TR/Crypt.ZPACK.Gen in C:\Users\***\AppData\Local\Temp\eapp32hst.dl

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4806

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

13.10.2010 03:18:51
mbam-log-2010-10-13 (03-18-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 458463
Laufzeit: 1 Stunde(n), 37 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7

Infizierte Speicherprozesse:
C:\Users\***\AppData\Local\Temp\dfrgsnapnt.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfrgsnapnt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dpuzamufoyemu (Trojan.Agent.U) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rteluxiyayi (Trojan.Agent.U) -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\***\AppData\Local\Temp\dfrgsnapnt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1B8D4AOK\5-direct[1].ex (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1B8D4AOK\setup[2].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SBU96FSR\5-direct[1].ex (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\ProgramData\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\piovfsr.dll (Trojan.Agent.U) -> Delete on reboot.
C:\Users\***\AppData\Local\afewujox.dll (Trojan.Agent.U) -> Delete on reboot.
         

OTL logfile created on: 13.10.2010 03:33:35 - Run 1
OTL by OldTimer - Version 3.2.15.1     Folder = C:\Users\***\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 68,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 139,59 Gb Free Space | 46,83% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\T-Com\Sinus 154 data II\TS154USB.exe ()
PRC - C:\Program Files\T-Com\Sinus 154 data II\PRISMSVR.exe (Conexant Systems, Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\***\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (DAUpdaterSvc) -- C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (cvslock) -- C:\Program Files\CVSNT\cvslock.exe ()
SRV - (cvsnt) -- C:\Program Files\CVSNT\cvsservice.exe (March Hare Software Ltd)
SRV - (matlabserver) -- C:\Programme\Matlab\webserver\bin\win32\matlabserver.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) -- C:\Windows\System32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (CoachVid) -- C:\Windows\System32\drivers\CoachVid.sys (FotoNation Inc.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (RT73) -- C:\Windows\System32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (DT154_A02) -- C:\Windows\System32\drivers\TS154USB.sys (Deutsche Telekom AG)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.one.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {C57885F7-C713-4F35-A567-EE433B585999}:1.9.1
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.09.17 10:02:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.09.17 10:02:50 | 000,000,000 | ---D | M]
 
[2008.10.08 18:27:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla\Extensions
[2010.10.12 23:12:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\e6n84d4h.default\extensions
[2010.07.18 03:20:02 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\e6n84d4h.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.09.17 17:36:09 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.05.13 17:49:57 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009.09.25 17:01:26 | 000,071,016 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsharedview.dll
[2010.07.22 18:09:49 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.07.22 18:09:49 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.07.22 18:09:49 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.07.22 18:09:49 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.07.22 18:09:49 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PRISMSVR.EXE] C:\Program Files\T-Com\Sinus 154 data II\PRISMSVR.EXE (Conexant Systems, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk = C:\Program Files\Trillian\trillian.exe (Cerulean Studios)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img23.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img23.jpg
O30 - LSA: Authentication Packages - (setuid) - C:\Windows\System32\setuid.dll (March-Hare Software Ltd)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[3208.10.15 10:53:21 | 000,000,000 | ---D | C] -- C:\Application Data
[2010.10.13 00:05:26 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2010.10.13 00:05:06 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.10.13 00:05:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.10.13 00:04:59 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.10.13 00:04:59 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.10.12 22:50:49 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{C57885F7-C713-4F35-A567-EE433B585999}
[2010.09.29 09:39:57 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.09.15 16:56:07 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.03.25 20:13:00 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeEEE2.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\*.tmp files -> C:\Users\***\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.10.13 03:21:14 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.13 03:21:14 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.13 03:21:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.13 03:21:07 | 3488,018,432 | -HS- | M] () -- C:\hiberfil.sys
[2010.10.13 01:38:10 | 000,000,120 | ---- | M] () -- C:\Users\***\AppData\Local\Tbuxevafidelujo.dat
[2010.10.13 01:38:10 | 000,000,000 | ---- | M] () -- C:\Users\***\AppData\Local\Ipeku.bin
[2010.10.13 00:05:11 | 000,000,784 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.30 08:54:36 | 000,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.09.30 08:54:36 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.09.30 08:54:36 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.09.30 08:54:36 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.09.29 12:17:26 | 000,043,520 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\*.tmp files -> C:\Users\***\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.10.13 00:05:11 | 000,000,784 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.10.12 22:50:50 | 000,000,120 | ---- | C] () -- C:\Users\***\AppData\Local\Tbuxevafidelujo.dat
[2010.10.12 22:50:50 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Local\Ipeku.bin
[2010.08.13 11:22:38 | 000,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2010.05.13 18:23:06 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.08 21:05:30 | 000,023,888 | ---- | C] () -- C:\Users\***\AppData\Roaming\UserTile.png
[2010.03.25 19:55:15 | 000,005,048 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2010.01.04 18:15:15 | 000,000,680 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2009.10.02 15:21:35 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.10.02 15:21:34 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.05.27 22:44:01 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.22 00:39:18 | 000,000,600 | ---- | C] () -- C:\Users\***\AppData\Local\PUTTY.RND
[2008.10.31 18:20:48 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2008.10.31 18:20:48 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2008.10.31 18:20:47 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.10.31 18:20:46 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.10.31 18:20:46 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2008.10.14 14:42:11 | 000,000,080 | ---- | C] () -- C:\Windows\matlab.ini
[2008.10.08 17:47:48 | 000,043,520 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2007.11.26 22:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006.11.02 12:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2010.08.13 11:29:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2009.05.24 15:34:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2010.05.13 19:35:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\NCH Swift Sound
[2008.10.17 20:40:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2010.05.08 21:05:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking
[2009.05.22 00:06:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Portable PuTTY
[2010.07.31 00:43:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Trillian
[2010.07.23 13:18:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Tropico 3
[2010.08.24 00:00:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2010.10.13 03:20:23 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 13.10.2010 03:33:35 - Run 1
OTL by OldTimer - Version 3.2.15.1     Folder = C:\Users\***\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 68,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 139,59 Gb Free Space | 46,83% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01C4DC9C-5C5D-487C-999F-198AFCD2FC3C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{1B00AA6F-9435-4450-BC49-26DC2198AB08}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{3B406AE2-CBB6-4C14-884B-E717DC956988}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{3F3AD993-C0DC-4FAC-ABD2-D59205C9E2C5}" = rport=139 | protocol=6 | dir=out | app=system | 
"{6C88D0A3-BD01-4CF0-8F77-7592F13F47F2}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B2DDFC1D-D3E8-4AF4-A81A-C96E2582B4E9}" = rport=138 | protocol=17 | dir=out | app=system | 
"{B6D93B2C-11A8-49D0-9500-176EBE6D85D5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{B8180B3C-DD33-4E56-A52D-5BEA16A27064}" = lport=138 | protocol=17 | dir=in | app=system | 
"{DE074A1E-DBE1-4DD4-A3B9-215C9A7C06F0}" = lport=137 | protocol=17 | dir=in | app=system | 
"{EAA6BBF1-4572-42EA-A535-41606E057102}" = lport=445 | protocol=6 | dir=in | app=system | 
"{FF6B6AA7-B971-449D-939B-28313EF8C0AE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00AB193D-6E5F-4431-BF2D-3F0DA35C0A6E}" = protocol=6 | dir=in | app=c:\spiele\starcraft ii\versions\base15405\sc2.exe | 
"{36C21DAE-EB2C-4F4D-B801-5D7357ACC11F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{3C7DC7F3-7152-4890-9598-00616432708C}" = protocol=17 | dir=in | app=c:\spiele\starcraft ii\versions\base15405\sc2.exe | 
"{4033ACC1-900E-47A4-B6BC-55413532E389}" = protocol=17 | dir=in | app=c:\program files\mass effect\masseffectlauncher.exe | 
"{5064C4CD-DA75-4EDB-B982-9F6F614CB031}" = protocol=6 | dir=in | app=c:\program files\dragon age\daoriginslauncher.exe | 
"{514F792D-1974-4168-BF53-CC5A4FCA039A}" = protocol=6 | dir=in | app=c:\program files\dragon age\bin_ship\daupdatersvc.service.exe | 
"{53E73874-4DFB-4CE4-AF17-59BA6665741A}" = protocol=17 | dir=in | app=c:\program files\dragon age\bin_ship\daupdatersvc.service.exe | 
"{575650D1-A6F2-46EC-A9C3-B9E24E617D53}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5BBC3060-EC53-4C91-A0C5-F1E765E24A76}" = protocol=17 | dir=in | app=c:\spiele\starcraft ii\starcraft ii.exe | 
"{5C39BA00-1870-4EE9-AE11-F1D53190D289}" = protocol=6 | dir=in | app=c:\program files\dragon age\bin_ship\daupdatersvc.service.exe | 
"{5E448250-51E2-4657-9A86-651A72D217A1}" = protocol=17 | dir=in | app=c:\program files\dragon age\bin_ship\daorigins.exe | 
"{5EF116D6-C8D3-4A38-9E73-5BFB7BA7B1B1}" = protocol=6 | dir=in | app=c:\program files\mass effect\binaries\masseffect.exe | 
"{71977BA5-935B-42B5-B4BF-76788AB50822}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{71D675BB-11E9-4DE5-961B-254C37EEFAAE}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{872650B4-1960-4432-A7C6-D61F1A12572C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{9458F974-F7B9-4BF1-B07F-65B46D435844}" = protocol=17 | dir=in | app=c:\program files\dragon age\daoriginslauncher.exe | 
"{99DD42D1-7FC2-46D4-978F-BD4A07EC9EC1}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{A35AD8CC-F79A-4B19-865B-436246C8F29B}" = protocol=6 | dir=in | app=c:\program files\dragon age\bin_ship\daorigins.exe | 
"{A3D0E6DE-B02D-4921-AF16-CB4E0DB75363}" = protocol=17 | dir=in | app=c:\program files\dragon age\bin_ship\daupdatersvc.service.exe | 
"{B0C97603-8BA9-4DCE-AC72-35838AD299E8}" = protocol=17 | dir=in | app=c:\program files\mass effect\binaries\masseffect.exe | 
"{BB6A82E6-1293-48B6-84B0-B2E48EBDBA42}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |  
"{CA4A01AD-B3C5-4649-A341-D36FD2F199B6}" = protocol=6 | dir=in | app=c:\program files\mass effect\masseffectlauncher.exe | 
"{CB22E097-0C95-41FB-A493-77314BEDFDA8}" = protocol=6 | dir=in | app=c:\spiele\curse\curseclient.exe | 
"{D17DCDE0-DD1B-439D-A7F9-F8D24DF72FB0}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{D3BCC6FC-B8E8-4111-8D61-30A60722EDAA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{D408DF67-EA4D-422A-815D-44AC375E8AFC}" = protocol=17 | dir=in | app=c:\spiele\curse\curseclient.exe | 
"{DC853821-6052-4AC3-B5A7-0576F919A311}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DFCE5EEE-F9E7-4E92-8D28-48615156E5E4}" = protocol=6 | dir=in | app=c:\spiele\starcraft ii\starcraft ii.exe | 
"{EF094B3E-CE7F-4682-A2D6-A5724CB40D38}" = protocol=6 | dir=in | app=c:\spiele\microsoft games\age of empires iii\age3x.exe | 
"{F22B22C5-7ABC-4EE8-8DEC-F81F068C97CB}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"TCP Query User{044E5389-B3A5-40B1-9569-CA90C0894793}C:\program files\matlab\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\program files\matlab\bin\win32\matlab.exe | 
"TCP Query User{0F6DD93A-932C-4E93-BC6B-89ADB9B72262}C:\spiele\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\spiele\starcraft ii\support\blizzarddownloader.exe | 
"TCP Query User{137F5F72-9B43-44A0-AAE7-6AEFE7AAEEC7}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 
"TCP Query User{152B2125-801F-4401-80DF-BDEE42DD65C0}C:\program files\dragon age\bin_ship\daorigins.exe" = protocol=6 | dir=in | app=c:\program files\dragon age\bin_ship\daorigins.exe | 
"TCP Query User{241F8296-2112-4A29-8B24-6FD8ED37F6D5}C:\spiele\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\spiele\warcraft iii\war3.exe | 
"TCP Query User{29BB632B-1974-4058-9CD9-FDFE76A6CEF4}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 
"TCP Query User{2A3B7136-B139-4FA3-A4D3-5C352F1B73EB}C:\program files\matlab\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\program files\matlab\bin\win32\matlab.exe | 
"TCP Query User{2E5C4FCE-425E-4CBE-9602-CE60460EF308}C:\spiele\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\spiele\tmnationsforever\tmforever.exe | 
"TCP Query User{2FB4F952-B80C-497C-A071-4D7E41565DE0}C:\spiele\starcraft ii\versions\base16561\sc2.exe" = protocol=6 | dir=in | app=c:\spiele\starcraft ii\versions\base16561\sc2.exe | 
"TCP Query User{3586551A-CFAF-413A-963E-6A86373E6383}C:\spiele\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\spiele\warcraft iii\war3.exe | 
"TCP Query User{3A02E3F6-526B-4AED-93F0-FF7576F12123}C:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe" = protocol=6 | dir=in | app=c:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe | 
"TCP Query User{4BBEF84B-2AB2-4444-98D1-4DF83C64D694}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |  
"TCP Query User{555D3874-15D3-4848-A589-F334F192DAA6}C:\cygwin\bin\xwin.exe" = protocol=6 | dir=in | app=c:\cygwin\bin\xwin.exe | 
"TCP Query User{7F412294-A216-44BE-B0CB-45E6B3BD14BA}C:\spiele\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\spiele\tmnationsforever\tmforever.exe | 
"TCP Query User{7FC741D3-714E-4749-ADA8-7D28895497B9}C:\program files\xming\xming.exe" = protocol=6 | dir=in | app=c:\program files\xming\xming.exe | 
"TCP Query User{951430E3-6E2A-409A-B707-2D93FA9A8E37}C:\program files\xming\xming.exe" = protocol=6 | dir=in | app=c:\program files\xming\xming.exe | 
"TCP Query User{DB72DA61-8CC1-489C-84D8-D831906477F7}C:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe" = protocol=6 | dir=in | app=c:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe | 
"UDP Query User{06C9639B-FA36-416C-948F-1C1DCA40F3F7}C:\program files\matlab\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\program files\matlab\bin\win32\matlab.exe | 
"UDP Query User{0AE0691C-9959-466F-9CE3-90F04E9EB7B3}C:\program files\matlab\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\program files\matlab\bin\win32\matlab.exe | 
"UDP Query User{0D22A8DE-7B7F-4925-807C-B4C89659EBA2}C:\spiele\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\spiele\warcraft iii\war3.exe | 
"UDP Query User{225227F2-7002-494F-B5CB-C6D783D37FAE}C:\program files\xming\xming.exe" = protocol=17 | dir=in | app=c:\program files\xming\xming.exe | 
"UDP Query User{241446FC-6E75-451C-8078-CAC77E7F052F}C:\spiele\starcraft ii\versions\base16561\sc2.exe" = protocol=17 | dir=in | app=c:\spiele\starcraft ii\versions\base16561\sc2.exe | 
"UDP Query User{41A3D9A2-2C20-4A90-940E-913F8A58FAAE}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 
"UDP Query User{499C4F45-E5FA-4E56-8D93-F24CC348ECC6}C:\spiele\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\spiele\tmnationsforever\tmforever.exe | 
"UDP Query User{56D27F1A-E002-482F-BC57-9C08C36EE764}C:\spiele\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\spiele\starcraft ii\support\blizzarddownloader.exe |  
"UDP Query User{70F6B118-4431-4075-8796-CAFB7B7F353E}C:\spiele\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\spiele\tmnationsforever\tmforever.exe | 
"UDP Query User{8C344E5E-DBA7-4204-9200-EB17E6CC7654}C:\program files\dragon age\bin_ship\daorigins.exe" = protocol=17 | dir=in | app=c:\program files\dragon age\bin_ship\daorigins.exe | 
"UDP Query User{A15530D8-619D-4EDB-9308-16A5E12744FF}C:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe" = protocol=17 | dir=in | app=c:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe | 
"UDP Query User{AA53E08D-19C4-416B-91ED-A1367BD47FA6}C:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe" = protocol=17 | dir=in | app=c:\spiele\lucasarts\star wars jedi knight jedi academy\gamedata\jamp.exe | 
"UDP Query User{C83E8964-180F-44C9-9D91-80C06FB7F5D2}C:\spiele\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\spiele\warcraft iii\war3.exe | 
"UDP Query User{D376C35F-E3CD-42BF-8492-C68949D9DFC1}C:\cygwin\bin\xwin.exe" = protocol=17 | dir=in | app=c:\cygwin\bin\xwin.exe | 
"UDP Query User{E4443975-83BD-4E26-ADAD-6AEB234553C8}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 
"UDP Query User{E6454CF0-75E0-4E44-86F6-AA62B17DFF72}C:\program files\xming\xming.exe" = protocol=17 | dir=in | app=c:\program files\xming\xming.exe | 
"UDP Query User{FAC21901-27A2-4BF6-B81F-D4DA5B974DE2}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{0D994CC5-819F-4657-84DD-397B8FE1EA80}" = Star Wars Jedi Knight Jedi Academy
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 16
"{359ADF3A-F727-40F1-9D8A-6699EE355287}" = Gothic 3
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{53AF9DC2-DA7A-43CE-82A8-F60ACAC851E9}" = Microsoft SharedView
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{72F0172C-6D1D-470E-9298-A3A1A6530CFB}" = Origin8
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C480BB2-42A9-40C6-AA5F-7AA20FC7C7F3}" = CVSNT 2.5.03.2382
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A912021A-FEDD-4DA3-8DB4-245EBDA84778}" = OriginPro 8G
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C53FB914-C1F6-4F9D-93E2-A3A84935EC15}" = Sinus 154 data II
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CurseClient" = Curse Client
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"ExpressRip" = Express Rip
"GPL Ghostscript 8.63" = GPL Ghostscript 8.63
"GSview 4.9" = GSview 4.9
"hon" = Heroes of Newerth
"InstallShield_{C53FB914-C1F6-4F9D-93E2-A3A84935EC15}" = Sinus 154 data II
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.2.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MatlabR14" = MATLAB Family of Products Release 14
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MiKTeX 2.7" = MiKTeX 2.7
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"NVIDIA Drivers" = NVIDIA Drivers
"Orb" = Winamp Remote
"Picasa 3" = Picasa 3
"Portable PuTTY for Xming_is1" = Xming portable PuTTY 7.3.0.26
"PROHYBRIDR" = 2007 Microsoft Office system
"Sam and Max - Season One" = Sam and Max - Season One 1.0
"StarCraft II" = StarCraft II
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeXnicCenter_is1" = TeXnicCenter Version 1 Beta 7.50
"TmNationsForever_is1" = TmNationsForever
"TortoiseCVS_is1" = TortoiseCVS 1.10.9
"Trillian" = Trillian
"Tropico3" = Tropico 3 1.00
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"WinDjView" = WinDjView 1.0.3
"WinRAR archiver" = WinRAR
"Xming_is1" = Xming 6.9.0.31
"Xming-fonts_is1" = Xming-fonts 7.4.0.3
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 22.09.2010 04:05:49 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 22.09.2010 04:05:49 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 22.09.2010 04:07:08 | Computer Name = *** | Source = WinMgmt | ID = 10
Description = 
 
Error - 22.09.2010 04:10:40 | Computer Name = *** | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\CVSNT\cvsnt.cpl".
 Fehler in Manifest- oder Richtliniendatei "C:\Program Files\CVSNT\cvsnt.cpl" in
 Zeile 21.  Der Wert "asInvoked" des "level"-Attributs im urn:schemas-microsoft-com:asm.v1^requestedPrivileges-Element
 ist ungültig.
 
Error - 22.09.2010 04:14:16 | Computer Name = *** | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\CVSNT\cvsnt.cpl".
 Fehler in Manifest- oder Richtliniendatei "C:\Program Files\CVSNT\cvsnt.cpl" in
 Zeile 21.  Der Wert "asInvoked" des "level"-Attributs im urn:schemas-microsoft-com:asm.v1^requestedPrivileges-Element
 ist ungültig.
 
Error - 22.09.2010 04:16:04 | Computer Name = *** | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\CVSNT\cvsnt.cpl".
 Fehler in Manifest- oder Richtliniendatei "C:\Program Files\CVSNT\cvsnt.cpl" in
 Zeile 21.  Der Wert "asInvoked" des "level"-Attributs im urn:schemas-microsoft-com:asm.v1^requestedPrivileges-Element
 ist ungültig.
 
Error - 22.09.2010 05:34:46 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 22.09.2010 05:34:46 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 22.09.2010 05:36:07 | Computer Name = *** | Source = WinMgmt | ID = 10
Description = 
 
Error - 22.09.2010 05:36:29 | Computer Name = *** | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\CVSNT\cvsnt.cpl".
 Fehler in Manifest- oder Richtliniendatei "C:\Program Files\CVSNT\cvsnt.cpl" in
 Zeile 21.  Der Wert "asInvoked" des "level"-Attributs im urn:schemas-microsoft-com:asm.v1^requestedPrivileges-Element
 ist ungültig.
 
[ System Events ]
Error - 09.10.2010 12:08:11 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.10.2010 04:24:35 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.10.2010 05:21:25 | Computer Name = *** | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 10.10.2010 um 11:17:49 unerwartet heruntergefahren.
 
Error - 10.10.2010 05:23:04 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.10.2010 08:20:32 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.10.2010 19:07:09 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 11.10.2010 04:57:11 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.10.2010 04:51:08 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.10.2010 14:35:18 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.10.2010 21:22:48 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >