| |
| |||||||
Log-Analyse und Auswertung: Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuftWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.06.2010, 13:20
| #1 |
 |  Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Hi, leider habe ich seit gestern das Problem, das sich ab und zu via IE Werbung und Anzeigen öffnen. Zudem lagt ein Spiel, das dies bisher noch nie getan hat... hier meine HiJack Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:17:22, on 27.06.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme2\Kodak\printer\center\KodakSvc.exe C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\Dit.exe C:\WINDOWS\system32\Prismsta.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\Tvacaa.exe C:\Programme\Windows Live\Messenger\msnmsgr.exe C:\Programme\Windows Live\Contacts\wlcomm.exe C:\Programme\Windows Media Player\wmplayer.exe C:\WINDOWS\system32\rundll32.exe C:\DOKUME~1\*****\LOKALE~1\Temp\Td1.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme2\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.medion.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Prism_Utility] Prismsta.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe O4 - Global Startup: McAfee Security Scan Plus.lnk = ? O4 - Global Startup: REALTEK RTL8185 Wireless LAN Utility.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: MedionShop - {07E3F115-C445-480D-94CB-ECA914A353CE} - hxxp://www.medionshop.de/ (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=hxxp://www.aldi.com O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{F1D17B61-9097-4B08-8A46-E43E61F637DE}: NameServer = 213.191.74.18,213.191.74.19 O17 - HKLM\System\CS1\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme2\Common\Database\bin\fbserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Programme2\Kodak\printer\center\KodakSvc.exe O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 8689 bytes Ich hoffe jemand kann mir helfen, grüße! |
|
27.06.2010, 13:25
| #2 |
| /// Selecta Jahrusso   | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen Code:
ATTFilter C:\WINDOWS\Tvacaa.exe
Schritt 2 Downloade Dir bitte Load.exe
Nach dem Neustart findest Du einen Ordner MFTools auf dem Desktop. Darin befindet sich eine Anleitung.pdf. Diese bitte öffnen und die darin beschriebenen Schritte abarbeiten.
__________________ |
|
28.06.2010, 11:21
| #3 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft so das sind die ergebnisse von virustotal:
__________________Antivirus Version letzte aktualisierung Ergebnis a-squared 5.0.0.30 2010.06.27 - AhnLab-V3 2010.06.27.01 2010.06.27 - AntiVir 8.2.4.2 2010.06.25 - Antiy-AVL 2.0.3.7 2010.06.25 - Authentium 5.2.0.5 2010.06.26 - Avast 4.8.1351.0 2010.06.27 Win32:MalOb-BL Avast5 5.0.332.0 2010.06.27 Win32:MalOb-BL AVG 9.0.0.836 2010.06.27 FakeAV.CCQ BitDefender 7.2 2010.06.27 - CAT-QuickHeal 10.00 2010.06.26 - ClamAV 0.96.0.3-git 2010.06.26 - Comodo 5233 2010.06.27 - DrWeb 5.0.2.03300 2010.06.27 - eSafe 7.0.17.0 2010.06.24 - eTrust-Vet 36.1.7668 2010.06.25 Win32/Renos.D!generic F-Prot 4.6.1.107 2010.06.26 - F-Secure 9.0.15370.0 2010.06.26 Suspicious:W32/Malware!Gemini Fortinet 4.1.133.0 2010.06.27 - GData 21 2010.06.27 Win32:MalOb-BL Ikarus T3.1.1.84.0 2010.06.27 - Jiangmin 13.0.900 2010.06.27 - Kaspersky 7.0.0.125 2010.06.27 - McAfee 5.400.0.1158 2010.06.27 Downloader-CEW.b McAfee-GW-Edition 2010.1 2010.06.25 - Microsoft 1.5902 2010.06.27 - NOD32 5232 2010.06.27 - Norman 6.05.10 2010.06.27 - nProtect 2010-06-27.02 2010.06.27 - Panda 10.0.2.7 2010.06.27 - PCTools 7.0.3.5 2010.06.27 - Prevx 3.0 2010.06.27 High Risk Cloaked Malware Rising 22.53.04.05 2010.06.25 - Sophos 4.54.0 2010.06.27 Mal/FakeAV-CX Sunbelt 6513 2010.06.27 VirTool.Win32.Obfuscator.hg!b (v) Symantec 20101.1.0.89 2010.06.27 - TheHacker 6.5.2.0.303 2010.06.25 - TrendMicro 9.120.0.1004 2010.06.27 - TrendMicro-HouseCall 9.120.0.1004 2010.06.27 - VBA32 3.12.12.5 2010.06.25 - ViRobot 2010.6.26.3907 2010.06.26 - VirusBuster 5.0.27.0 2010.06.26 - weitere Informationen File size: 162816 bytes MD5 : bbdf0667d1c692adedc1e978426e6cc8 SHA1 : d5af45b1449c753204b1571b146231d9f9f72a6c SHA256: 5c5294f8abf57dd00f3456aba7606c014b23c9200b3a14cde690dbd2086916c7 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x44B0 timedatestamp.....: 0x4B2AC6F6 (Fri Dec 18 01:04:06 2009) machinetype.......: 0x14C (Intel I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 CODE 0x1000 0x7097 0x7200 3.53 864c58e55fedc656092e8c339416864e .data 0x9000 0x274 0x400 2.73 d28b173591273c1a0126ec27bba3864f .tls 0xA000 0x1F879 0x1FA00 7.57 fa2bdde931e6e949d105e51417f5e849 .idata 0x2A000 0x1D36B 0x400 0.00 0f343b0931126a20f133d67c2b018a3b DATA 0x48000 0x3FF 0x400 0.87 0df194e8a95a0f1157a508d583592796 ( 12 imports ) > advapi32.dll: RegQueryValueExA, RegQueryValueA, RegEnumKeyA, RegCreateKeyA > comctl32.dll: ImageList_Add, ImageList_Write, ImageList_DragShowNolock > comdlg32.dll: GetSaveFileNameA, ChooseColorA, FindTextA, GetFileTitleA, GetOpenFileNameA > gdi32.dll: GetCurrentPositionEx, SaveDC, BitBlt, CopyEnhMetaFileA, LineTo, CreateCompatibleDC, SetTextColor > kernel32.dll: CreateFileA, CloseHandle, GetStringTypeA, SetEndOfFile, GetProcAddress, VirtualQuery, LoadResource, lstrcmpiA, ExitThread, GetModuleHandleA, LoadLibraryA, ReadFile, EnterCriticalSection, VirtualAlloc > msvcrt.dll: malloc, strncmp, log, memcpy > ole32.dll: CLSIDFromProgID, GetHGlobalFromStream, CoRevokeClassObject, CoTaskMemFree, OleRegGetUserType, CoGetContextToken, CoCreateFreeThreadedMarshaler > oleaut32.dll: RegisterTypeLib > shell32.dll: DragQueryFileA, SHGetFileInfoA > shlwapi.dll: SHQueryInfoKeyA, SHGetValueA > user32.dll: EnumThreadWindows, IsChild, GetWindowThreadProcessId, GetKeyboardType, GetFocus, GetTopWindow, SetMenu, CreateWindowExA, AdjustWindowRectEx, EnableScrollBar, IsDialogMessageA, IsWindowEnabled, GetDlgItem, GetWindowRect, GetDCEx, MessageBoxA, SetWindowPlacement, CharToOemA, SetScrollPos, SetClassLongA, SetMenuItemInfoA, KillTimer, DrawAnimatedRects, SetFocus, ActivateKeyboardLayout, GetMessagePos, GetKeyboardLayout, CallNextHookEx, GetMenuItemInfoA, EndPaint, DrawMenuBar, MsgWaitForMultipleObjects, GetMenuStringA, GetKeyboardLayoutList, SetParent, UpdateWindow, SetWindowLongA, EnumWindows, DestroyMenu, GetScrollPos, SendMessageA, FrameRect, GetActiveWindow, PtInRect, ScrollWindow, CloseClipboard, TrackPopupMenu, OemToCharA, InvalidateRect, RemoveMenu, InsertMenuA, SetClipboardData, RegisterWindowMessageA, GetKeyNameTextA, ScreenToClient, GetCapture, GetClassNameA, OffsetRect, ReleaseCapture, WaitMessage, RemovePropA, EnableWindow, LoadBitmapA, ShowOwnedPopups, IsDialogMessageW, SetWindowPos, SetScrollRange, GetClientRect, IsWindowVisible, DispatchMessageA, DrawTextA, EnableMenuItem, CharLowerBuffA, DestroyWindow, CharUpperBuffA, SendMessageW, LoadStringA, DefFrameProcA, IntersectRect, GetDesktopWindow, GetMenuItemID, GetScrollInfo, SetWindowTextA, DefMDIChildProcA, MapVirtualKeyA, SystemParametersInfoA, IsIconic, UnhookWindowsHookEx, UnregisterClassA, CreateIcon, InflateRect, ShowScrollBar, CreatePopupMenu, PostQuitMessage, EmptyClipboard, GetSubMenu, GetClassInfoA, SetForegroundWindow, BeginPaint, PeekMessageW, CallWindowProcA, CheckMenuItem, RedrawWindow, IsRectEmpty, ClientToScreen, GetSysColorBrush, TranslateMDISysAccel, PeekMessageA, SetWindowsHookExA, CreateMenu, IsWindow, DestroyCursor, GetClassLongA, SetCursor, SetActiveWindow, MessageBeep, OpenClipboard > version.dll: VerQueryValueA ( 0 exports ) TrID : File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) Symantec reputation: Suspicious.Insight Suspicious.Insight | Symantec ssdeep: 3072:FGXuq+tcCrVDq8azwbYSMMXF09dVPP6LkKtH+NuvJQT30:FMgigazIYS8xPC9teNwJM0 sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned Prevx Info: Prevx PEiD : - RDS : NSRL Reference Data Set soll ich schritt 2 mit load.exe jetzt durchführen`? |
|
28.06.2010, 11:30
| #4 |
| /// Selecta Jahrusso | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Wäre nicht schlecht ja 
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
28.06.2010, 13:41
| #5 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft erledigt... von einer pdf mit aleitung war aber nichts da, lediglich der temp cleaner ist durchgelaufen ?!?! und zusätzlich hab ich ne zip aufm desktop "Gmer" enthält nur "Gmer.exe", was soll ich damit machen? ansonsten hier noch mal die HiJack wenns was bringt: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:38:49, on 28.06.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme2\Kodak\printer\center\KodakSvc.exe C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\Dit.exe C:\WINDOWS\system32\Prismsta.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme2\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.medion.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Welcome to ALDI R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Prism_Utility] Prismsta.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [QNB2EB90WX] C:\DOKUME~1\Henri\LOKALE~1\Temp\Td1.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe O4 - Global Startup: McAfee Security Scan Plus.lnk = ? O4 - Global Startup: REALTEK RTL8185 Wireless LAN Utility.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: MedionShop - {07E3F115-C445-480D-94CB-ECA914A353CE} - MEDIONshop Deutschland (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=hxxp://www.aldi.com O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{F1D17B61-9097-4B08-8A46-E43E61F637DE}: NameServer = 213.191.74.18,213.191.74.19 O17 - HKLM\System\CS1\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme2\Common\Database\bin\fbserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Programme2\Kodak\printer\center\KodakSvc.exe O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 8520 bytes Danke für die schnellen antworten, liebe Grüße, DAMME!! |
|
28.06.2010, 13:46
| #6 |
| /// Selecta Jahrusso | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Und kein Ordner MFTools auf dem Desktop ? 
__________________ --> Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft |
|
01.07.2010, 00:05
| #7 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft doch, sry... wenn ich die aleitung jetzt aber befolge, dann habe ich probleme gmer.exe zu öffnen. die exe is auf dem desktop und kurz nachdem ich es öffne, kommt die fehlermeldung: "gmer.exe hat ein problem festgestellt und musste beendet werden... problem bericht senden/nicht senden." bei senden spuct er den aber nicht aus. bitte um hilfe, mittlerweile meckert avira noch mehr rum und teilweise kann ich nicht mal mehr den Firefox öffen, was soll ich tun, schritte 1 bis 3 aus pdf sind ausgeführt! danke, damme |
|
01.07.2010, 00:32
| #8 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft der neue kram vor dem mich antivir warnt heist glaub ich (name geht komischerweise weg nach paar sekunden: "sshnhs21.exe" damme |
|
01.07.2010, 00:46
| #9 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft er sagt dahinter verbirgt sich das trojanische pferd "TR/codepack.kuw" |
|
01.07.2010, 07:38
| #10 |
| /// Selecta Jahrusso | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Steht da nicht, wenn Du Probleme bei einem Schritt hast, überspringen ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
01.07.2010, 11:08
| #12 |
| /// Selecta Jahrusso | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Sieht nach nem unfertigen Download aus. CustomScan mit OTL Lade Dir bitte OTL von Oldtimer erneut herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
01.07.2010, 12:31
| #13 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft ÿþO T L E x t r a s l o g f i l e c r e a t e d o n : 0 1 . 0 7 . 2 0 1 0 1 3 : 1 1 : 0 3 - R u n 1 O T L b y O l d T i m e r - V e r s i o n 3 . 2 . 7 . 0 F o l d e r = C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ D e s k t o p W i n d o w s X P H o m e E d i t i o n S e r v i c e P a c k 3 ( V e r s i o n = 5 . 1 . 2 6 0 0 ) - T y p e = N T W o r k s t a t i o n I n t e r n e t E x p l o r e r ( V e r s i o n = 6 . 0 . 2 9 0 0 . 5 5 1 2 ) L o c a l e : 0 0 0 0 0 4 0 7 | C o u n t r y : D e u t s c h l a n d | L a n g u a g e : D E U | D a t e F o r m a t : d d . M M . y y y y 1 , 0 0 G b T o t a l P h y s i c a l M e m o r y | 1 , 0 0 G b A v a i l a b l e P h y s i c a l M e m o r y | 6 5 , 0 0 % M e m o r y f r e e 2 , 0 0 G b P a g i n g F i l e | 1 , 0 0 G b A v a i l a b l e i n P a g i n g F i l e | 7 9 , 0 0 % P a g i n g F i l e f r e e P a g i n g f i l e l o c a t i o n ( s ) : C : \ p a g e f i l e . s y s 7 6 8 1 5 3 6 [ b i n a r y d a t a ] % S y s t e m D r i v e % = C : | % S y s t e m R o o t % = C : \ W I N D O W S | % P r o g r a m F i l e s % = C : \ P r o g r a m m e D r i v e C : | 9 3 , 1 6 G b T o t a l S p a c e | 1 1 , 6 0 G b F r e e S p a c e | 1 2 , 4 6 % S p a c e F r e e | P a r t i t i o n T y p e : N T F S D r i v e D : | 8 3 , 3 8 G b T o t a l S p a c e | 4 9 , 5 1 G b F r e e S p a c e | 5 9 , 3 8 % S p a c e F r e e | P a r t i t i o n T y p e : N T F S D r i v e E : | 9 , 7 6 G b T o t a l S p a c e | 5 , 6 3 G b F r e e S p a c e | 5 7 , 7 4 % S p a c e F r e e | P a r t i t i o n T y p e : F A T 3 2 F : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d G : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d H : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d I : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d D r i v e P : | 6 , 6 7 M b T o t a l S p a c e | 0 , 0 0 M b F r e e S p a c e | 0 , 0 0 % S p a c e F r e e | P a r t i t i o n T y p e : C D F S D r i v e Q : | 7 , 4 7 G b T o t a l S p a c e | 3 , 4 9 G b F r e e S p a c e | 4 6 , 6 6 % S p a c e F r e e | P a r t i t i o n T y p e : F A T 3 2 C o m p u t e r N a m e : H E N R I S P C C u r r e n t U s e r N a m e : H e n r i L o g g e d i n a s A d m i n i s t r a t o r . C u r r e n t B o o t M o d e : N o r m a l S c a n M o d e : C u r r e n t u s e r C o m p a n y N a m e W h i t e l i s t : O n S k i p M i c r o s o f t F i l e s : O n F i l e A g e = 9 0 D a y s O u t p u t = S t a n d a r d Q u i c k S c a n [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = E x t r a R e g i s t r y ( S a f e L i s t ) = = = = = = = = = = [ / c o l o r ] [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = F i l e A s s o c i a t i o n s = = = = = = = = = = [ / c o l o r ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ C l a s s e s \ < e x t e n s i o n > ] [ H K E Y _ C U R R E N T _ U S E R \ S O F T W A R E \ C l a s s e s \ < e x t e n s i o n > ] . h t m l [ @ = F i r e f o x H T M L ] - - C : \ P r o g r a m m e \ M o z i l l a F i r e f o x \ f i r e f o x . e x e ( M o z i l l a C o r p o r a t i o n ) [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S h e l l S p a w n i n g = = = = = = = = = = [ / c o l o r ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ C l a s s e s \ < k e y > \ s h e l l \ [ c o m m a n d ] \ c o m m a n d ] b a t f i l e [ o p e n ] - - " % 1 " % * c m d f i l e [ o p e n ] - - " % 1 " % * c o m f i l e [ o p e n ] - - " % 1 " % * e x e f i l e [ o p e n ] - - " % 1 " % * h t m l f i l e [ e d i t ] - - " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ m s o h t m e d . e x e " % 1 ( M i c r o s o f t C o r p o r a t i o n ) h t m l f i l e [ p r i n t ] - - " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ m s o h t m e d . e x e " / p % 1 ( M i c r o s o f t C o r p o r a t i o n ) p i f f i l e [ o p e n ] - - " % 1 " % * r e g f i l e [ m e r g e ] - - R e g E r r o r : K e y e r r o r . s c r f i l e [ c o n f i g ] - - " % 1 " s c r f i l e [ i n s t a l l ] - - r u n d l l 3 2 . e x e d e s k . c p l , I n s t a l l S c r e e n S a v e r % l ( M i c r o s o f t C o r p o r a t i o n ) s c r f i l e [ o p e n ] - - " % 1 " / S t x t f i l e [ e d i t ] - - R e g E r r o r : K e y e r r o r . U n k n o w n [ o p e n a s ] - - % S y s t e m R o o t % \ s y s t e m 3 2 \ r u n d l l 3 2 . e x e % S y s t e m R o o t % \ s y s t e m 3 2 \ s h e l l 3 2 . d l l , O p e n A s _ R u n D L L % 1 D i r e c t o r y [ f i n d ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e ( M i c r o s o f t C o r p o r a t i o n ) D i r e c t o r y [ O n e N o t e . O p e n ] - - C : \ P R O G R A ~ 1 \ M I C R O S ~ 4 \ O f f i c e 1 2 \ O N E N O T E . E X E " % L " ( M i c r o s o f t C o r p o r a t i o n ) D i r e c t o r y [ W i n a m p . B o o k m a r k ] - - " C : \ P r o g r a m m e 2 \ W i n a m p \ w i n a m p . e x e " / B O O K M A R K " % 1 " ( N u l l s o f t , I n c . ) D i r e c t o r y [ W i n a m p . E n q u e u e ] - - " C : \ P r o g r a m m e 2 \ W i n a m p \ w i n a m p . e x e " / A D D " % 1 " ( N u l l s o f t , I n c . ) D i r e c t o r y [ W i n a m p . P l a y ] - - " C : \ P r o g r a m m e 2 \ W i n a m p \ w i n a m p . e x e " " % 1 " ( N u l l s o f t , I n c . ) F o l d e r [ o p e n ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e / i d l i s t , % I , % L ( M i c r o s o f t C o r p o r a t i o n ) F o l d e r [ e x p l o r e ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e / e , / i d l i s t , % I , % L ( M i c r o s o f t C o r p o r a t i o n ) D r i v e [ f i n d ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e ( M i c r o s o f t C o r p o r a t i o n ) [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S e c u r i t y C e n t e r S e t t i n g s = = = = = = = = = = [ / c o l o r ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r ] " A n t i V i r u s D i s a b l e N o t i f y " = 0 " F i r e w a l l D i s a b l e N o t i f y " = 0 " U p d a t e s D i s a b l e N o t i f y " = 0 " A n t i V i r u s O v e r r i d e " = 0 " F i r e w a l l O v e r r i d e " = 0 [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ A h n l a b A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ C o m p u t e r A s s o c i a t e s A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ K a s p e r s k y A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ M c A f e e A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ M c A f e e F i r e w a l l ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ P a n d a A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ P a n d a F i r e w a l l ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S o p h o s A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S y m a n t e c A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S y m a n t e c F i r e w a l l ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T i n y F i r e w a l l ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T r e n d A n t i V i r u s ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T r e n d F i r e w a l l ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ Z o n e L a b s F i r e w a l l ] [ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ D o m a i n P r o f i l e ] [ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ D o m a i n P r o f i l e \ G l o b a l l y O p e n P o r t s \ L i s t ] " 1 3 9 : T C P " = 1 3 9 : T C P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 4 " 4 4 5 : T C P " = 4 4 5 : T C P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 5 " 1 3 7 : U D P " = 1 3 7 : U D P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 1 " 1 3 8 : U D P " = 1 3 8 : U D P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 2 [ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e ] " E n a b l e F i r e w a l l " = 1 " D o N o t A l l o w E x c e p t i o n s " = 0 " D i s a b l e N o t i f i c a t i o n s " = 0 [ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e \ G l o b a l l y O p e n P o r t s \ L i s t ] " 1 9 0 0 : U D P " = 1 9 0 0 : U D P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 7 " 2 8 6 9 : T C P " = 2 8 6 9 : T C P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 8 " 1 3 9 : T C P " = 1 3 9 : T C P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 4 " 4 4 5 : T C P " = 4 4 5 : T C P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 5 " 1 3 7 : U D P " = 1 3 7 : U D P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 1 " 1 3 8 : U D P " = 1 3 8 : U D P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 2 [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = A u t h o r i z e d A p p l i c a t i o n s L i s t = = = = = = = = = = [ / c o l o r ] [ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ D o m a i n P r o f i l e \ A u t h o r i z e d A p p l i c a t i o n s \ L i s t ] " C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e " = C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e : * : E n a b l e d : W i n d o w s L i v e C a l l - - ( M i c r o s o f t C o r p o r a t i o n ) [ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e \ A u t h o r i z e d A p p l i c a t i o n s \ L i s t ] " C : \ G a m e s \ p e s 2 0 0 8 \ P E S 2 0 0 8 . e x e " = C : \ G a m e s \ p e s 2 0 0 8 \ P E S 2 0 0 8 . e x e : * : E n a b l e d : P r o E v o l u t i o n S o c c e r 2 0 0 8 - - ( K O N A M I ) " C : \ P r o g r a m m e \ P i n n a c l e \ S h a r e d F i l e s \ P r o g r a m s \ S t r m S e r v e r \ S t r m S e r v e r . e x e " = C : \ P r o g r a m m e \ P i n n a c l e \ S h a r e d F i l e s \ P r o g r a m s \ S t r m S e r v e r \ S t r m S e r v e r . e x e : L o c a l S u b N e t : E n a b l e d : P i n n a c l e S t r e a m i n g S e r v e r - - ( P i n n a c l e S y s t e m s ) " C : \ G a m e s \ W a r h a m m e r 4 0 k \ W 4 0 k . e x e " = C : \ G a m e s \ W a r h a m m e r 4 0 k \ W 4 0 k . e x e : * : E n a b l e d : W 4 0 K - - ( R e l i c E n t e r t a i n m e n t I n c . ) " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O U T L O O K . E X E " = C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O U T L O O K . E X E : * : E n a b l e d : M i c r o s o f t O f f i c e O u t l o o k - - ( M i c r o s o f t C o r p o r a t i o n ) " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ G R O O V E . E X E " = C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ G R O O V E . E X E : * : E n a b l e d : M i c r o s o f t O f f i c e G r o o v e - - ( M i c r o s o f t C o r p o r a t i o n ) " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O N E N O T E . E X E " = C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O N E N O T E . E X E : * : E n a b l e d : M i c r o s o f t O f f i c e O n e N o t e - - ( M i c r o s o f t C o r p o r a t i o n ) " C : \ P r o g r a m m e \ K O N A M I \ P r o E v o l u t i o n S o c c e r 2 0 0 9 \ p e s 2 0 0 9 . e x e " = C : \ P r o g r a m m e \ K O N A M I \ P r o E v o l u t i o n S o c c e r 2 0 0 9 \ p e s 2 0 0 9 . e x e : * : E n a b l e d : P r o E v o l u t i o n S o c c e r 2 0 0 9 - - ( K o n a m i D i g i t a l E n t e r t a i n m e n t C o . , L t d . ) " C : \ G a m e s \ C S S o u r c e \ h l 2 . e x e " = C : \ G a m e s \ C S S o u r c e \ h l 2 . e x e : * : E n a b l e d : h l 2 - - ( ) " C : \ G a m e s \ R a d s p o r t m a n a g e r P r o 2 0 0 5 - 2 0 0 6 \ C y m 2 0 0 5 . e x e " = C : \ G a m e s \ R a d s p o r t m a n a g e r P r o 2 0 0 5 - 2 0 0 6 \ C y m 2 0 0 5 . e x e : * : E n a b l e d : C y m 2 0 0 5 - - F i l e n o t f o u n d " C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X . e x e " = C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X . e x e : * : E n a b l e d : T o m _ C l a n c y ' s _ H . A . W . X _ 1 - - F i l e n o t f o u n d " C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X _ d x 1 0 . e x e " = C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X _ d x 1 0 . e x e : * : E n a b l e d : T o m _ C l a n c y ' s _ H . A . W . X _ 2 - - F i l e n o t f o u n d " C : \ P r o g r a m m e \ E l e c t r o n i c A r t s \ E A D M \ C o r e . e x e " = C : \ P r o g r a m m e \ E l e c t r o n i c A r t s \ E A D M \ C o r e . e x e : * : E n a b l e d : E A D o w n l o a d M a n a g e r - - ( E l e c t r o n i c A r t s ) " C : \ G a m e s \ P e s 2 0 1 0 \ p e s 2 0 1 0 . e x e " = C : \ G a m e s \ P e s 2 0 1 0 \ p e s 2 0 1 0 . e x e : * : E n a b l e d : P r o E v o l u t i o n S o c c e r 2 0 1 0 - - F i l e n o t f o u n d " C : \ P r o g r a m m e 2 \ i t u n e s \ i T u n e s . e x e " = C : \ P r o g r a m m e 2 \ i t u n e s \ i T u n e s . e x e : * : E n a b l e d : i T u n e s - - ( A p p l e I n c . ) " C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e " = C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e : * : E n a b l e d : W i n d o w s L i v e C a l l - - ( M i c r o s o f t C o r p o r a t i o n ) " C : \ P r o g r a m m e 2 \ L o g i t e c h T o u c h M o u s e S e r v e r \ i T o u c h - S e r v e r - W i n . e x e " = C : \ P r o g r a m m e 2 \ L o g i t e c h T o u c h M o u s e S e r v e r \ i T o u c h - S e r v e r - W i n . e x e : * : E n a b l e d : L o g i t e c h - - ( L o g i t e c h , I n c . ) " C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . e x e " = C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . e x e : * : E n a b l e d : R a y V - - F i l e n o t f o u n d " C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . d l l " = C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . d l l : * : E n a b l e d : R a y V - - F i l e n o t f o u n d [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = H K E Y _ L O C A L _ M A C H I N E U n i n s t a l l L i s t = = = = = = = = = = [ / c o l o r ] [ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ U n i n s t a l l ] " { 0 0 2 D 9 D 5 E - 2 9 B A - 3 E 6 D - 9 B C 4 - 3 D 7 D 6 D B C 7 3 5 C } " = M i c r o s o f t V i s u a l C + + 2 0 0 8 A T L U p d a t e k b 9 7 3 9 2 4 - x 8 6 9 . 0 . 3 0 7 2 9 . 4 1 4 8 " { 0 0 4 F 0 4 0 7 - 7 8 E 1 - 1 1 D 2 - B 6 0 F - 0 0 6 0 9 7 C 9 9 8 E 7 } " = M i c r o s o f t A c c e s s 2 0 0 0 S R - 1 R u n t i m e " { 0 2 E B D B B 9 - 4 6 0 0 - 4 1 D 3 - B 5 6 6 - 4 0 C B 8 6 1 5 1 1 D 2 } " = W o r l d o f W a r c r a f t F R E E T r i a l " { 0 4 4 4 0 0 4 4 - 9 1 4 9 - 4 5 C 6 - A 8 0 6 - F 2 B F 9 C F C E 7 6 2 } " = M i c r o s o f t E n c a r t a E n z y k l o p ä d i e 2 0 0 4 " { 0 5 5 E E 5 9 D - 2 1 7 B - 4 3 A 7 - A B F F - 5 0 7 B 9 6 6 4 0 5 D 8 } " = A T I C a t a l y s t C o n t r o l C e n t e r " { 0 6 F 8 0 0 1 7 - 8 F 9 8 - 4 C 9 4 - B 8 6 8 - 5 2 3 5 8 5 6 9 F C 3 2 } " = C o m m a n d & C o n q u e r G e n e r a l s " { 0 7 2 8 7 1 2 3 - B 8 A C - 4 1 C E - 8 3 4 6 - 3 D 7 7 7 2 4 5 C 3 5 B } " = B o n j o u r " { 0 9 9 6 C 3 3 1 - 6 D C B - 4 E 3 8 - A 3 E C - 0 A 7 7 A B A E 1 3 6 1 } " = H e l p _ C T R " { 0 B E D B D 4 E - 2 D 3 4 - 4 7 B 5 - 9 9 7 3 - 5 7 E 6 2 B 2 9 3 0 7 C } " = A T I C o n t r o l P a n e l " { 1 C E 5 9 6 5 6 - 4 1 0 4 - 4 4 A A - 0 0 B F - D 2 5 4 6 C 7 E A 4 9 7 } " = T i g e r W o o d s P G A T O U R 0 6 " { 1 E 0 2 4 0 3 C - C 4 6 9 - 4 9 3 7 - 9 B 9 4 - 7 D F 9 F 7 8 8 8 8 F A } " = S m a r t M a n a g e r " { 2 0 5 C 6 B D D - 7 B 7 3 - 4 2 D E - 8 5 0 5 - 9 A 0 9 3 F 3 5 A 2 3 8 } " = W i n d o w s L i v e - U p l o a d t o o l " { 2 1 D 3 9 3 D 7 - 6 7 1 1 - 4 6 7 0 - A 7 B A - 3 B 4 C 7 2 D 1 6 8 2 0 } " = T r e k S t o r i . B e a t c e b r a x " { 2 2 B 7 7 5 E 7 - 6 C 4 2 - 4 F C 5 - 8 E 1 0 - 9 A 5 E 3 2 5 7 B D 9 4 } " = M S V C R T " { 2 6 3 7 C 3 4 7 - 9 D A D - 1 1 D 6 - 9 E A 2 - 0 0 0 5 5 D 0 C A 7 6 1 } " = P o w e r C i n e m a 2 . 5 " { 2 8 3 F F B 2 3 - 8 7 5 1 - 4 B 0 8 - A C B 8 - 5 E 0 F 8 B C F 7 7 2 7 } " = P r o E v o l u t i o n S o c c e r 2 0 1 0 " { 2 A 9 7 D 5 B 3 - A 9 8 9 - 4 7 E 1 - B 2 0 7 - 1 C A 9 E 3 6 3 5 6 5 5 } " = a i o p r n t " { 2 F D F D 6 0 0 - 7 3 3 8 - 4 7 3 8 - 9 0 D 5 - F C 4 A C A 0 8 D C 3 6 } " = P r o E v o l u t i o n S o c c e r 2 0 0 8 " { 3 0 C 1 0 E E 3 - E F B 3 - 4 B 7 A - 9 C D C - 5 0 7 9 0 C 2 B 5 2 0 0 } " = C A L i c e n s i n g " { 3 1 D A B A 2 0 - 1 0 A 1 - 4 7 4 6 - 9 D 9 F - 5 7 9 5 5 B 8 D F F 6 6 } " = F r e e G a m e s O f f e r , D e s k t o p S h o r t c u t " { 3 5 0 C 9 7 B 3 - 3 D 7 C - 4 E E 8 - B A A 9 - 0 0 B C B 3 D 5 4 2 2 7 } " = W e b F l d r s X P " { 3 6 2 D 5 1 6 7 - 9 7 1 6 - 4 4 B E - 8 9 F D - B F 9 E B 6 E F 8 1 4 B } " = D a w n O f W a r " { 3 B E D 0 2 3 8 - 3 A 2 5 - 4 1 A E - B C 2 3 - 3 1 6 9 1 4 B 5 B 0 4 8 } " = a i o o c r " { 3 D 1 A 6 B 7 0 - 3 E 0 2 - 4 9 B C - 8 8 B 0 - 9 1 6 C 8 0 2 7 4 6 3 2 } " = I n f o r m a t i o n e n ü b e r I h r e n P C " { 3 D E D 3 A 7 2 - 6 1 A 8 - 4 B 8 7 - 9 8 A 5 - E F 0 B C 8 0 3 8 A A 0 } " = D A E M O N T o o l s " { 4 1 E 6 5 4 A 9 - 2 6 D 0 - 4 E A C - 8 5 4 B - 0 F A 8 2 4 F F F A B B } " = W i n d o w s L i v e M e s s e n g e r " { 4 3 2 4 B C 9 3 - C 8 2 F - E D 1 6 - B A 8 6 - 5 E 3 4 B 9 E 0 5 3 0 3 } " = c c c - c o r e - s t a t i c " { 4 3 D C F 7 6 6 - 6 8 3 8 - 4 F 9 A - 8 C 9 1 - D 9 2 D A 5 8 6 D F A 7 } " = M i c r o s o f t W i n d o w s - J o u r n a l - V i e w e r " { 4 5 3 7 E A 4 B - F 6 0 3 - 4 1 8 1 - 8 9 F B - 2 9 5 3 F C 6 9 5 A B 1 } " = n e t b r d g " { 4 5 E B D A 5 9 - D 3 3 B - 4 3 3 A - 9 5 6 E - B 2 F 2 3 6 4 6 8 B 5 6 } " = M U S I C M A T C H ( R ) J u k e b o x " { 4 E A D 2 E 2 1 - 1 D 4 A - 4 E 2 B - A 0 8 2 - 8 D 0 8 9 6 1 5 3 9 C 9 } " = M i c r o s o f t W o r k s S u i t e - A d d - I n s f ü r M i c r o s o f t W o r d " { 4 E D 1 1 8 E E - 7 8 5 C - C C 1 8 - 5 D 2 E - D 5 C A 4 B A A 0 3 F 0 } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s F u l l N e w " { 5 1 5 E 1 B 0 0 - E 2 B 4 - 4 9 7 5 - 9 9 0 0 - 9 5 F 6 6 0 7 7 C 3 A E } " = e T r u s t A n t i v i r u s R e g i s t r a t i o n " { 5 2 B 9 7 2 1 8 - 9 8 C B - 4 B 8 B - 9 2 8 3 - D 2 1 3 C 8 5 E 1 A A 4 } " = W i n d o w s L i v e A n m e l d e - A s s i s t e n t " { 5 3 9 4 7 5 B 7 - 4 4 B 7 - 8 B 0 A - 1 3 4 C - F 0 1 B 9 C 8 B 7 5 6 9 } " = c c c - c o r e - p r e i n s t a l l " { 5 A C 7 A E 5 4 - 5 5 D F - 1 1 2 6 - 0 7 6 C - 6 2 3 F 0 0 8 D 4 0 B 6 } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s F u l l E x i s t i n g " { 5 B 6 8 0 7 5 0 - 7 6 0 B - 4 9 E 4 - 8 1 E 7 - 2 1 B 2 B 3 3 7 F 9 F 7 } " = M i c r o s o f t W o r k s " { 5 F C 6 8 7 7 2 - 6 D 5 6 - 4 1 C 6 - 9 D F 1 - 2 4 E 8 6 8 1 9 8 A E 6 } " = W i n d o w s L i v e C a l l " { 6 3 5 1 D 2 1 7 - 3 E E 3 - 1 9 6 7 - 2 9 B E - 6 A 7 7 6 3 5 F E 4 8 5 } " = S k i n s " { 6 8 1 1 C A A 0 - B F 1 2 - 1 1 D 4 - 9 E A 1 - 0 0 5 0 B A E 3 1 7 E 1 } " = P o w e r D V D " { 6 9 5 6 8 5 6 F - B 6 B 3 - 4 B E 0 - B A 0 B - 8 F 4 9 5 B E 3 2 0 3 3 } " = A p p l e S o f t w a r e U p d a t e " { 6 A B 9 C D 3 A - F 9 1 F - 2 3 3 B - 9 2 3 B - 6 C 5 9 B A 6 3 5 2 4 D } " = C a t a l y s t C o n t r o l C e n t e r H y d r a V i s i o n F u l l " { 7 1 6 E 0 3 0 6 - 8 3 1 8 - 4 3 6 4 - 8 B 8 F - 0 C C 4 E 9 3 7 6 B A C } " = M S X M L 4 . 0 S P 2 P a r s e r a n d S D K " { 7 2 9 9 0 5 2 b - 0 2 a 4 - 4 6 2 7 - 8 1 f 2 - 1 8 1 8 d a 5 d 5 5 0 d } " = M i c r o s o f t V i s u a l C + + 2 0 0 5 R e d i s t r i b u t a b l e " { 7 3 F 1 6 8 1 F - A D E 1 - 4 6 1 F - 9 F 1 8 - B 7 6 4 0 5 0 7 D 3 9 5 } " = k s d i p " { 7 6 E F F C 7 C - 1 7 A 6 - 4 7 9 D - 9 E 4 7 - 8 E 6 5 8 C 1 6 9 5 A E } " = W i n d o w s - S i c h e r u n g s p r o g r a m m " { 7 7 0 6 5 7 D 0 - A 1 2 3 - 3 C 0 7 - 8 E 4 4 - 1 C 8 3 E C 8 9 5 1 1 8 } " = M i c r o s o f t V i s u a l C + + 2 0 0 5 A T L U p d a t e k b 9 7 3 9 2 3 - x 8 6 8 . 0 . 5 0 7 2 7 . 4 0 5 3 " { 7 9 1 E 3 D 4 4 - 3 3 D 3 - 4 4 4 6 - 8 2 A D - 5 C D 4 B 0 1 6 9 0 8 3 } " = a i o f w " { 7 9 E 4 1 D 9 1 - B A 1 C - 4 4 B 9 - 9 3 5 8 - 4 8 E 5 9 8 2 6 3 E C F } " = c e n t e r " { 7 B 3 F 0 1 1 3 - E 6 3 C - 4 D 6 D - A F 1 9 - 1 1 1 A 3 1 6 5 C C A 2 } " = T e x t - T o - S p e e c h - R u n t i m e " { 7 B 6 3 B 2 9 2 2 B 1 7 4 1 3 5 A F C 0 E 1 3 7 7 D D 8 1 E C 2 } " = D i v X C o d e c " { 7 C 7 A C 2 D 4 - 1 0 7 7 - 4 5 C 8 - 8 2 6 A - 1 6 4 4 5 B 5 E 0 D B 7 } " = P i n n a c l e D i s t a n T V S e r v e r " { 8 4 3 0 8 1 B D - 3 5 1 F - 4 6 F C - 8 A 1 7 - 5 1 7 A 0 D 9 1 1 7 A 3 } " = h e l p t u t " { 8 5 A 9 1 C 2 2 - C 3 6 9 - F C F B - 5 F 1 F - D 5 9 E B 2 1 A D 0 E 1 } " = C C C H e l p E n g l i s h " { 8 6 D 4 B 8 2 A - A B E D - 4 4 2 A - B E 8 6 - 9 6 3 5 7 B 7 0 F 4 F E } " = A s k T o o l b a r " { 8 7 9 5 C B E D - 5 5 E 2 - 4 6 9 3 - 9 F 1 4 - 8 4 E C 4 4 6 9 3 5 B E } " = S p e e c h R e d i s t " { 9 0 1 2 0 0 0 0 - 0 0 1 0 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t S o f t w a r e U p d a t e f o r W e b F o l d e r s ( G e r m a n ) 1 2 " { 9 0 1 2 0 0 0 0 - 0 0 1 5 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e A c c e s s M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 5 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 6 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e E x c e l M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 6 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 8 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P o w e r P o i n t M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 8 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 9 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P u b l i s h e r M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 9 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e O u t l o o k M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 B - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e W o r d M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 B - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { A 0 5 1 6 4 1 5 - E D 6 1 - 4 1 9 A - 9 8 1 D - 9 3 5 9 6 D A 7 4 1 6 5 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 9 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( E n g l i s h ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 9 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { A B D D E 9 7 2 - 3 5 5 B - 4 A F 1 - 8 9 A 8 - D A 5 0 B 7 B 5 C 0 4 5 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 C - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( F r e n c h ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 C - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { F 5 8 0 D D D 5 - 8 D 3 7 - 4 9 9 8 - 9 6 8 E - E B B 7 6 B B 8 6 7 8 7 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 1 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( I t a l i a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 1 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 3 2 2 2 9 6 D 4 - 1 E A E - 4 0 3 0 - 9 F B C - D 2 7 8 7 E B 2 5 F A 2 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 2 C - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f i n g ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 3 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e E n t e r p r i s e 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 3 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 0 B 3 6 C 6 D 6 - F 5 D 8 - 4 E A F - B F 9 4 - 4 3 7 6 A 2 3 0 A D 5 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 3 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 3 D 0 1 9 5 9 8 - 7 B 5 9 - 4 4 7 A - 8 0 A E - 8 1 5 B 7 0 3 B 8 4 F F } " = S e c u r i t y U p d a t e f o r M i c r o s o f t O f f i c e s y s t e m 2 0 0 7 ( 9 7 2 5 8 1 ) " { 9 0 1 2 0 0 0 0 - 0 0 4 4 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e I n f o P a t h M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 4 4 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 6 E - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e S h a r e d M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 6 E - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 2 6 4 5 4 C 2 6 - D 2 5 9 - 4 5 4 3 - A A 6 0 - 3 1 8 9 E 0 9 C 5 F 7 6 } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 A 1 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e O n e N o t e M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 A 1 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 0 1 2 0 0 0 0 - 0 0 B A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e G r o o v e M U I ( G e r m a n ) 2 0 0 7 " { 9 0 1 2 0 0 0 0 - 0 0 B A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 ) " { 9 5 1 2 0 0 0 0 - 0 0 B 9 - 0 4 0 9 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t A p p l i c a t i o n E r r o r R e p o r t i n g " { 9 6 6 5 B 3 2 5 - 3 F 9 6 - 1 1 D 6 - A 1 F A - 0 0 0 3 7 4 8 9 0 9 3 2 } " = T u n e U p U t i l i t i e s 2 0 0 3 " { 9 9 E C F 4 1 F - 5 C C A - 4 2 B D - B 8 B 8 - A 8 3 3 3 E 2 E 2 9 4 4 } " = i T u n e s " { 9 A 2 5 3 0 2 D - 3 0 C 0 - 3 9 D 9 - B D 6 F - 2 1 E 6 E C 1 6 0 4 7 5 } " = M i c r o s o f t V i s u a l C + + 2 0 0 8 R e d i s t r i b u t a b l e - x 8 6 9 . 0 . 3 0 7 2 9 . 1 7 " { A 1 F 6 6 F C 9 - 1 1 E E - 4 F 2 F - 9 8 C 9 - 1 6 F 8 D 1 E 6 9 F B 7 } " = S e g o e U I " { A 3 0 5 1 C D 0 - 2 F 6 4 - 3 8 1 3 - A 8 8 D - B 8 D C C D E 8 F 8 C 7 } " = M i c r o s o f t . N E T F r a m e w o r k 3 . 0 S e r v i c e P a c k 2 " { A 4 9 F 2 4 9 F - 0 C 9 1 - 4 9 7 F - 8 6 D F - B 2 5 8 5 E 8 E 7 6 B 7 } " = M i c r o s o f t V i s u a l C + + 2 0 0 5 R e d i s t r i b u t a b l e " { A 6 D 0 1 4 0 F - E 6 2 F - 9 D 1 E - 2 4 0 8 - 9 C F F 9 1 F F 6 F C 8 } " = c c c - u t i l i t y " { A 8 D B 6 1 1 A - D 8 0 E - 4 5 0 D - 8 5 F 6 - 3 A C D D 1 6 4 B E 3 1 } " = P r o E v o l u t i o n S o c c e r 2 0 0 9 " { A C 7 6 B A 8 6 - 7 A D 7 - 1 0 3 1 - 7 6 4 6 - 0 0 0 0 0 0 0 0 0 0 0 1 } " = A d o b e R e a d e r 6 . 0 - D e u t s c h " { B 4 1 F 5 E D 6 - 4 D 6 7 - 4 F A A - B 7 8 7 - D 5 D F 1 D D 0 E C 8 0 } " = R E A L T E K R T L 8 1 8 5 W i r e l e s s L A N D r i v e r a n d U t i l i t y " { B 7 A 0 C E 0 6 - 0 6 8 E - 1 1 D 6 - 9 7 F D - 0 0 5 0 B A C B F 8 6 1 } " = P o w e r P r o d u c e r " { C 0 2 5 1 5 8 5 - 1 B E 8 - 4 2 7 8 - B 3 C B - 9 6 4 B 6 E 0 1 C 5 9 D } " = a i o s c n n r " { C 0 9 F B 3 C D - 3 D 0 C - 3 F 2 D - 8 9 9 A - 6 A 1 D 6 7 F 2 0 7 3 F } " = M i c r o s o f t . N E T F r a m e w o r k 2 . 0 S e r v i c e P a c k 2 " { C 3 3 7 B D A F - C B 4 E - 4 7 E 2 - B E 1 A - C B 3 1 B B 7 D D 0 E 3 } " = A p p l e M o b i l e D e v i c e S u p p o r t " { C 3 9 E 6 5 F 4 - 2 4 E F - 4 D C 5 - 9 F F 4 - F 9 1 F E 3 3 2 C 3 7 E } " = v i d e o n " { C 4 4 A 7 4 2 2 - E 3 8 0 - 4 4 B E - 7 9 F E - 1 C 0 3 2 D 8 A 0 3 A 7 } " = C a t a l y s t C o n t r o l C e n t e r C o r e I m p l e m e n t a t i o n " { C 7 3 4 0 5 7 1 - 7 7 7 3 - 4 A 8 C - 9 E B C - 4 E 4 2 4 3 B 3 8 C 7 6 } " = M i c r o s o f t X M L P a r s e r " { C 7 8 E A C 6 F - 7 A 7 3 - 4 5 2 E - 8 1 3 4 - D B B 2 1 6 5 C 5 A 6 8 } " = Q u i c k T i m e " { C B 0 9 9 8 9 0 - 1 D 5 F - 1 1 D 5 - 9 E A 9 - 0 0 5 0 B A E 3 1 7 E 1 } " = P o w e r D i r e c t o r " { C B 2 F 7 E D D - 9 D 1 F - 4 3 C 1 - 9 0 F C - 4 F 5 2 E A E 1 7 2 A 1 } " = M i c r o s o f t . N E T F r a m e w o r k 1 . 1 " { C D 8 1 5 6 0 3 - A B 7 1 - 4 C F B - B 3 A C - 5 2 2 2 9 8 0 3 7 A C C } " = W 8 3 L 5 1 8 D " { C E 2 C D D 6 2 - 0 1 2 4 - 3 6 C A - 8 4 D 3 - 9 F 4 D C F 5 C 5 B D 9 } " = M i c r o s o f t . N E T F r a m e w o r k 3 . 5 S P 1 " { C E B B 6 B F B - D 7 0 8 - 4 F 9 9 - A 6 3 3 - B C 2 6 0 0 E 0 1 E F 6 } " = B l u e t o o t h S t a c k f o r W i n d o w s b y S i t e c o m E u r o p e " { D 1 9 5 5 A 3 A - E A 2 4 - 4 6 8 2 - 8 6 4 1 - 4 3 B 5 B 6 8 8 B 0 9 A } " = U S B W i r e l e s s K e y b o a r d D r i v e r " { D 3 2 4 7 0 A 1 - B 1 0 C - 4 0 5 9 - B A 5 3 - C F 0 4 8 6 F 6 8 E B C } " = K O D A K A l l - i n - O n e - D r u c k e r s o f t w a r e " { D 3 B 1 C 7 9 9 - C B 7 3 - 4 2 D E - B A 0 F - 2 3 4 4 7 9 3 A 0 9 5 C } " = C a t a l y s t C o n t r o l C e n t e r - B r a n d i n g " { D B 0 2 F 7 1 6 - 6 2 7 5 - 4 2 E 9 - B 8 D 2 - 8 3 B A 2 B F 5 1 0 0 B } " = S F R " { D B A 8 B 9 E 1 - C 6 F F - 4 6 2 4 - 9 5 9 8 - 7 3 D 3 B 4 1 A 0 9 0 3 } " = M i c r o s o f t P i c t u r e I t ! F o t o P r e m i u m 9 " { D C 6 2 6 A 2 1 - E D F 1 - 4 0 C 7 - 8 F 2 F - D 2 B A 7 5 3 5 5 2 9 F } " = h e l p u g " { E 2 6 D E D C 7 - 1 A 9 9 - 4 F 8 C - 9 6 1 5 - 6 D B 1 1 2 E 6 4 9 5 B } _ i s 1 " = T e x a s H o l d ' e m P o k e r 3 D - D e l u x e E d i t i o n 1 . 0 " { E 2 A 0 7 5 3 4 - B 6 6 D - 4 F F 6 - B A 5 9 - E F 0 C B 9 C 4 2 1 1 1 } " = 8 0 2 . 1 1 G U t i l i t y " { E 5 D 2 4 9 2 9 - 9 1 A 4 - B 0 A 1 - D E 0 0 - A F C 4 5 3 9 2 1 E F 7 } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s L i g h t " { E 6 C 0 9 B F B - B A 7 5 - 1 5 C 7 - 5 B 1 8 - A 2 C E 3 1 C 4 F 4 2 B } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s P r e v i e w s C o m m o n " { E 7 8 B F A 6 0 - 5 3 9 3 - 4 C 3 8 - 8 2 A B - E 8 0 1 9 E 4 6 4 E B 4 } " = M i c r o s o f t . N E T F r a m e w o r k 1 . 1 G e r m a n L a n g u a g e P a c k " { E A 1 C B 7 A C - E 2 2 1 - 4 8 2 2 - A 7 8 9 - 0 A D B 0 5 1 D C 4 9 8 } " = M e d i o n F l a s h X L 2 . 0 " { E B B 7 9 4 E D - D 2 8 2 - 4 3 3 4 - 9 2 F B - 2 5 4 4 8 1 E F F 5 1 4 } " = P r o E v o l u t i o n S o c c e r 6 " { E D 0 0 D 0 8 A - 3 C 5 F - 4 8 8 D - 9 3 A 0 - A 0 4 F 2 1 F 2 3 9 5 6 } " = W i n d o w s L i v e C o m m u n i c a t i o n s P l a t f o r m " { E F 7 E 9 3 1 D - D C 8 4 - 4 7 1 B - 8 D B 6 - A 8 3 3 5 8 0 9 5 4 7 4 } " = E A D o w n l o a d M a n a g e r " { E F B 2 1 D E 7 - 8 C 1 9 - 4 A 8 8 - B B 2 8 - A 7 6 6 E 1 6 4 9 3 B C } " = A d o b e P h o t o s h o p C S " { F 0 E 1 2 B B A - A D 6 6 - 4 0 2 2 - A 4 5 3 - A 1 C 8 A 0 C 4 D 5 7 0 } " = M i c r o s o f t C h o i c e G u a r d " { F 3 8 A D C A 4 - A F 7 C - 4 C 7 3 - 9 0 2 1 - 6 F 1 E A 1 5 D 1 5 E A } " = P i n n a c l e T V C e n t e r P r o " { F 6 5 6 D C 7 9 - 0 1 3 A - 4 6 8 3 - 8 6 9 2 - B 9 3 8 F C 0 0 B 9 4 1 } " = D k Z S t u d i o " { F 8 F F 1 8 E E - 2 6 4 A - 4 3 F D - B 2 F 6 - 5 E A D 4 0 7 9 8 C 2 F } " = W i n d o w s L i v e E s s e n t i a l s " { F C E 6 5 C 4 E - B 0 E 8 - 4 F B D - A D 1 6 - E D C B E 6 C D 5 9 1 F } " = H i g h M A T - E r w e i t e r u n g f ü r d e n M i c r o s o f t W i n d o w s X P - A s s i s t e n t e n z u m S c h r e i b e n v o n C D s " 3 D R o u l e t t e " = 3 D R o u l e t t e 1 . 0 " 7 - Z i p " = 7 - Z i p 4 . 6 5 " A d o b e A c r o b a t 5 . 0 " = A d o b e A c r o b a t 5 . 0 " A d o b e F l a s h P l a y e r A c t i v e X " = A d o b e F l a s h P l a y e r 1 0 A c t i v e X " A d o b e F l a s h P l a y e r P l u g i n " = A d o b e F l a s h P l a y e r 1 0 P l u g i n " A d o b e S h o c k w a v e P l a y e r " = A d o b e S h o c k w a v e P l a y e r " A l l A T I S o f t w a r e " = A T I - S o f t w a r e U n i n s t a l l U t i l i t y " A m e r i c a O n l i n e d e " = A O L D e u t s c h l a n d " A n t i - B l a x x _ i s 1 " = A n t i - B l a x x 1 . 1 7 " A n y V i d e o C o n v e r t e r _ i s 1 " = A n y V i d e o C o n v e r t e r 2 . 7 . 5 " A S A P I U p d a t e " = A S A P I U p d a t e " A T I D i s p l a y D r i v e r " = A T I D i s p l a y D r i v e r " A v i r a A n t i V i r D e s k t o p " = A v i r a A n t i V i r P e r s o n a l - F r e e A n t i v i r u s " C - M e d i a A u d i o " = C - M e d i a 3 D A u d i o " C o o l E d i t P r o 2 . 0 " = C o o l E d i t P r o 2 . 0 " D e r i v e 5 " = D e r i v e 5 " D L B P r o g _ i s 1 " = D L B P r o g 2 0 0 8 . 3 a " D u n g e o n S i e g e 1 . 0 " = D u n g e o n S i e g e " E N T E R P R I S E " = M i c r o s o f t O f f i c e E n t e r p r i s e 2 0 0 7 " E R U N T _ i s 1 " = E R U N T 1 . 1 j " F i r e b i r d S Q L S e r v e r D " = F i r e b i r d S Q L S e r v e r - M A G I X E d i t i o n 2 . 0 . 0 . 1 ( D ) " F r e e A u d i o C D B u r n e r _ i s 1 " = F r e e A u d i o C D B u r n e r v e r s i o n 1 . 2 " F r e e V i d e o D u b _ i s 1 " = F r e e V i d e o D u b v e r s i o n 1 . 5 " F r e e Y o u T u b e t o M P 3 C o n v e r t e r _ i s 1 " = F r e e Y o u T u b e t o M P 3 C o n v e r t e r v e r s i o n 3 . 2 " F S X _ S c r e e n s a v e r " = F S X _ S c r e e n s a v e r " G a a M o a ' s P l u g i n s f o r C o o l E d i t P r o " = G a a M o a ' s P l u g i n s f o r C o o l E d i t P r o " G a m e C e n t e r " = G a m e C e n t e r " G E L B E S E I T E N _ H A M B U R G _ 2 0 0 8 " = G e l b e S e i t e n f ü r H a m b u r g u n d U m g e b u n g 2 0 0 8 " G o l d W a v e v 5 . 2 0 " = G o l d W a v e v 5 . 2 0 " H i j a c k T h i s " = H i j a c k T h i s 2 . 0 . 2 " H i t m a n 2 : S i l e n t A s s a s s i n " = H i t m a n 2 : S i l e n t A s s a s s i n " I n d e o ® s o f t w a r e " = I n d e o ® s o f t w a r e " I n s t a l l S h i e l d _ { 0 6 F 8 0 0 1 7 - 8 F 9 8 - 4 C 9 4 - B 8 6 8 - 5 2 3 5 8 5 6 9 F C 3 2 } " = C o m m a n d & C o n q u e r G e n e r a l s " I n s t a l l S h i e l d _ { 2 F D F D 6 0 0 - 7 3 3 8 - 4 7 3 8 - 9 0 D 5 - F C 4 A C A 0 8 D C 3 6 } " = P r o E v o l u t i o n S o c c e r 2 0 0 8 " I n s t a l l S h i e l d _ { 3 6 2 D 5 1 6 7 - 9 7 1 6 - 4 4 B E - 8 9 F D - B F 9 E B 6 E F 8 1 4 B } " = D a w n O f W a r " I n s t a l l S h i e l d _ { E B B 7 9 4 E D - D 2 8 2 - 4 3 3 4 - 9 2 F B - 2 5 4 4 8 1 E F F 5 1 4 } " = P r o E v o l u t i o n S o c c e r 6 " I n s t a l l S h i e l d _ { E F 7 E 9 3 1 D - D C 8 4 - 4 7 1 B - 8 D B 6 - A 8 3 3 5 8 0 9 5 4 7 4 } " = E A D o w n l o a d M a n a g e r " L o g i t e c h T o u c h M o u s e S e r v e r " = L o g i t e c h T o u c h M o u s e S e r v e r 1 . 0 " M A G I X M u s i c M a k e r T e c h n o E d i t i o n 2 D " = M A G I X M u s i c M a k e r T e c h n o E d i t i o n 2 4 . 0 . 0 . 1 0 ( D ) " M a l w a r e b y t e s ' A n t i - M a l w a r e _ i s 1 " = M a l w a r e b y t e s ' A n t i - M a l w a r e " M c A f e e S e c u r i t y S c a n " = M c A f e e S e c u r i t y S c a n P l u s " M e d i a S h o w " = M e d i @ S h o w " M i c r o s o f t . N E T F r a m e w o r k 1 . 1 ( 1 0 3 3 ) " = M i c r o s o f t . N E T F r a m e w o r k 1 . 1 " M i c r o s o f t . N E T F r a m e w o r k 3 . 5 S P 1 " = M i c r o s o f t . N E T F r a m e w o r k 3 . 5 S P 1 " M o z i l l a F i r e f o x ( 3 . 6 . 3 ) " = M o z i l l a F i r e f o x ( 3 . 6 . 3 ) " M o z i l l a T h u n d e r b i r d ( 3 . 0 . 5 ) " = M o z i l l a T h u n d e r b i r d ( 3 . 0 . 5 ) " M S C o m p P a c k V 1 " = M i c r o s o f t C o m p r e s s i o n C l i e n t P a c k 1 . 0 f o r W i n d o w s X P " N e r o - B u r n i n g R o m ! U n i n s t a l l K e y " = N e r o O E M " N e r o V i s i o n ! U n i n s t a l l K e y " = N e r o V i s i o n E x p r e s s 2 " N M P U n i n s t a l l K e y " = N e r o M e d i a P l a y e r " P i c t u r e I t _ v 9 " = M i c r o s o f t P i c t u r e I t ! F o t o P r e m i u m 9 " P S P M a x M e d i a M a n a g e r _ i s 1 " = P S P M a x M e d i a M a n a g e r " P S P V i d e o C o n v e r t e r 3 " = P S P V i d e o C o n v e r t e r 3 " R e a l P l a y e r 6 . 0 " = R e a l O n e P l a y e r " R e a s o n 4 _ i s 1 " = R e a s o n 4 . 0 " R i g h t d o w n S o f t w a r e R i g h t d o w n S o f t w a r e S e a r c h B a r " = R i g h t d o w n S o f t w a r e - T o o l b a r " R o l l e r C o a s t e r T y c o o n S e t u p " = R o l l " S a m s u n g M o b i l e U S B M o d e m " = S a m s u n g M o b i l e U S B M o d e m S o f t w a r e " S h o c k w a v e " = S h o c k w a v e " S t e i n b e r g W a v e L a b 5 . 0 0 a " = S t e i n b e r g W a v e L a b 5 . 0 0 a " T B a s s 4 . e x e " = F i e l d & S t r e a m ® T r o p h y B a s s 4 " T o t a l A n n i h i l a t i o n : K i n g d o m s " = T o t a l A n n i h i l a t i o n : K i n g d o m s " U n i n s t a l l _ i s 1 " = U n i n s t a l l 1 . 0 . 0 . 1 " U n r e a l T o u r n a m e n t " = U n r e a l T o u r n a m e n t " V i e w p o i n t M e d i a P l a y e r " = V i e w p o i n t M e d i a P l a y e r " W I C " = W i n d o w s I m a g i n g C o m p o n e n t " W i n a m p " = W i n a m p " W i n d o w s M e d i a F o r m a t R u n t i m e " = W i n d o w s M e d i a F o r m a t 1 1 r u n t i m e " W i n d o w s M e d i a P l a y e r " = W i n d o w s M e d i a P l a y e r 1 1 " W i n d o w s X P S e r v i c e P a c k " = W i n d o w s X P S e r v i c e P a c k 3 " W i n L i v e S u i t e _ W a v e 3 " = W i n d o w s L i v e E s s e n t i a l s " W i n R A R a r c h i v e r " = W i n R A R A r c h i v i e r e r " W M F D i s t 1 1 " = W i n d o w s M e d i a F o r m a t 1 1 r u n t i m e " w m p 1 1 " = W i n d o w s M e d i a P l a y e r 1 1 " W u d f 0 1 0 0 0 " = M i c r o s o f t U s e r - M o d e D r i v e r F r a m e w o r k F e a t u r e P a c k 1 . 0 " X 1 0 H a r d w a r e " = X 1 0 H a r d w a r e ( T M ) " X b o x _ 3 6 0 _ C C _ D r i v e r " = X b o x 3 6 0 C o n t r o l l e r f o r W i n d o w s [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = H K E Y _ C U R R E N T _ U S E R U n i n s t a l l L i s t = = = = = = = = = = [ / c o l o r ] [ H K E Y _ C U R R E N T _ U S E R \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ U n i n s t a l l ] " W i n a m p D e t e c t " = W i n a m p D e t e c t o r P l u g - i n [ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = L a s t 1 0 E v e n t L o g E r r o r s = = = = = = = = = = [ / c o l o r ] [ A p p l i c a t i o n E v e n t s ] E r r o r - 2 8 . 0 6 . 2 0 1 0 1 4 : 4 3 : 1 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n H a n g | I D = 1 0 0 2 D e s c r i p t i o n = S t i l l s t e h e n d e A n w e n d u n g w m p l a y e r . e x e , V e r s i o n 1 1 . 0 . 5 7 2 1 . 5 1 4 5 , S t i l l s t a n d m o d u l h u n g a p p , V e r s i o n 0 . 0 . 0 . 0 , S t i l l s t a n d a d r e s s e 0 x 0 0 0 0 0 0 0 0 . E r r o r - 2 8 . 0 6 . 2 0 1 0 1 4 : 4 3 : 2 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n H a n g | I D = 1 0 0 2 D e s c r i p t i o n = S t i l l s t e h e n d e A n w e n d u n g w m p l a y e r . e x e , V e r s i o n 1 1 . 0 . 5 7 2 1 . 5 1 4 5 , S t i l l s t a n d m o d u l h u n g a p p , V e r s i o n 0 . 0 . 0 . 0 , S t i l l s t a n d a d r e s s e 0 x 0 0 0 0 0 0 0 0 . E r r o r - 2 8 . 0 6 . 2 0 1 0 1 4 : 4 6 : 0 8 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n H a n g | I D = 1 0 0 2 D e s c r i p t i o n = S t i l l s t e h e n d e A n w e n d u n g w m p l a y e r . e x e , V e r s i o n 1 1 . 0 . 5 7 2 1 . 5 1 4 5 , S t i l l s t a n d m o d u l h u n g a p p , V e r s i o n 0 . 0 . 0 . 0 , S t i l l s t a n d a d r e s s e 0 x 0 0 0 0 0 0 0 0 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 3 4 : 3 7 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0 D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 3 5 : 1 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0 D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 3 6 : 0 1 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0 D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 4 4 : 1 7 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0 D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 4 7 : 5 4 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0 D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 9 : 0 1 : 4 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0 D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 9 : 0 1 : 4 4 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 1 D e s c r i p t i o n = F e h l e r h a f t e r S p e i c h e r b e r e i c h 1 6 0 8 4 4 5 8 1 3 . [ S y s t e m E v e n t s ] E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 1 4 : 2 5 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " W A N M i n i p o r t ( A T W ) S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 1 4 : 2 5 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " M c A f e e S e c u r i t y S c a n C o m p o n e n t H o s t S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 5 7 : 4 8 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = W i n d o w s U p d a t e A g e n t | I D = 2 0 D e s c r i p t i o n = I n s t a l l a t i o n s f e h l e r : D i e I n s t a l l a t i o n d e s f o l g e n d e n U p d a t e s i s t m i t F e h l e r 0 x 8 0 0 7 0 6 4 3 f e h l g e s c h l a g e n : W i n d o w s I n t e r n e t E x p l o r e r 7 f ü r W i n d o w s X P E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " A t i H o t K e y P o l l e r " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 1 D e s c r i p t i o n = D e r D i e n s t " A p p l e M o b i l e D e v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l v o r g e k o m m e n . F o l g e n d e K o r r e k t u r m a ß n a h m e n w e r d e n i n 6 0 0 0 0 M i l l i s e k u n d e n d u r c h g e f ü h r t : S t a r t e n S i e d e n D i e n s t n e u . . E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " B o n j o u r - D i e n s t " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " M a c h i n e D e b u g M a n a g e r " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " K o d a k A i O D e v i c e S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " E r e i g n i s p r o t o k o l l - Ü b e r w a c h u n g " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 3 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4 D e s c r i p t i o n = D i e n s t " W A N M i n i p o r t ( A T W ) S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t . < E n d o f r e p o r t > bitte um schnelle lösung, mittlerweile untersagt mir sshnas21.dll jegliches öffnen von firefox oder IE, ich bin an einem anderen pc jetzt zum schreiben, vielen dank! |
|
01.07.2010, 12:32
| #14 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft OTL.txt: OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.07.2010 13:11:03 - Run 1 OTL by OldTimer - Version 3.2.7.0 Folder = C:\Dokumente und Einstellungen\Henri\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 93,16 Gb Total Space | 11,60 Gb Free Space | 12,46% Space Free | Partition Type: NTFS Drive D: | 83,38 Gb Total Space | 49,51 Gb Free Space | 59,38% Space Free | Partition Type: NTFS Drive E: | 9,76 Gb Total Space | 5,63 Gb Free Space | 57,74% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive P: | 6,67 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive Q: | 7,47 Gb Total Space | 3,49 Gb Free Space | 46,66% Space Free | Partition Type: FAT32 Computer Name: HENRISPC Current User Name: Henri Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.07.01 12:45:42 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe PRC - [2009.10.23 23:59:56 | 000,228,352 | ---- | M] (Logitech, Inc.) -- C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2009.07.09 13:22:18 | 000,144,712 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2008.07.25 14:34:50 | 000,018,944 | ---- | M] (Eastman Kodak Company) -- C:\Programme2\Kodak\Printer\Center\KodakSvc.exe PRC - [2008.07.18 14:08:34 | 001,306,624 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe PRC - [2008.05.04 16:02:26 | 004,603,904 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\U3\0774100ED89203BB\LaunchPad.exe PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.10.26 13:45:04 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WISPTIS.EXE PRC - [2006.05.22 18:24:02 | 000,675,840 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe PRC - [2004.02.04 09:40:44 | 000,151,597 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe PRC - [2004.01.14 17:09:56 | 000,215,552 | ---- | M] (Intersil Americas Inc.) -- C:\WINDOWS\system32\PRISMSTA.exe PRC - [2003.12.30 00:33:16 | 000,094,208 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\Dit.exe PRC - [2003.12.05 09:49:28 | 000,065,536 | ---- | M] (America Online, Inc.) -- C:\WINDOWS\wanmpsvc.exe PRC - [2002.09.20 17:29:30 | 000,053,248 | ---- | M] (Computer Associates) -- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe PRC - [2001.02.23 11:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe ========== Modules (SafeList) ========== MOD - [2010.07.01 12:45:42 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe MOD - [2008.04.14 08:51:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - [2010.06.26 19:45:27 | 000,205,824 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\sshnas21.dll -- (SSHNAS) SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009.07.09 13:22:18 | 000,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2008.11.04 02:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2008.07.25 14:34:50 | 000,018,944 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Programme2\Kodak\printer\center\KodakSvc.exe -- (KodakSvc) SRV - [2007.11.13 23:22:51 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service) SRV - [2006.12.14 18:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2005.11.17 16:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme2\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.12.05 09:49:28 | 000,065,536 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\WINDOWS\wanmpsvc.exe -- (WANMiniportService) WAN Miniport (ATW) SRV - [2002.09.20 17:41:02 | 000,077,824 | ---- | M] (Computer Associates) [On_Demand | Stopped] -- C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe -- (CA_LIC_SRVR) SRV - [2002.09.20 17:29:30 | 000,053,248 | ---- | M] (Computer Associates) [Auto | Running] -- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe -- (LogWatch) SRV - [2002.09.20 17:27:06 | 000,077,824 | ---- | M] (Computer Associates) [On_Demand | Stopped] -- C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe -- (CA_LIC_CLNT) SRV - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) [On_Demand | Stopped] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets) SRV - [2001.02.23 11:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM) ========== Driver Services (SafeList) ========== DRV - [2010.07.01 12:41:03 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBCRFT.SYS -- (CardReaderFilter) DRV - [2009.11.25 12:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2009.02.26 00:58:57 | 003,565,568 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.04.14 01:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE) DRV - [2007.06.14 15:41:00 | 000,466,048 | ---- | M] (LITEON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P) DRV - [2007.06.13 20:30:20 | 000,013,440 | ---- | M] (LITEON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc) DRV - [2007.05.03 14:37:08 | 000,022,152 | ---- | M] (Maxtor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxopswd.sys -- (MXOPSWD) DRV - [2005.09.13 18:32:00 | 000,034,816 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb) DRV - [2005.08.26 23:10:20 | 000,108,672 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfbd.sys -- (Tosrfbd) DRV - [2005.06.27 19:48:08 | 000,053,504 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfhid.sys -- (Tosrfhid) DRV - [2005.06.27 09:14:35 | 000,066,560 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x) DRV - [2005.05.17 14:48:21 | 000,050,176 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x) DRV - [2005.05.16 15:23:38 | 000,019,968 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x) DRV - [2005.05.16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x) DRV - [2005.04.06 10:54:44 | 000,050,048 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd) Bluetooth Audio Device (WDM) DRV - [2005.03.30 13:42:54 | 000,047,230 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tosporte.sys -- (tosporte) DRV - [2005.01.06 14:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds) DRV - [2004.10.04 11:33:02 | 000,062,799 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom) DRV - [2004.08.22 17:31:48 | 000,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt) DRV - [2004.08.22 17:31:10 | 000,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\d347bus.sys -- (d347bus) DRV - [2004.07.08 18:07:34 | 000,036,531 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (Tosrfbnp) DRV - [2004.02.07 17:03:08 | 000,028,276 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MxlW2k.sys -- (MxlW2k) DRV - [2004.01.16 14:02:58 | 000,017,408 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\x10ufx2.sys -- (XUIF) DRV - [2004.01.16 10:31:56 | 000,380,736 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PRISMA00.sys -- (PRISM_A00) DRV - [2003.12.19 18:13:30 | 000,011,672 | ---- | M] (Chicony) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\UKBFLT.sys -- (UKBFLT) DRV - [2003.12.05 19:46:36 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc) DRV - [2003.12.05 09:34:20 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW) DRV - [2003.06.12 11:47:42 | 000,024,704 | ---- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PhTVTune.sys -- (PhTVTune) DRV - [2003.06.05 11:04:22 | 000,350,752 | ---- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Cap7134.sys -- (Cap7134) MEDION (7134) DRV - [2003.05.22 20:44:44 | 000,670,203 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctxs51.sys -- (Intels51) DRV - [2002.10.16 14:55:48 | 000,002,851 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Toshidpt.sys -- (toshidpt) DRV - [2002.10.02 10:57:12 | 000,013,532 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SjyPkt.sys -- (SjyPkt) DRV - [2002.04.24 13:07:56 | 000,019,928 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbscr.sys -- (wbscr) DRV - [2002.04.17 21:27:02 | 000,011,264 | ---- | M] (VOB Computersysteme GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\asapi.sys -- (Asapi) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Welcome to ALDI IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledItems: langpack-de@firefox.mozilla.org:3.6.818 FF - prefs.js..extensions.enabledItems: {25A1388B-6B18-46c3-BEBA-A81915D0DE8F}:1.7.0.1 FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:0.2.4 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.06 11:41:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.06.26 22:44:48 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.5\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.06.28 18:58:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.5\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2010.03.04 22:38:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Extensions [2010.03.04 22:38:56 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.07.01 01:07:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions [2010.03.21 13:47:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.03.04 21:40:34 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F} [2010.03.24 14:25:56 | 000,000,000 | ---D | M] (Leo Search) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\{c666c018-6409-4479-afa3-68e4129e7eff} [2010.03.04 21:35:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\langpack-de@firefox.mozilla.org [2010.03.24 14:34:11 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\dictcc.xml [2010.03.24 15:37:01 | 000,001,175 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\ebay-deutschland.xml [2010.03.24 14:32:50 | 000,001,748 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\leo-deu-fra.xml [2010.03.24 15:25:08 | 000,001,030 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\wikipedia-de-1.xml [2010.03.24 15:25:09 | 000,001,030 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\wikipedia-de-2.xml [2010.03.24 15:25:05 | 000,001,030 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\wikipedia-de.xml [2010.03.24 14:21:08 | 000,002,057 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\youtube-videosuche.xml [2010.03.04 20:38:35 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.05.25 18:09:48 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll [2010.04.06 11:41:03 | 000,001,538 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazon-en-GB.xml [2010.04.06 11:41:03 | 000,000,947 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\chambers-en-GB.xml [2010.04.06 11:41:03 | 000,000,769 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-en-GB.xml [2010.04.06 11:41:03 | 000,001,135 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-en-GB.xml O1 HOSTS File: ([2002.08.29 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx () O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Cmaudio] C:\WINDOWS\CMICNFG.CPL (C-Media Corporation) O4 - HKLM..\Run: [Dit] C:\WINDOWS\Dit.exe (ICSI Technology Ltd.) O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [Prism_Utility] C:\WINDOWS\System32\PRISMSTA.exe (Intersil Americas Inc.) O4 - HKLM..\Run: [PRISMSTA.EXE] C:\WINDOWS\System32\PRISMSTA.exe (Intersil Americas Inc.) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\RunOnceEx: [] File not found O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\REALTEK RTL8185 Wireless LAN Utility.lnk = C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe (Realtek Semiconductor Corp.) O4 - Startup: C:\Dokumente und Einstellungen\Henri\Startmenü\Programme\Autostart\Logitech Touch Mouse Server.lnk = C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab (Shockwave ActiveX Control) O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine) O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab (RdxIE Class) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38020.7125 (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004.02.03 20:34:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008.05.06 14:26:23 | 000,000,309 | R--- | M] () - P:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{1b19811c-8821-11dd-a3c0-00038a000015}\Shell - "" = AutoRun O33 - MountPoints2\{1b19811c-8821-11dd-a3c0-00038a000015}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1b19811c-8821-11dd-a3c0-00038a000015}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -- File not found O33 - MountPoints2\{652309fe-1d80-11df-96ad-00038a000015}\Shell\AutoRun\command - "" = I:\SamsungSoftware\APPInst.exe -- File not found O33 - MountPoints2\{91a8325e-a136-11de-9564-00038a000015}\Shell - "" = AutoRun O33 - MountPoints2\{91a8325e-a136-11de-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{91a8325e-a136-11de-9564-00038a000015}\Shell\AutoRun\command - "" = P:\LaunchU3.exe -- [2007.10.23 09:45:39 | 001,336,632 | R--- | M] () O33 - MountPoints2\{c1c86512-bd88-11de-95ad-00038a000015}\Shell - "" = AutoRun O33 - MountPoints2\{c1c86512-bd88-11de-95ad-00038a000015}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c1c86512-bd88-11de-95ad-00038a000015}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found O33 - MountPoints2\N\Shell\AutoRun\command - "" = N:\Toshiba\more4you.exe -- File not found O33 - MountPoints2\P\Shell - "" = AutoRun O33 - MountPoints2\P\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\P\Shell\AutoRun\command - "" = P:\LaunchU3.exe -- [2007.10.23 09:45:39 | 001,336,632 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk /r \??\M:) - File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2004.02.03 20:33:47 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: SSHNAS - C:\WINDOWS\system32\sshnas21.dll () CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 90 Days ========== [2010.07.01 12:45:29 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe [2010.07.01 00:21:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010.06.28 14:29:56 | 000,000,000 | ---D | C] -- C:\Avenger [2010.06.28 14:21:25 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip [2010.06.28 12:26:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\MFTools [2010.06.27 03:00:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\TuneUp Software [2010.06.26 22:44:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Winamp [2010.06.26 19:26:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\Meine empfangenen Dateien [2010.06.25 15:36:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\eigentümerversammlung [2010.06.03 15:36:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\Anzeige [2010.05.06 20:57:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\kopierte musik [2010.05.05 23:41:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Malwarebytes [2010.05.05 23:41:08 | 000,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.05.05 23:41:06 | 000,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.05.05 23:41:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.05.05 17:28:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\contentgmbh [2010.05.03 14:35:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\Henri Studium [2010.04.22 02:19:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\RayV [2010.04.18 19:35:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\iphone [2010.04.02 18:02:37 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft [2007.02.08 18:51:01 | 000,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2007.02.08 18:51:01 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys ========== Files - Modified Within 90 Days ========== [2010.07.01 12:45:42 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe [2010.07.01 12:44:56 | 001,058,878 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.07.01 12:44:56 | 000,454,160 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.07.01 12:44:56 | 000,436,790 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.07.01 12:44:56 | 000,083,324 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.07.01 12:44:56 | 000,070,110 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.07.01 12:41:03 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\System32\drivers\USBCRFT.SYS [2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job [2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010.07.01 12:40:53 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.07.01 12:40:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.07.01 12:40:38 | 1341,706,240 | -HS- | M] () -- C:\hiberfil.sys [2010.07.01 12:37:22 | 011,796,480 | -H-- | M] () -- C:\Dokumente und Einstellungen\Henri\NTUSER.DAT [2010.07.01 12:37:22 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Henri\ntuser.ini [2010.07.01 00:20:22 | 000,000,584 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\NTREGOPT.lnk [2010.07.01 00:20:22 | 000,000,565 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\ERUNT.lnk [2010.07.01 00:00:19 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.06.28 20:43:03 | 000,026,692 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\wklnhst.dat [2010.06.28 17:33:04 | 000,000,349 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI [2010.06.28 12:28:23 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Gmer.zip [2010.06.27 02:58:23 | 000,062,464 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.27 02:34:59 | 003,707,130 | -H-- | M] () -- C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\IconCache.db [2010.06.26 19:45:27 | 000,205,824 | ---- | M] () -- C:\WINDOWS\System32\sshnas21.dll [2010.06.26 02:01:58 | 000,000,135 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010.06.19 11:22:19 | 000,034,889 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\kubb_bauplan.pdf [2010.06.16 02:53:02 | 000,009,810 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Zahlung Kicker.xlsx [2010.06.09 23:12:19 | 000,348,200 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.06.09 20:57:13 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010.06.02 22:17:05 | 050,783,831 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\doping_ndr_compl.mp3 [2010.05.26 12:48:28 | 000,602,990 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000003.jpg [2010.05.26 12:47:59 | 000,956,223 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000002.jpg [2010.04.15 02:52:49 | 000,000,190 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Verknüpfung mit Toshiba USB-HDD (N).lnk ========== Files Created - No Company Name ========== [2010.07.01 00:32:11 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\gmer.exe [2010.07.01 00:20:22 | 000,000,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\NTREGOPT.lnk [2010.07.01 00:20:22 | 000,000,565 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\ERUNT.lnk [2010.06.28 12:28:15 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Gmer.zip [2010.06.26 19:45:42 | 000,000,282 | -H-- | C] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job [2010.06.26 19:45:35 | 000,000,282 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010.06.26 19:45:27 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\sshnas21.dll [2010.06.19 11:22:18 | 000,034,889 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\kubb_bauplan.pdf [2010.06.14 01:49:17 | 307,237,987 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\5 Joanne K. Rowling - H. P. Und der Orden des Phönix (3. Teil).m4b [2010.06.14 01:49:02 | 321,256,699 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\5 Joanne K. Rowling - H. P. Und der Orden des Phönix (2. Teil).m4b [2010.06.14 01:48:44 | 326,647,555 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\5 Joanne K. Rowling - H. P. Und der Orden des Phönix (1. Teil).m4b [2010.06.07 18:35:23 | 000,009,810 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Zahlung Kicker.xlsx [2010.06.02 22:09:59 | 050,783,831 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\doping_ndr_compl.mp3 [2010.05.27 18:27:46 | 000,956,223 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000002.jpg [2010.05.27 18:27:46 | 000,602,990 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000003.jpg [2010.04.04 13:00:09 | 001,285,847 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1310052.JPG [2010.04.04 12:59:29 | 001,260,439 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300050.JPG [2010.04.04 12:59:29 | 001,232,414 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300051.JPG [2010.04.04 12:59:29 | 001,205,695 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300047.JPG [2010.04.04 12:59:29 | 001,088,432 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300049.JPG [2009.09.28 19:27:57 | 000,000,387 | ---- | C] () -- C:\WINDOWS\retrieve.ini [2009.08.18 17:47:31 | 000,000,042 | ---- | C] () -- C:\WINDOWS\IniFile1.ini [2009.08.11 12:10:06 | 000,000,311 | ---- | C] () -- C:\WINDOWS\game.ini [2009.01.10 14:41:15 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll [2009.01.10 12:54:32 | 000,012,800 | ---- | C] () -- C:\WINDOWS\System32\EKDeviceServices.dll [2009.01.05 18:44:20 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\mgxasio2.dll [2009.01.05 18:41:57 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll [2008.05.20 13:26:11 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI [2008.01.30 22:42:24 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI [2008.01.26 16:17:56 | 000,000,327 | ---- | C] () -- C:\WINDOWS\SIERRA.INI [2008.01.24 12:19:34 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [2008.01.12 21:40:08 | 000,000,098 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI [2008.01.12 21:26:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI [2007.12.25 15:24:15 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\MACD32.DLL [2007.12.25 15:24:15 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\MASE32.DLL [2007.12.25 15:24:15 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\MAMC32.DLL [2007.12.25 15:24:15 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\MASD32.DLL [2007.12.25 15:24:15 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\MA32.DLL [2007.09.20 12:33:52 | 003,190,784 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2007.09.20 12:33:52 | 000,741,376 | ---- | C] () -- C:\WINDOWS\System32\audxlib.dll [2007.09.20 12:33:52 | 000,511,488 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2007.09.20 12:33:52 | 000,405,504 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2007.09.20 12:33:52 | 000,245,760 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll [2007.09.20 12:33:52 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll [2007.09.20 12:33:52 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll [2007.09.20 12:33:52 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll [2007.09.20 12:33:52 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2007.09.20 12:33:52 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll [2007.09.20 12:33:52 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll [2007.09.20 12:33:52 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll [2007.09.20 12:33:52 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\ff_realaac.dll [2007.09.20 12:33:52 | 000,079,872 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll [2007.09.20 12:33:52 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll [2007.09.20 12:33:52 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll [2007.09.20 12:33:52 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2007.09.20 12:33:52 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2007.09.20 12:33:52 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2007.07.25 15:24:30 | 001,559,040 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2007.05.07 17:25:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\musicmaker.INI [2007.05.07 17:08:10 | 000,000,334 | ---- | C] () -- C:\WINDOWS\BeatBox.INI [2007.05.07 17:02:56 | 000,038,912 | ---- | C] () -- C:\WINDOWS\System32\mgxasio.dll [2007.05.07 17:01:40 | 000,006,768 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2007.03.31 18:11:02 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini [2007.02.09 19:51:19 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2007.02.08 18:43:25 | 000,000,023 | ---- | C] () -- C:\WINDOWS\AOLMIcon.ini [2006.12.07 02:00:50 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2006.12.07 01:57:19 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2006.02.26 16:08:28 | 000,585,728 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2004.12.02 16:20:18 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll [2004.09.22 11:09:06 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll [2004.08.22 18:04:56 | 000,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2004.07.20 18:04:02 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll [2004.02.17 15:22:00 | 000,000,037 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2004.02.12 15:08:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\GetOSVer.dll [2004.02.06 11:34:12 | 000,000,135 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2004.02.06 11:23:04 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll [2004.02.06 11:23:04 | 000,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll [2004.02.06 11:23:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll [2004.02.06 11:23:04 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll [2004.02.06 11:23:04 | 000,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini [2004.02.04 20:27:57 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2004.02.04 12:02:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004.02.04 04:26:29 | 000,001,050 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2004.02.04 02:35:11 | 000,000,047 | ---- | C] () -- C:\WINDOWS\InoSetup.ini [2004.02.04 02:30:46 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2004.02.04 02:26:04 | 000,000,282 | ---- | C] () -- C:\WINDOWS\Dit.INI [2004.02.04 02:14:06 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRMDRV.DLL [2004.02.04 02:14:05 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2004.02.04 02:14:05 | 000,003,424 | ---- | C] () -- C:\WINDOWS\cmiainfo.sys [2004.02.04 02:14:05 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2004.02.04 02:14:05 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2004.02.04 02:14:02 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [2004.02.03 20:36:59 | 000,000,863 | ---- | C] () -- C:\WINDOWS\orun32.ini [2004.02.03 08:28:01 | 000,380,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\PRISMA00.sys [2004.01.15 15:43:28 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll [2003.07.29 16:33:26 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\TosHidAPI.dll [1998.03.25 20:12:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\vbzlib.dll ========== LOP Check ========== [2010.04.30 10:07:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Eastman Kodak Company [2009.01.10 13:02:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kds_kodak [2009.11.06 20:11:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KONAMI [2009.01.05 18:52:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX [2007.12.26 22:23:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor [2004.02.04 19:30:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\muvee Technologies [2007.12.25 15:41:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle [2009.11.08 13:37:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Propellerhead Software [2008.06.09 17:30:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tandem [2010.02.19 20:33:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [2010.03.06 16:17:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\2K Sports [2009.08.18 15:52:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Any Video Converter [2008.08.28 12:45:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Atari [2008.06.09 17:28:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\InterTrust [2009.01.05 18:52:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\MAGIX [2010.03.04 20:36:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\OfferBox [2009.11.08 13:45:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Propellerhead Software [2010.05.03 14:39:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\RayV [2010.03.04 22:38:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Thunderbird [2008.03.01 16:08:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Toshiba [2010.06.27 03:00:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\TuneUp Software [2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2010.01.12 14:10:26 | 000,444,156 | ---- | M] () -- C:\AnalysisLog.sr0 [2004.02.03 20:34:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2010.06.28 14:29:56 | 000,000,798 | ---- | M] () -- C:\avenger.txt [2008.02.16 01:52:43 | 000,000,211 | RHS- | M] () -- C:\boot.ini [2002.08.29 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin [2004.02.03 20:34:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2008.12.31 19:07:45 | 000,000,319 | ---- | M] () -- C:\drmHeader.bin [2010.07.01 12:40:38 | 1341,706,240 | -HS- | M] () -- C:\hiberfil.sys [2004.02.03 20:34:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2004.02.04 09:22:10 | 000,000,496 | -H-- | M] () -- C:\IPH.PH [2004.02.03 20:34:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2007.02.26 12:35:22 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2009.11.06 19:36:11 | 000,251,712 | RHS- | M] () -- C:\ntldr [2010.07.01 12:40:35 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.02.25 23:42:32 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll [2010.06.26 19:45:27 | 000,205,824 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\sshnas21.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2004.02.03 21:28:53 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2004.02.03 21:28:53 | 000,606,208 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2004.02.03 21:28:53 | 000,421,888 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\system32\drivers\*.sys /90 > [2010.07.01 12:41:03 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\system32\drivers\USBCRFT.SYS < %systemroot%\system32\user32.dll /md5 > [2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2008.04.14 08:52:34 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2008.04.14 08:52:34 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-30 22:57:44 < End of report > |
|
01.07.2010, 12:34
| #15 |
| | Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Malwarebytes' Anti-Malware 1.39 Datenbank Version: 2421 Windows 5.1.2600 Service Pack 3 01.07.2010 00:31:20 mbam-log-2010-07-01 (00-31-20).txt Scan-Methode: Quick-Scan Durchsuchte Objekte: 88341 Laufzeit: 8 minute(s), 11 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 1 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
| Themen zu Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft |
| antivir, antivir guard, avira, bho, bonjour, browser, computer, desktop, firefox, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, mozilla, problem, realtek, rundll, security, security scan, senden, server, software, system, werbe-popups, werbung, windows, windows xp, wireless lan |
Textbox.
.
Linear-Darstellung
