA9E63}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{8D647807-656B-4E28-B8BD-CB59AAE63659}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{9324FD7D-F410-45E9-89BD-8E5BA6305CA6}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{95704BAC-E68D-4FE0-BA32-7778E64D3F73}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{97732ABF-FDD6-4A24-A539-F877CA2DEE83}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{98796FDB-DCF3-42E5-8DA4-747836180255}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{995C769C-0B7E-4327-A277-0683E6217828}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{9D51B3CD-7145-43EE-A925-F7E67B0493CB}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{9D8421D6-6A23-461A-B1FE-B289EF4C8A92}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{9E03AD0E-BB8D-4E14-9E38-63DF63F94900}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{A1EA48E9-FBAC-485F-B85E-09982C1FDF5B}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{A286490E-F55B-471D-B55F-BBC1DF77B49F}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{A2FC9F7A-5BCD-41BE-B93E-8D98EDE8DF48}" = protocol=6 | dir=out | app=system | 
"{A3E68057-F770-4EAD-A502-A618898F391D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{A554BBAB-8738-4966-B537-625F3ED60F88}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{A7B0B685-9451-4655-9AA1-0511AC2C7B0E}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"{A9F2F0ED-36CF-4104-B20C-0118D2F5239E}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe | 
"{AC67E88F-8018-4405-8AE2-BFF6BDF9CA3F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{B45BA51C-33F5-436D-A271-F7DC44DF6FD8}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe | 
"{B9B8D530-F913-4659-A8A0-AAB207D7057C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{BA2B1EB0-9CC0-44E6-93DF-A53BB379619D}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{BAB63540-0A87-4F8B-834C-815375DE4DE0}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{BC11EFD0-3978-4099-8D13-DDD4C659B011}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{BC5F0A62-C47C-4970-9664-A9E0D01ED378}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{BC979392-5AC1-4089-81CD-2C0A54CEC4CD}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe | 
"{BCEB3751-F599-4376-A13E-A6016838673F}" = protocol=6 | dir=in | app=c:\program files\netlog photo tool\netlog photo tool.exe | 
"{BEED68A4-BA05-4F52-BAEB-191B8D6BC280}" = protocol=17 | dir=in | app=c:\program files\netlog photo tool\netlog photo tool.exe | 
"{C0824247-20AF-40A3-AC1C-6853707A4BD2}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{C10C7B5D-5E0F-4E54-A9BD-0C31CF834C8C}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{C1648759-AF77-4A72-B70F-99C279C0BCA3}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{C260F280-D0EE-4A4E-8701-48659B298682}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{C94D7A1C-B8DA-48BC-90C7-275C5D9B2EFF}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{C992FB46-4C0B-4F9F-8CEF-689236ACDD15}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{CE245222-BC66-4F8C-AF32-150491FA5C03}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{D3F8666B-B613-4317-8C43-2655A1E89A1C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{D4015F72-1252-4591-88F1-1602E5117F26}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D749C0FC-D3A4-4D5E-A0BF-18153A5CCDED}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe | 
"{D785C90F-56DC-4E76-B42D-EC3E3E5B8FD6}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe | 
"{DA4E24A6-9787-4020-90DF-6317EF9769A7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{DA88C308-FB67-416C-86DF-F49052933A27}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{DABF38DA-6191-477D-8F9E-1630A9847AEC}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{DF319E4B-6F31-4035-B17E-D485A4D9FDD9}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{DF4ED71D-CCA1-46A8-93A3-CA977727B4A3}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{E19B0630-3533-4621-80F8-692F2CF3FE56}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{E2A78926-0AA2-4149-8C4D-73D11E8B5884}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{E3E3A829-1DE1-49C9-8F18-906007B3196E}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{E45886DC-6861-472B-BE9E-FE9E10050476}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{E61705E1-8546-4A77-8483-2AE789E9DE01}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe | 
"{E8E2A9DA-28F9-4B81-87D3-0DF72081E897}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{E9C0F5C8-42E9-4851-95AB-2C06E73100D6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{E9DBB550-F247-4ED4-B6D8-D7784AEEB0E5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{EFC6D0FA-175A-4DAF-AAE4-65D3AC790548}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{F159B892-E73E-4B8D-8DAB-B8010845F464}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{F54F1BE0-D0DD-42B7-A747-14D5E7A59FA5}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{F627850E-49A7-42F1-8FE5-31D66D1423E7}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{FB5A3CBA-7464-4276-A089-1A1CBE5DF0A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{FD47B1EF-2029-4E17-B7D9-6082F8E72E76}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"TCP Query User{031E06BB-BA3F-4C24-B670-D21B5F7BABDF}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"TCP Query User{234F0990-46FA-4F45-8CA4-99DF42401A39}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | 
"TCP Query User{82EB0E08-EE19-40F3-BC8E-3E6DA9E0F223}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{565F388A-5CFA-4DC0-A544-C81E92384C92}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | 
"UDP Query User{A71C687A-1A5A-4C35-B8AC-A00008C980B8}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{C7FF1B2D-E4C4-4FDC-A46E-5C4815A30B78}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00D0200F-3B4D-4A2F-869E-533ED835A943}" = Hervorhebe-Funktion (Windows Live Toolbar)
"{043A9DB2-2AD5-4049-86F9-769452193041}" = LiveUpload to Facebook
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{218761F6-CBF6-4973-B910-A33E6563A1EA}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)
"{2218B96C-ABA2-45D9-A0B4-56B71F5303DB}" = Nokia Ovi Suite
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}" = Smart Menus (Windows Live Toolbar)
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{42B74521-4706-412A-9A27-AED12B83E886}" = Nokia Ovi Application Installer
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{50D69C54-6963-49A6-B762-A9FF8F56AF0F}" = Brockhaus multimedial 2008
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5BB977A4-E843-4E31-9859-745F442B1031}" = Nero 8 Essentials
"{5F0545E7-3F0F-4730-AF70-26E61DBDF263}" = GfK Internet-Monitor
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6442DEDF-AC2F-4CBA-85DE-42E459C5006C}" = Nokia Ovi Content Copier
"{6444D9D9-CD6C-4464-B970-55C606C944DC}" = Logitech QuickCam
"{6869591A-7DD8-46D2-837F-57CBF7358955}" = Nokia Connectivity Cable Driver
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}" = PC Connectivity Solution
"{6EB6C056-02BB-453E-8448-EC90B9794180}" = Nokia Multimedia Common Components 2.4
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites für Windows Live Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}" = Nokia PC Suite
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.4 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B55690B9-756E-41C6-8418-84AB04A5A605}" = Nokia Ovi Music Manager
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C4B045DB-C2C0-4A05-8DA5-754B4733EE31}" = Nokia Ovi One Touch Access
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D3656CE3-0F62-447F-AEF3-9BF29B6197D9}" = Nokia Photos
"{DAC63ECB-4571-435F-9B19-51F54BC88109}" = Nokia Home Media Server
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E1C7EF5E-3A7B-4ED4-A48B-F70F1B36EAB4}" = Corel Paint Shop Pro Photo XI
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F9EA1C47-64A6-45E4-9A80-8CC1575B971D}" = Nokia Ovi System Utilities
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"0BCA6D24013166B380927D270B90FF6D447A4AAA" = Windows Driver Package - OPTO ELECTRONICS CO.,LTD (optousb) Ports  (06/02/2008 2.0.5.5)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ahtyer" = Favorit
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows-Treiberpaket - Nokia Modem  (05/22/2008 3.8)
"CamStudio" = CamStudio
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Windows-Treiberpaket - Nokia Modem  (03/05/2008 3.7)
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Windows-Treiberpaket - Nokia Modem  (03/13/2008 6.86.0.1)
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"Google Desktop" = Google Desktop
"HijackThis" = HijackThis 2.0.2
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"lvdrivers_11.70" = Logitech QuickCam-Treiberpaket
"Mahjong Towers II" = Mahjong Towers II
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Messenger_Plus_Live Toolbar" = Messenger_Plus_Live Toolbar
"Messenger_Plus_Live_Germany Toolbar" = Messenger_Plus_Live_Germany Toolbar
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Netlog 24" = Netlog 24
"Netlog Music Tool" = Netlog Music Tool
"Nokia Ovi Application Installer" = Nokia Ovi Application Installer 6.85.3011
"Nokia Ovi Content Copier" = Nokia Ovi Content Copier 6.85.3011
"Nokia Ovi Music Manager" = Nokia Ovi Music Manager 6.85.3008
"Nokia Ovi One Touch Access" = Nokia Ovi One Touch Access 6.85.3019
"Nokia Ovi System Utilities" = Nokia Ovi System Utilities 6.85.3018
"Nokia PC Suite" = Nokia PC Suite
"NuragoLSP" = NuragoLSP
"NVIDIA Drivers" = NVIDIA Drivers
"Panel Client_is1" = Panel Client 3.2
"SCHLECKER Foto Digital Service" = SCHLECKER Foto Digital Service
"Tobit ClipInc Server" = Tobit.Software clipinc.fx
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.2
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"X10Hardware" = X10 Hardware(TM)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2071923619-2738621278-2916424366-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Netlog Photo Tool" = Netlog Photo Tool
"Netlog Video Tool" = Netlog Video Tool
"QUICKMEDIACONVERTER" = Player
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---

OTL Logfile:

OTL logfile created on: 23.06.2010 15:17:20 - Run 2
OTL by OldTimer - Version 3.2.6.1     Folder = C:\Users\Elke\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 42,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 576,15 Gb Total Space | 424,95 Gb Free Space | 73,76% Space Free | Partition Type: NTFS
Drive D: | 20,01 Gb Total Space | 11,16 Gb Free Space | 55,76% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ELKE-PC
Current User Name: Elke
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Elke\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Microsoft\Office Live\OfficeLiveSignIn.exe (Microsoft Corp.)
PRC - C:\Programme\GfKLSPService\GfKLSPService.exe (nurago GmbH)
PRC - C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\GfKLSPService\GacelaWatchDogService.exe ()
PRC - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe (Nokia)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Tobit ClipInc\Server\ClipInc-Server.exe ()
PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Programme\GfK Internet-Monitor 2.0\GfK-Reporting.exe (nurago GmbH)
PRC - C:\Programme\GfK Internet-Monitor 2.0\GfK-Updater.exe (Nurago GmbH )
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Tobit ClipInc\Player\ClipIncTray.exe (Tobit.Software)
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Programme\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
PRC - C:\Programme\Netlog 24\Notifier\Netlog24Notifier.exe (Netlog)
PRC - C:\Programme\Netlog Music Tool\NetlogMusicTool.exe ()
PRC - C:\Programme\Nokia\Nokia Home Media Server\Media Server\twonkymediaserver.exe ()
PRC - C:\Programme\Nokia\Nokia Home Media Server\Media Server\twonkymedia.exe (PacketVideo)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Programme\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
PRC - C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Programme\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Programme\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Programme\NETGEAR\WG111v3\WG111v3.exe ()
PRC - C:\Programme\Home Cinema\Power2Go\Power2GoExpress.exe (Cyberlink)
PRC - C:\Windows\System32\PSIService.exe ()
PRC - C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Elke\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (GfkLSPService) -- C:\Programme\GfKLSPService\GfKLSPService.exe (nurago GmbH)
SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ClipInc001) -- C:\Program Files\Tobit ClipInc\Server\ClipInc-Server.exe ()
SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (GfK-Reporting-Service) -- C:\Program Files\GfK Internet-Monitor 2.0\GfK-Reporting.exe (nurago GmbH)
SRV - (GfK-Update-Service) -- C:\Program Files\GfK Internet-Monitor 2.0\GfK-Updater.exe (Nurago GmbH )
SRV - (TwonkyMedia) -- C:\Program Files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe (PacketVideo)
SRV - (LVSrvLauncher) -- C:\Programme\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (LVPrcSrv) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()
SRV - (x10nets) -- C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (fssfltr) -- C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (optovcm) -- C:\Windows\System32\drivers\optovcm.sys (OPTO ELECTRONICS CO.,LTD.)
DRV - (optousb) -- C:\Windows\System32\drivers\optousb.sys (OPTO ELECTRONICS CO.,LTD.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (LVUSBSta) -- C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) -- C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)
DRV - (LVPr2Mon) -- C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (LVcKap) -- C:\Windows\System32\drivers\Lvckap.sys (Logitech Inc.)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (PhilCap) -- C:\Windows\System32\drivers\PhilCap.sys (NXP Semiconductors Germany GmbH)
DRV - (RTL8187B) -- C:\Windows\System32\drivers\wg111v3.sys (NETGEAR Inc.                           )
DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.)
DRV - (X10Hid) -- C:\Windows\System32\drivers\x10hid.sys (X10 Wireless Technology, Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKLM\..\URLSearchHook: {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Programme\Messenger_Plus_Live_Germany\tbMess.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Programme\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\..\URLSearchHook: {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Programme\Messenger_Plus_Live_Germany\tbMess.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Programme\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Messenger Plus Live Germany Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567732&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Messenger Plus Live Germany Customized Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2567732&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0
FF - prefs.js..extensions.enabledItems: fastYoutubeDownloader@yevgenyandrov.net:1.2.2
FF - prefs.js..extensions.enabledItems: gacela2@nurago.com:10.1.261
FF - prefs.js..extensions.enabledItems: {6e764c17-863a-450f-bdd0-6772bd5aaa18}:1.0.3
FF - prefs.js..extensions.enabledItems: {9b339f6e-ddcd-401b-8764-230adbd01761}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {542e4d79-1970-4e95-9862-fdb96f61b280}:2.6.0.15
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
FF - prefs.js..network.proxy.type: 4
 
FF - HKLM\software\mozilla\Firefox\Extensions\\gacela2@nurago.com: C:\Program Files\GfK Internet-Monitor 2.0\ [2010.05.28 13:35:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.12.08 11:38:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.05.05 18:44:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.07 23:08:13 | 000,000,000 | ---D | M]
 
[2008.09.01 23:34:32 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\mozilla\Extensions
[2010.06.23 10:48:40 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions
[2010.05.05 18:13:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.05.28 13:57:11 | 000,000,000 | ---D | M] (Messenger Plus Live Germany Toolbar) -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions\{542e4d79-1970-4e95-9862-fdb96f61b280}
[2009.04.11 19:33:23 | 000,000,000 | ---D | M] (Media Converter) -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}
[2010.03.11 15:45:07 | 000,000,000 | ---D | M] (Messenger Plus Live Toolbar) -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions\{9b339f6e-ddcd-401b-8764-230adbd01761}
[2010.02.14 13:36:42 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.06.13 13:07:44 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\mozilla\Firefox\Profiles\3yzc3z0j.default\extensions\fastYoutubeDownloader@yevgenyandrov.net
[2009.11.16 02:51:39 | 000,002,236 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Mozilla\FireFox\Profiles\3yzc3z0j.default\searchplugins\askcom.xml
[2009.10.06 14:39:06 | 000,002,163 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Mozilla\FireFox\Profiles\3yzc3z0j.default\searchplugins\bing.xml
[2010.04.21 12:07:06 | 000,000,957 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Mozilla\FireFox\Profiles\3yzc3z0j.default\searchplugins\conduit.xml
[2009.01.15 12:01:05 | 000,002,060 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Mozilla\FireFox\Profiles\3yzc3z0j.default\searchplugins\netlog-de.xml
[2009.05.19 14:59:44 | 000,003,915 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Mozilla\FireFox\Profiles\3yzc3z0j.default\searchplugins\sweetim.xml
[2008.09.01 23:35:05 | 000,001,196 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Mozilla\FireFox\Profiles\3yzc3z0j.default\searchplugins\winamp-search.xml
[2010.05.07 23:08:14 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.07 23:08:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.05.07 23:08:03 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (GfK Internet-Monitor) - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Programme\GfK Internet-Monitor 2.0\Gacela2.dll (nurago GmbH)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Messenger Plus Live Germany Toolbar) - {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Programme\Messenger_Plus_Live_Germany\tbMess.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Messenger Plus Live Germany Toolbar) - {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Programme\Messenger_Plus_Live_Germany\tbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Programme\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [EPSON Stylus DX4200 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [GfKWatchDog] C:\Program Files\GfKLSPService\GacelaWatchDogService.exe ()
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickFinder Scheduler] C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE (Corel Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( )
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [ClipIncSrvTray] C:\Program Files\Tobit ClipInc\Player\ClipIncTray.exe (Tobit.Software)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe File not found
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [Netlog 24] C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe (Netlog)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [Netlog Music Tool] C:\Program Files\Netlog Music Tool\NetlogMusicTool.exe ()
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [Power2GoExpress] C:\Program Files\Home Cinema\Power2Go\Power2GoExpress.exe (Cyberlink)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [Sidebar] C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Programme\WordPerfect Office X3\Programs\WPLauncher.hta ()
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Über GfK Internet-Monitor - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Programme\GfK Internet-Monitor 2.0\Gacela2.dll (nurago GmbH)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\GfKLSPService.DLL ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\GfKLSPService.DLL ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\GfKLSPService.DLL ()
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: CabBuilder hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - AppInit_DLLs: (c:\progra~1\google\google~2\goec62~1.dll) - c:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Elke\Pictures\Elke\355260_R_K_B_by_knipseline_pixelio.de.jpg
O24 - Desktop BackupWallPaper: C:\Users\Elke\Pictures\Elke\355260_R_K_B_by_knipseline_pixelio.de.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008.01.21 04:34:27 | 000,000,000 | ---D | M]
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.clmp3enc - C:\Programme\Home Cinema\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\LVCodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.23 11:53:01 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2010.06.23 11:53:01 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2010.06.23 11:53:01 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2010.06.23 09:46:19 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2010.06.23 09:46:19 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2010.06.23 09:41:12 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.06.23 09:41:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.06.23 09:41:11 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.21 00:50:05 | 000,000,000 | ---D | C] -- C:\Users\Elke\AppData\Roaming\IObit
[2010.06.21 00:50:05 | 000,000,000 | ---D | C] -- C:\Programme\IObit
[2010.06.19 17:16:43 | 000,000,000 | ---D | C] -- C:\rsit
[2010.06.18 21:00:16 | 000,000,000 | ---D | C] -- C:\Users\Elke\AppData\Roaming\Facebook
[2010.06.10 19:42:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010.06.10 19:42:18 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.06.10 19:42:18 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.06.10 19:42:05 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.06.10 19:42:05 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.06.10 19:42:05 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.06.10 19:42:05 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.06.10 19:42:05 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.06.10 19:42:05 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.06.10 19:42:05 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.06.10 19:42:05 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.06.10 19:42:05 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.06.10 19:42:05 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.06.10 19:42:05 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.06.10 19:42:05 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.06.10 19:42:05 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.06.10 19:42:05 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.06.10 19:42:05 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.06.10 19:41:45 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.05.28 13:57:12 | 000,000,000 | ---D | C] -- C:\Programme\Messenger_Plus_Live_Germany
[2010.05.28 13:41:48 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.23 15:18:47 | 007,864,320 | -HS- | M] () -- C:\Users\Elke\NTUSER.DAT
[2010.06.23 14:55:15 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.23 14:55:15 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.23 12:56:57 | 000,000,376 | ---- | M] () -- C:\Windows\tasks\Registry Reviver-Elke-Startup.job
[2010.06.23 12:55:17 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.06.23 12:55:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.06.23 12:54:50 | 3220,480,000 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.23 11:54:05 | 000,524,288 | -HS- | M] () -- C:\Users\Elke\NTUSER.DAT{fcd2bb06-e6d8-11dd-9ffc-001bdc003e12}.TMContainer00000000000000000002.regtrans-ms
[2010.06.23 11:54:05 | 000,065,536 | -HS- | M] () -- C:\Users\Elke\NTUSER.DAT{fcd2bb06-e6d8-11dd-9ffc-001bdc003e12}.TM.blf
[2010.06.23 11:53:57 | 000,003,204 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.06.23 11:52:25 | 004,283,338 | -H-- | M] () -- C:\Users\Elke\AppData\Local\IconCache.db
[2010.06.23 09:41:15 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.21 01:04:20 | 000,071,680 | ---- | M] () -- C:\Users\Elke\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.19 21:17:05 | 000,001,981 | ---- | M] () -- C:\Users\Elke\Desktop\Spybot - Search & Destroy.lnk
[2010.06.17 11:56:08 | 000,052,224 | ---- | M] () -- C:\Users\Elke\Documents\Hallo Serdar.doc
[2010.06.17 02:07:55 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.06.17 02:07:55 | 000,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.06.17 02:07:55 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.06.17 02:07:55 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.06.17 02:07:55 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.06.16 20:24:20 | 000,007,206 | -HS- | M] () -- C:\Windows\System32\KGyGaAvL.sys
[2010.06.15 15:25:56 | 000,067,072 | ---- | M] () -- C:\Users\Elke\Documents\seyla 1.doc
[2010.06.14 16:07:13 | 000,025,600 | ---- | M] () -- C:\Users\Elke\Documents\Hallo Elke.doc
[2010.06.11 14:36:05 | 000,367,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.06.08 00:39:26 | 000,240,640 | ---- | M] () -- C:\Users\Elke\Documents\seyla.doc
[2010.06.07 10:15:47 | 000,048,640 | ---- | M] () -- C:\Users\Elke\Documents\Sen Benim Aşk Ararken Bulduğum Değil.doc
[2010.06.06 19:29:50 | 000,524,288 | -HS- | M] () -- C:\Users\Elke\NTUSER.DAT{fcd2bb06-e6d8-11dd-9ffc-001bdc003e12}.TMContainer00000000000000000001.regtrans-ms
[2010.06.04 13:14:42 | 000,037,376 | ---- | M] () -- C:\Users\Elke\Documents\Zitieren.doc
[2010.05.26 19:06:41 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.05.26 16:47:41 | 000,289,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
 
========== Files Created - No Company Name ==========
 
[2010.06.23 09:41:15 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.19 21:17:05 | 000,001,981 | ---- | C] () -- C:\Users\Elke\Desktop\Spybot - Search & Destroy.lnk
[2010.06.17 11:56:08 | 000,052,224 | ---- | C] () -- C:\Users\Elke\Documents\Hallo Serdar.doc
[2010.06.15 15:25:56 | 000,067,072 | ---- | C] () -- C:\Users\Elke\Documents\seyla 1.doc
[2010.06.14 16:07:11 | 000,025,600 | ---- | C] () -- C:\Users\Elke\Documents\Hallo Elke.doc
[2010.06.08 00:39:25 | 000,240,640 | ---- | C] () -- C:\Users\Elke\Documents\seyla.doc
[2010.06.07 10:15:46 | 000,048,640 | ---- | C] () -- C:\Users\Elke\Documents\Sen Benim Aşk Ararken Bulduğum Değil.doc
[2010.06.04 13:14:41 | 000,037,376 | ---- | C] () -- C:\Users\Elke\Documents\Zitieren.doc
[2010.04.13 17:12:31 | 000,262,144 | ---- | C] () -- C:\Windows\System32\GfKLSPService.DLL
[2010.03.25 01:04:06 | 000,002,688 | ---- | C] () -- C:\Windows\System32\GfKLSPService.ini
[2010.03.25 01:04:06 | 000,000,080 | ---- | C] () -- C:\Windows\System32\GfKLSPServiceOff.ini
[2009.09.24 17:08:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.25 00:02:48 | 000,000,065 | ---- | C] () -- C:\Windows\FISHUI.INI
[2009.05.20 20:53:55 | 000,339,968 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
[2009.05.20 20:53:55 | 000,114,688 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
[2009.02.16 16:39:03 | 000,000,088 | RHS- | C] () -- C:\Windows\System32\F075FCFF2A.sys
[2008.09.15 00:47:00 | 000,442,368 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2008.09.02 15:26:27 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.09.01 12:53:12 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2008.08.29 23:50:26 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008.08.29 18:54:00 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX4200G.ini
[2008.08.26 15:41:28 | 000,000,792 | ---- | C] () -- C:\Windows\_delis32.ini
[2008.08.25 19:54:00 | 000,007,206 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2008.08.25 19:54:00 | 000,000,008 | RHS- | C] () -- C:\Windows\System32\C4586CE68D.sys
[2008.07.11 12:09:20 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.06.03 11:10:38 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI
[2008.06.03 10:03:42 | 000,009,760 | ---- | C] () -- C:\Windows\System32\716xCoInstaller.dll
[2008.02.05 18:20:08 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2007.03.30 00:00:40 | 000,203,264 | R--- | C] () -- C:\Windows\System32\CddbCdda.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2003.02.20 19:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[1999.01.27 13:39:06 | 000,065,024 | ---- | C] () -- C:\Windows\System32\indounin.dll
[1997.06.13 07:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\Iyvu9_32.dll
 
========== LOP Check ==========
 
[2009.08.25 00:08:10 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\DataCast
[2008.09.03 15:39:09 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\EPSON
[2010.06.18 21:00:17 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Facebook
[2010.06.21 00:50:05 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\IObit
[2008.09.01 12:53:28 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Leadertech
[2009.07.18 17:56:04 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Nokia
[2009.11.16 11:59:26 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Nseries
[2009.07.30 14:14:42 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\PC Suite
[2008.09.04 12:40:59 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Tobit
[2009.07.18 19:13:59 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Nokia
[2008.09.04 18:17:25 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\PC Suite
[2008.12.07 16:28:18 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Tobit
[2010.06.23 12:56:57 | 000,000,376 | ---- | M] () -- C:\Windows\Tasks\Registry Reviver-Elke-Startup.job
[2010.06.23 11:53:58 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.08.24 14:35:35 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Adobe
[2008.09.03 00:42:59 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Apple Computer
[2010.06.16 20:31:52 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Corel
[2009.05.08 14:01:04 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\CyberLink
[2009.08.25 00:08:10 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\DataCast
[2008.09.03 15:39:09 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\EPSON
[2010.06.18 21:00:17 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Facebook
[2008.08.22 21:09:31 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Google
[2008.08.22 17:17:00 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Identities
[2008.08.29 23:50:19 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\InstallShield
[2010.06.21 00:50:05 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\IObit
[2008.09.01 12:53:28 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Leadertech
[2008.08.22 19:39:19 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Macromedia
[2010.04.24 22:38:03 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Media Center Programs
[2009.12.22 17:46:30 | 000,000,000 | --SD | M] -- C:\Users\Elke\AppData\Roaming\Microsoft
[2008.09.01 23:34:32 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Mozilla
[2008.08.30 01:18:42 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Nero
[2009.07.18 17:56:04 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Nokia
[2009.11.16 11:59:26 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Nseries
[2009.07.30 14:14:42 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\PC Suite
[2010.02.27 03:13:05 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Skype
[2010.02.27 02:08:24 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\skypePM
[2008.09.04 12:40:59 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\Tobit
[2010.03.10 12:11:36 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\U3
[2010.04.29 12:00:20 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\vlc
[2009.06.01 18:16:21 | 000,000,000 | ---D | M] -- C:\Users\Elke\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.06.18 21:00:17 | 000,050,354 | ---- | M] (Facebook, Inc.) -- C:\Users\Elke\AppData\Roaming\Facebook\uninstall.exe
[2009.07.18 15:03:56 | 020,914,549 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\Nokia\Nokia Download!\Temp\Nokia_Download_newUI_2.1.19.0_setup.exe
[2007.10.23 10:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Elke\AppData\Roaming\U3\temp\cleanup.exe
[2008.05.02 11:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\Elke\AppData\Roaming\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.03.12 08:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.12.08 08:28:08 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=1A649B87A7B7C1220A2B16B121F2198E -- C:\Windows\System32\drivers\nvstor32.sys
[2007.12.08 08:28:08 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=1A649B87A7B7C1220A2B16B121F2198E -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_933da2ea\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
< 5. Klicke "run Scan" >
 
< 6. 2 reporte werden erstellt: >
 
< OTL.Txt >
 
< Extras.Txt >
< End of report >
         

--- --- ---

hi, spybot kann unsere arbeit behindern, deinstaliere es erst mal, starte dann neu.


Fixen mit OTL

• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe File not found
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten
bitte öffne avira, ereignisse und teile mal mit, was avira gemeldet hat

All processes killed
Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-2071923619-2738621278-2916424366-1000..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe File not found> in the current context!
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Elke
->Flash cache emptied: 784 bytes

User: Gast
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Elke
->Temp folder emptied: 1999491 bytes
->Temporary Internet Files folder emptied: 175168 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 2434143 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 119018593 bytes
->Java cache emptied: 25803258 bytes
->FireFox cache emptied: 47813519 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2566031 bytes
RecycleBin emptied: 20204651 bytes

Total Files Cleaned = 210,00 mb


OTL by OldTimer - Version 3.2.6.1 log created on 06232010_172757

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Also beim ersten Mal hat sich der Pc aufgehängt, beim zweiten Versuch hat es dann geklappt.

so und wenn du mir jetzt noch sagt welche meldungen avira ausspuckt?

Also aviar scheint zufrieden zu sein aber dort ist der trojaner auch vorher nicht angzeigt worden.



Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Mittwoch, 23. Juni 2010 17:50

Es wird nach 2239525 Virenstämmen gesucht.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : Elke
Computername : ELKE-PC

Versionsinformationen:
BUILD.DAT : 9.0.0.422 21701 Bytes 09.03.2010 10:23:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 20.11.2009 10:53:44
AVSCAN.DLL : 9.0.3.0 49409 Bytes 13.02.2009 11:04:10
LUKE.DLL : 9.0.3.2 209665 Bytes 20.02.2009 10:35:44
LUKERES.DLL : 9.0.2.0 13569 Bytes 26.01.2009 09:41:59
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:53:44
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 10:53:44
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 13:13:37
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 17:36:43
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 17:42:20
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 13:21:55
VBASE006.VDF : 7.10.7.218 2294784 Bytes 02.06.2010 16:05:38
VBASE007.VDF : 7.10.7.219 2048 Bytes 02.06.2010 16:05:39
VBASE008.VDF : 7.10.7.220 2048 Bytes 02.06.2010 16:05:42
VBASE009.VDF : 7.10.7.221 2048 Bytes 02.06.2010 16:05:43
VBASE010.VDF : 7.10.7.222 2048 Bytes 02.06.2010 16:05:43
VBASE011.VDF : 7.10.7.223 2048 Bytes 02.06.2010 16:05:44
VBASE012.VDF : 7.10.7.224 2048 Bytes 02.06.2010 16:05:44
VBASE013.VDF : 7.10.8.37 270336 Bytes 10.06.2010 22:39:32
VBASE014.VDF : 7.10.8.69 138752 Bytes 14.06.2010 10:40:43
VBASE015.VDF : 7.10.8.102 130560 Bytes 16.06.2010 10:40:48
VBASE016.VDF : 7.10.8.135 152064 Bytes 21.06.2010 10:57:24
VBASE017.VDF : 7.10.8.136 2048 Bytes 21.06.2010 10:57:24
VBASE018.VDF : 7.10.8.137 2048 Bytes 21.06.2010 10:57:24
VBASE019.VDF : 7.10.8.138 2048 Bytes 21.06.2010 10:57:25
VBASE020.VDF : 7.10.8.139 2048 Bytes 21.06.2010 10:57:25
VBASE021.VDF : 7.10.8.140 2048 Bytes 21.06.2010 10:57:25
VBASE022.VDF : 7.10.8.141 2048 Bytes 21.06.2010 10:57:26
VBASE023.VDF : 7.10.8.142 2048 Bytes 21.06.2010 10:57:26
VBASE024.VDF : 7.10.8.143 2048 Bytes 21.06.2010 10:57:26
VBASE025.VDF : 7.10.8.144 2048 Bytes 21.06.2010 10:57:26
VBASE026.VDF : 7.10.8.145 2048 Bytes 21.06.2010 10:57:27
VBASE027.VDF : 7.10.8.146 2048 Bytes 21.06.2010 10:57:27
VBASE028.VDF : 7.10.8.147 2048 Bytes 21.06.2010 10:57:27
VBASE029.VDF : 7.10.8.148 2048 Bytes 21.06.2010 10:57:28
VBASE030.VDF : 7.10.8.149 2048 Bytes 21.06.2010 10:57:28
VBASE031.VDF : 7.10.8.158 133632 Bytes 23.06.2010 10:57:43
Engineversion : 8.2.2.6
AEVDF.DLL : 8.1.2.0 106868 Bytes 23.04.2010 23:55:36
AESCRIPT.DLL : 8.1.3.31 1352058 Bytes 02.06.2010 16:07:40
AESCN.DLL : 8.1.6.1 127347 Bytes 12.05.2010 18:51:02
AESBX.DLL : 8.1.3.1 254324 Bytes 23.04.2010 23:55:36
AERDL.DLL : 8.1.4.6 541043 Bytes 21.04.2010 13:22:25
AEPACK.DLL : 8.2.1.1 426358 Bytes 19.03.2010 17:08:43
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 12.05.2010 18:51:01
AEHEUR.DLL : 8.1.1.33 2724214 Bytes 04.06.2010 17:26:57
AEHELP.DLL : 8.1.11.5 242038 Bytes 02.06.2010 16:06:05
AEGEN.DLL : 8.1.3.10 377205 Bytes 02.06.2010 16:06:02
AEEMU.DLL : 8.1.2.0 393588 Bytes 23.04.2010 23:55:33
AECORE.DLL : 8.1.15.3 192886 Bytes 12.05.2010 18:51:00
AEBB.DLL : 8.1.1.0 53618 Bytes 23.04.2010 23:55:33
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12.12.2008 07:47:56
AVPREF.DLL : 9.0.3.0 44289 Bytes 09.09.2009 10:46:58
AVREP.DLL : 8.0.0.7 159784 Bytes 18.02.2010 16:41:04
AVREG.DLL : 9.0.0.0 36609 Bytes 07.11.2008 14:25:04
AVARKT.DLL : 9.0.0.3 292609 Bytes 24.03.2009 14:05:37
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30.01.2009 09:37:04
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28.01.2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02.02.2009 07:21:28
NETNT.DLL : 9.0.0.0 11521 Bytes 07.11.2008 14:41:21
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 09.06.2009 12:44:39
RCTEXT.DLL : 9.0.73.0 87297 Bytes 20.11.2009 10:53:44

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: c:\program files\avira\antivir desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, F:, G:, H:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: mittel

Beginn des Suchlaufs: Mittwoch, 23. Juni 2010 17:50

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'dllhost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'dllhost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'OfficeLiveSignIn.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'OUTLOOK.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'msnmsgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wlcomm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclMSBTSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclRSSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclUSBSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ServiceLayer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'COCIManager.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMIndexStoreSvr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMIndexingService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WG111v3.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LogitechDesktopMessenger.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PCSuite.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMBgMonitor.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Power2GoExpress.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ClipIncTray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleToolbarNotifier.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Netlog24Notifier.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NetlogMusicTool.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'msnmsgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GacelaWatchDogService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Quickcam.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Communications_Helper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleDesktop.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'alg.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'twonkymediaserver.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'explorer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'dwm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LVComSer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVCM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'X10nets.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'twonkymedia.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PSIService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NBService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LVPrcSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LVComSer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GfKLSPService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GfK-Updater.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GfK-Reporting.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ClipInc-Server.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'audiodg.exe' - '0' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
Es wurden '93' Prozesse mit '93' Modulen durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Masterbootsektor HD3
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'F:\'
[INFO] Im Laufwerk 'F:\' ist kein Datenträger eingelegt!
Bootsektor 'G:\'
[INFO] Im Laufwerk 'G:\' ist kein Datenträger eingelegt!
Bootsektor 'H:\'
[INFO] Im Laufwerk 'H:\' ist kein Datenträger eingelegt!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '52' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <BOOT>
C:\hiberfil.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
[HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei.
[HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann.
C:\pagefile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
[HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei.
[HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann.
Beginne mit der Suche in 'D:\' <RECOVER>
Beginne mit der Suche in 'F:\'
Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'G:\'
Der zu durchsuchende Pfad G:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'H:\'
Der zu durchsuchende Pfad H:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.


Ende des Suchlaufs: Mittwoch, 23. Juni 2010 18:37
Benötigte Zeit: 47:16 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

28739 Verzeichnisse wurden überprüft
492148 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
2 Dateien konnten nicht durchsucht werden
492146 Dateien ohne Befall
5078 Archive wurden durchsucht
2 Warnungen
2 Hinweise