Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Sparkasssentrojaner

Sparkasssentrojaner


Plagegeister aller Art und deren Bekämpfung: Sparkasssentrojaner

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 06.11.2010, 16:35   #1
Blacky64
 
Sparkasssentrojaner - Icon35

Sparkasssentrojaner


Hallo

Ich weiß, das dieses Thema schon mehrmals hier angesprochen wurde.
Leider gibts es hier keine wirkliche Hilfestellung für Leien.
Ich hab das mal mit dem OTL gemacht. Habe nämlich auch einen
Trojaner auf meinem Rechner, der 40 Tan's verlangt.
Wieso ist das eigentlich so kompliziert, einen Trojaner wieder runter zu bekommen? Wofür gibt es denn die ganzen Antivir-Software und Zusatzprogramme, wenn Sie doch nichts nützen? Aber egal. Ich hoffe mir kann hier jemand helfen und auch einmal für alle Leien erklären, wie die Bereinigung funktioniert, nicht nur erzählen, was man nacheinandr tun muss.

Danke schon mal im voraus.

OTL txt:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 06.11.2010 15:55:45 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\*\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 6138 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 13,34 Gb Free Space | 11,39% Space Free | Partition Type: NTFS
Drive D: | 117,19 Gb Total Space | 88,19 Gb Free Space | 75,26% Space Free | Partition Type: NTFS
Drive E: | 231,38 Gb Total Space | 208,67 Gb Free Space | 90,18% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\*\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\DESTIN~1\AppData\Local\Temp\tmpe96f0f7d\criticalupdate8.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\*\AppData\Roaming\Neti\qyiz.exe (Online Solutions)
PRC - C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\BOINC\boinc.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\BUFFALO\SLManagerEasy\Inputps.exe (BUFFALO INC.)
PRC - C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe (BUFFALO INC.)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
PRC - C:\Program Files (x86)\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
PRC - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Windows\SysWOW64\PSIService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\*\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Akamai) -- C:/Program Files (x86)/Common Files/Akamai/netsession_win_062a651.dll ()
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (Bufssvr) -- C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe (BUFFALO INC.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative Media Toolbox 6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs)
SRV - (Creative ALchemy AL1 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (Creative HOAL Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTHOALLicensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
SRV - (GEST Service) -- C:\Program Files (x86)\GIGABYTE\GEST\GSvr.exe ()
SRV - (PSI_SVC_2) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (ProtexisLicensing) -- C:\Windows\SysWOW64\PSIService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (netr7364) -- C:\Windows\SysNative\DRIVERS\netr7364.sys File not found
DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (ASPI) -- C:\Windows\SysNative\DRIVERS\ASPI32.sys File not found
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\DRIVERS\avipbb.sys (Avira GmbH)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\DRIVERS\usbser_lowerfltx64j.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\DRIVERS\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdcx64) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcdx64) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia)
DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia)
DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (btusb64h) -- C:\Windows\SysNative\drivers\btusb64h.sys (BUFFALO INC.)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\DRIVERS\usbser.sys (Microsoft Corporation)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys ()
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (skfiltv) -- C:\Windows\SysNative\drivers\skfiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (acedrv10) -- C:\Windows\SysNative\drivers\acedrv10.sys (Protect Software GmbH)
DRV:64bit: - (acehlp10) -- C:\Windows\SysNative\drivers\acehlp10.sys (Protect Software GmbH)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (TEAM) Realtek Virtual Miniport Driver for Teaming (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTTEAMPT) Realtek Teaming Protocol Driver (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTVLANPT) Realtek Vlan Protocol Driver (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtVlan60.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV:64bit: - (rt61x64) -- C:\Windows\SysNative\DRIVERS\netr6164.sys (Ralink Technology Inc.)
DRV:64bit: - (RT61) -- C:\Windows\SysNative\DRIVERS\RT61.sys (Ralink Technology Inc.)
DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (ET5Drv) -- C:\Windows\ET5Drv.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (RT61) -- C:\Windows\SysWOW64\drivers\rt61.sys (Ralink Technology Inc.)
DRV - (ASPI) -- C:\Windows\SysWOW64\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,MenuText = eBay.de
IE - HKLM\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Ask"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.6
FF - prefs.js..extensions.enabledItems: {EC1B67CA-A2CD-4931-915A-63D5341D1285}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {144D1513-0819-4538-AD26-D515AF443AE7}:1.1.0.1
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.9.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.0.4
FF - prefs.js..extensions.enabledItems: {B1FC0AB8-EEDC-451A-9185-A0D5E308BBDD}:1.0.0.8
FF - prefs.js..extensions.enabledItems: {4B4D630E-AAE2-4EA9-A0CB-5F045AAF2EC2}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {7A7EF87E-95DB-4A84-83E8-E0FE7B20017F}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {89506680-e3f4-484c-a2c0-ed711d481eda}:0.9.5
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:3.3.7
FF - prefs.js..extensions.enabledItems: {3F4D6A2C-841D-403C-8CD8-48E54192DDEB}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.0.1
FF - prefs.js..extensions.enabledItems: {da7f40f0-8675-11db-b606-0800200c9a66}:3.01
FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20090117
FF - prefs.js..keyword.URL: "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.31 20:36:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.10.31 20:36:03 | 000,000,000 | ---D | M]
 
[2008.08.28 06:54:15 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Extensions
[2010.10.02 11:56:08 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions
[2008.08.28 07:16:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2009.01.05 23:12:20 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2008.08.28 06:54:46 | 000,000,000 | ---D | M] (Aero Fox) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2008.12.11 16:24:37 | 000,000,000 | ---D | M] (Firefox Showcase) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda}
[2010.10.02 11:56:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2008.09.17 02:47:37 | 000,000,000 | ---D | M] (FOXSCAPE) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{da7f40f0-8675-11db-b606-0800200c9a66}
[2008.12.10 19:03:06 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009.01.21 18:48:20 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\nasanightlaunch@example.com
[2008.12.24 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com
[2008.12.24 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com-trash
[2010.03.30 23:07:01 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2008.09.20 16:52:23 | 000,000,000 | ---D | M] (Amazon Startcenter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{144D1513-0819-4538-AD26-D515AF443AE7}
[2008.09.20 16:52:24 | 000,000,000 | ---D | M] (Google Kontextmenü) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB}
[2008.09.20 16:52:23 | 000,000,000 | ---D | M] (eBay-Kontextmenü) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{4B4D630E-AAE2-4EA9-A0CB-5F045AAF2EC2}
[2008.09.20 16:52:22 | 000,000,000 | ---D | M] (eBay-Startcenter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{7A7EF87E-95DB-4A84-83E8-E0FE7B20017F}
[2008.09.20 16:52:20 | 000,000,000 | ---D | M] (eBay Statusbar Button) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{B1FC0AB8-EEDC-451A-9185-A0D5E308BBDD}
[2008.09.20 16:52:25 | 000,000,000 | ---D | M] (Preispiraten) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C}
[2008.09.20 16:52:24 | 000,000,000 | ---D | M] (Amazon Kontextmenü) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{EC1B67CA-A2CD-4931-915A-63D5341D1285}
[2009.09.04 17:12:06 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions\ashopffx@a-shop.com
[2010.10.31 20:36:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.31 20:36:01 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.31 20:36:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.31 20:36:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.31 20:36:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O2 - BHO: (amazon) - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\Program Files (x86)\Preispiraten\IEButtonAmazonInterface.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll (Google Inc.)
O2 - BHO: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O2 - BHO: (eBay) - {CD9B7762-DFBC-42B1-BB30-02A78287B456} - C:\Program Files (x86)\Preispiraten\IEButtonEbayInterface.dll ()
O2 - BHO: (Preispiraten) - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\Program Files (x86)\Preispiraten\IEButtonPPInterface.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (NCH Toolbar) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvSvc] C:\Windows\SysNative\nvsvc64.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [boincmgr] C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKCU..\Run: [{E7E6456B-F161-1299-E5E2-9E9A5B5CF4C2}] C:\Users\Destination\AppData\Roaming\Neti\qyiz.exe (Online Solutions)
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10k_Plugin.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten\\preispiraten.html ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Destination\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten\\preispiraten.html ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Destination\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten\preispiraten3ie.exe ()
O9 - Extra 'Tools' menuitem : Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten\preispiraten3ie.exe ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - File not found
O9 - Extra 'Tools' menuitem : Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - File not found
O9 - Extra Button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: eBay - {E79005A3-0F92-434B-9F7B-51131FC7168F} - File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Destination\Pictures\Hintergrund\darkness_2560x1600.jpg
O24 - Desktop BackupWallPaper: C:\Users\Destination\Pictures\Hintergrund\darkness_2560x1600.jpg
O32 - HKLM CDRom: AutoRun - 0
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\adobe\command - "" = F:\goodies\ar405deu.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\aocsetup.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\log\command - "" = F:\goodies\machine\machine.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\machine\command - "" = F:\goodies\machine\machine.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\setup\command - "" = F:\aocsetup.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\zone\command - "" = F:\goodies\mszone\zonea660.exe -- File not found
O33 - MountPoints2\{f70c0815-05dd-11df-a6ec-b8b9f2bcdc3f}\Shell - "" = AutoRun
O33 - MountPoints2\{f70c0815-05dd-11df-a6ec-b8b9f2bcdc3f}\Shell\AutoRun\command - "" = K:\Windows\CHECK\DriveNavigator.exe -- File not found
O33 - MountPoints2\{f820cbf8-a59f-11dd-bbc9-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f820cbf8-a59f-11dd-bbc9-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Run.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.06 15:54:19 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\*\Desktop\OTL.exe
[2010.11.06 15:50:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\alaplaya
[2010.11.06 15:33:51 | 686,257,826 | ---- | C] (Acresso Software Inc. ) -- C:\Users\*\Desktop\101022_AvalonHeroesEU.exe
[2010.11.06 15:33:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Akamai
[2010.11.03 23:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\BOINC
[2010.11.03 23:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BOINC
[2010.10.31 21:20:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GIMP-2.0
[2010.10.31 10:47:49 | 000,000,000 | ---D | C] -- C:\Users\Destination\Documents\The KMPlayer
[2010.10.31 10:47:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The KMPlayer
[2010.10.27 14:23:17 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2010.10.27 14:23:17 | 001,927,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2010.10.27 14:23:17 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2010.10.27 14:23:17 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Apphlpdm.dll
[2010.10.27 14:23:17 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll
[2010.10.27 14:23:16 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2010.10.15 03:08:13 | 000,000,000 | ---D | C] -- C:\Users\Destination\AppData\Roaming\Neti
[2010.10.13 13:59:52 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msshsq.dll
[2010.10.13 13:59:52 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msshsq.dll
[2010.10.13 13:59:47 | 001,915,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll
[2010.10.13 13:59:44 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll
[2010.10.13 13:59:44 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll
[2010.10.13 13:59:42 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll
[2010.10.13 13:59:41 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll
[2010.10.13 13:59:39 | 001,090,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll
[2010.10.13 13:59:39 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll
[2010.10.13 13:59:38 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll
[2010.10.13 13:59:28 | 013,426,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll
[2010.10.13 13:59:26 | 010,627,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll
[2010.10.13 13:59:24 | 008,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL
[2010.10.13 13:59:24 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL
[2010.10.13 13:58:43 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2010.10.13 13:58:43 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2010.10.13 13:58:42 | 000,758,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2010.10.13 13:58:41 | 000,477,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2010.10.13 13:58:40 | 000,485,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2010.10.13 13:58:40 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2010.10.13 13:58:40 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2010.10.13 13:58:40 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2010.10.13 13:58:40 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.10.13 13:58:40 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.10.13 13:58:40 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieencode.dll
[2010.10.13 13:58:40 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieencode.dll
[2010.10.13 13:58:31 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2010.10.13 13:58:31 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2010.10.13 13:58:31 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sscore.dll
[2010.10.13 13:58:31 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.06 15:54:59 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B1FCFC34-C21F-4BC1-96D0-40D79054FAC8}.job
[2010.11.06 15:54:19 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Destination\Desktop\OTL.exe
[2010.11.06 15:50:34 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\AvalonHeroesEU.lnk
[2010.11.06 15:48:06 | 686,257,826 | ---- | M] (Acresso Software Inc. ) -- C:\Users\*\Desktop\101022_AvalonHeroesEU.exe
[2010.11.06 15:36:02 | 000,000,310 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.11.06 15:34:00 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2799286350-1403585287-1070279313-1000UA.job
[2010.11.06 15:04:02 | 000,000,304 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.11.06 14:32:56 | 001,432,694 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.11.06 14:32:56 | 000,623,042 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.11.06 14:32:56 | 000,591,122 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.11.06 14:32:56 | 000,124,978 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.11.06 14:32:56 | 000,102,996 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.11.06 14:26:37 | 000,004,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.06 14:26:37 | 000,004,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.06 14:26:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.06 01:34:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2799286350-1403585287-1070279313-1000Core.job
[2010.11.05 22:34:41 | 000,002,117 | ---- | M] () -- C:\Users\*\Desktop\Google Chrome.lnk
[2010.11.03 00:17:24 | 000,081,584 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2010.10.31 21:49:05 | 000,002,025 | ---- | M] () -- C:\Users\*\.recently-used.xbel
[2010.10.31 21:21:07 | 000,000,896 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2010.10.31 10:47:20 | 000,000,840 | ---- | M] () -- C:\Users\*\Desktop\KMPlayer.lnk
[2010.10.31 10:43:22 | 000,000,130 | ---- | M] () -- C:\Users\*\AppData\Roaming\default.rss
[2010.10.31 10:40:39 | 000,097,280 | ---- | M] () -- C:\Users\*\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.28 15:26:21 | 428,622,387 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.10.14 14:20:43 | 002,249,024 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.06 15:50:34 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\AvalonHeroesEU.lnk
[2010.11.06 15:34:44 | 000,360,044 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistMSI7FB1.txt
[2010.11.06 15:34:44 | 000,011,202 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistUI7FB1.txt
[2010.10.31 21:49:05 | 000,002,025 | ---- | C] () -- C:\Users\*\.recently-used.xbel
[2010.10.31 21:21:07 | 000,000,896 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2010.10.31 10:47:20 | 000,000,840 | ---- | C] () -- C:\Users\*\Desktop\KMPlayer.lnk
[2010.10.31 10:43:22 | 000,000,130 | ---- | C] () -- C:\Users\*\AppData\Roaming\default.rss
[2010.07.26 13:58:55 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.07.23 23:29:19 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2010.05.27 16:59:45 | 001,448,214 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.01.21 12:23:38 | 000,009,506 | -H-- | C] () -- C:\Windows\UN070618.INI
[2010.01.21 12:22:53 | 000,009,305 | -H-- | C] () -- C:\Windows\UN090430.INI
[2009.12.13 11:17:19 | 000,000,000 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009.09.22 14:57:07 | 000,001,056 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2009.09.13 15:13:47 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2009.08.18 19:08:40 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.08.18 19:08:05 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.22 15:50:42 | 000,000,058 | ---- | C] () -- C:\Users\*\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2009.05.15 13:58:13 | 000,419,812 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistMSI65FE.txt
[2009.05.15 13:58:12 | 000,145,758 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistUI65FE.txt
[2009.04.12 19:53:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.03.27 16:17:20 | 000,000,532 | -H-- | C] () -- C:\Users\*n\AppData\Roaming\vispa.ini
[2009.03.16 16:21:42 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\RagTimeSearch.dll
[2009.02.28 19:17:00 | 000,127,488 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2009.02.28 19:17:00 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2009.02.09 19:56:22 | 000,067,584 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2008.12.07 13:08:06 | 000,795,648 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2008.12.07 13:08:04 | 000,130,048 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2008.09.07 23:57:55 | 000,002,620 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2008.09.07 23:57:55 | 000,000,088 | RHS- | C] () -- C:\ProgramData\A211ADDE53.sys
[2008.08.20 21:04:45 | 000,000,075 | ---- | C] () -- C:\Users\*\AppData\Roaming\default.pls
[2008.08.16 18:50:51 | 000,000,026 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.08.12 20:18:11 | 000,019,684 | ---- | C] () -- C:\Users\*n\AppData\Local\internal.grp
[2008.07.13 00:56:36 | 000,000,388 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2008.04.28 16:52:43 | 000,000,486 | ---- | C] () -- C:\ProgramData\GRFolder.ini
[2008.04.28 16:52:43 | 000,000,028 | ---- | C] () -- C:\ProgramData\GRGames.ini
[2008.04.11 20:40:44 | 001,868,944 | ---- | C] () -- C:\Windows\SysWow64\RSA32_16.DLL
[2008.04.11 20:39:08 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008.04.06 19:36:23 | 000,097,280 | ---- | C] () -- C:\Users\*\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.03.29 07:09:48 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.03.29 06:52:17 | 000,016,098 | ---- | C] () -- C:\Windows\German2.ini
[2008.03.29 05:22:09 | 000,295,028 | ---- | C] () -- C:\Windows\SysWow64\Install6x.dll
[2008.03.29 05:03:39 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2008.03.29 04:28:08 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2008.03.29 04:15:22 | 000,000,732 | ---- | C] () -- C:\Users\*\AppData\Local\d3d9caps64.dat
[2007.12.06 08:53:48 | 000,001,209 | R--- | C] () -- C:\Windows\xfiskcfg.ini
[2007.09.04 11:56:10 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2007.02.05 20:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006.04.21 10:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\HtmlHelp.dll
[1997.06.14 12:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
[U]< End of report >

--- --- ---



Extra Txt:OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 06.11.2010 15:55:45 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\*\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 6138 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 13,34 Gb Free Space | 11,39% Space Free | Partition Type: NTFS
Drive D: | 117,19 Gb Total Space | 88,19 Gb Free Space | 75,26% Space Free | Partition Type: NTFS
Drive E: | 231,38 Gb Total Space | 208,67 Gb Free Space | 90,18% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 0F A7 DD 32 A2 D3 C8 01 [binary data]
"VistaSp2" = 07 2A 6C 45 32 20 CA 01 [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5D518AF4-DAEC-459D-B3B5-8248C9547B82}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{9AB882CF-12F2-4AE6-A271-D5995A549379}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E74BACFF-8443-4F52-8B55-D262AFCFD89A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{EBE0B715-A207-4CCA-AB8C-226D730D7D27}" = lport=51761 | protocol=6 | dir=in | name=akamai netsession interface | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{19C5BA7C-7C9D-48F1-BDF6-88039B2BABB2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{58B42055-E167-4CEB-A47B-8E7B044CE5F0}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{73F15264-B524-4FD2-B476-B4651EA0E61C}" = dir=in | app=c:\program files (x86)\windows live\messenger\livecall.exe | 
"{9096F57F-3689-4830-A3EA-B9EF1BC6272A}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{A024A855-56E5-4A9F-BC34-6612C54966AD}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{C2CBF6D3-100F-4793-B02A-1D3DBA368DEA}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{D01ADD1C-B3EF-4838-8C5A-0A4C9C9B0774}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F1C50BD4-82AC-449C-961B-16257E801CC0}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F39A293B-AF1C-45CB-857A-347575CA1F13}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"TCP Query User{0AAC4F41-CD44-46BC-8A39-E6241B05975D}C:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"TCP Query User{0DA5ABE1-7006-45D2-970E-329ED20CDDB9}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"TCP Query User{133E6721-8BE0-4ADC-9C67-E68087ED39A2}D:\ageofempires\empires2.icd" = protocol=6 | dir=in | app=d:\ageofempires\empires2.icd | 
"TCP Query User{1393886A-4624-4ECB-AB90-E430E1BCB1A6}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"TCP Query User{1B1E4AF0-CC6B-4C80-BF5B-BE8A7EC4236A}C:\program files (x86)\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"TCP Query User{37CC4674-0871-466A-915D-02332D508C14}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"TCP Query User{3AC9AC8B-ED87-4729-849D-AC0A4A8DDBF8}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"TCP Query User{478C1426-5F17-4623-B333-2C3448281AC1}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 
"TCP Query User{512D6662-BDE6-4657-AF4C-0E107A3AACFA}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"TCP Query User{5B20D1D3-3C6A-4055-AB43-E41FE5BB2FF4}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"TCP Query User{66731C37-61AA-478B-8E79-F22F152D12C5}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"TCP Query User{73A6E86E-59C2-4CCE-BEE3-0943B7BF6919}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"TCP Query User{82A4C78D-4B48-495C-9996-6A601B8767C0}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"TCP Query User{8A63C899-8C96-43C8-83D8-78FAFF33A741}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"TCP Query User{9308E9EF-4F73-42A2-A478-1FDCE0637D9E}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{9946101F-A31B-4F88-8186-0B1701DB5E5F}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"TCP Query User{99E52062-3F6A-473A-A8D6-D8CB17209D83}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"TCP Query User{A4FA6FC8-DEE4-4549-9AFA-ED1C853AE097}D:\ageofempires\empires2.icd" = protocol=6 | dir=in | app=d:\ageofempires\empires2.icd | 
"TCP Query User{B923B75A-5181-48B3-8D0E-ADEBB22BFBD1}C:\casino\casino-club deutsch\casino.exe" = protocol=6 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"TCP Query User{CA7E3F50-483A-49DB-8640-41F1886F8DEA}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 
"TCP Query User{D4AE5C12-389D-4F76-8340-00596802FE02}C:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe | 
"TCP Query User{E8004BEF-99AB-407E-B06F-5D831D02C817}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{EC6B0BF7-6800-45CE-928B-A67EB522BF0C}C:\casino\casino-club deutsch\casino.exe" = protocol=6 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"TCP Query User{F45D4612-76E1-448D-B42A-0CE72B45E05D}C:\program files (x86)\tv\tv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tv\tv.exe | 
"UDP Query User{14A349A0-7A23-4EF1-919B-63035A22B7AE}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"UDP Query User{158124A5-2238-4192-8CF6-A238D2DA41D5}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"UDP Query User{1B3A05B2-69F8-44E0-B6DD-EDE430D585F8}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"UDP Query User{251ACD28-5D28-42D3-8E03-9821AA3F5A42}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"UDP Query User{482878E5-70AE-48FD-94BE-B5C7A61D3F54}D:\ageofempires\empires2.icd" = protocol=17 | dir=in | app=d:\ageofempires\empires2.icd | 
"UDP Query User{55CB546C-AA80-486B-B482-53CFFEA484BD}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"UDP Query User{60607505-5DA6-4BF0-8824-B46AEFF16B0B}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"UDP Query User{63CD4C7C-AE04-4ACD-BCDE-435375D7B086}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{6ECFF6A9-92B3-4C5A-A121-D900D078E58A}C:\program files (x86)\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"UDP Query User{6FEA2B6B-E19D-4717-A818-52D320B9CAA2}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"UDP Query User{74C5769B-E913-4C50-9D00-67C35DF2BA8A}C:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{9C98250C-C909-4B86-A6B2-13D9BBEBD156}C:\casino\casino-club deutsch\casino.exe" = protocol=17 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"UDP Query User{A70DD689-49AB-4E3B-BEBA-0A7E81BF59B2}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"UDP Query User{AB56C72A-C7D4-4682-A0CB-CDFC7A987168}C:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe | 
"UDP Query User{B10B61BD-3323-4B4D-BACA-D05FDE2AAC98}D:\ageofempires\empires2.icd" = protocol=17 | dir=in | app=d:\ageofempires\empires2.icd | 
"UDP Query User{B3EABC40-9631-4CD2-9E42-F5A493AD08A6}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"UDP Query User{CE4395EC-D6FD-4F5E-87B8-4E2928A2748B}C:\program files (x86)\tv\tv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tv\tv.exe | 
"UDP Query User{D5E17357-B0B7-4320-BD7E-37AEDAB75329}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 
"UDP Query User{DA77EB6A-CFD9-4914-A4D1-999770487183}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"UDP Query User{DE1162CD-25F4-43E5-8716-EC6B8EBACB78}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"UDP Query User{DF991D98-9E8E-486F-B3CE-AAB3C507B3DF}C:\casino\casino-club deutsch\casino.exe" = protocol=17 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"UDP Query User{E9B59C77-D4E5-4A8F-B1C2-91DE98BFD6A7}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 
"UDP Query User{EB349035-1174-4249-93C5-0C67186516F8}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"UDP Query User{F0B78BA3-7883-4A7C-86C6-B2127940D058}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series" = Canon MP620 series MP Drivers
"{4575935D-9457-4517-8750-2341F4286F5F}" = iTunes
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{52784483-7088-4A4C-81E2-808303AD98F5}" = Apple Mobile Device Support
"{53480120-0D50-4084-A168-E87F11EB3BF6}" = O&O DiskRecovery
"{7F05E704-30A6-421A-97A7-8EEB1C7FF011}" = Corel Shell Extension - 64Bit
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D7829DCF-B68F-4A8A-A368-992D37DFA4C1}" = Systemsteuerung "MobileMe"
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3
"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW(R) Graphics Suite X4
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00B93E18-7F40-4DA9-8156-8340936DCD2F}" = Yu-Gi-Oh! ONLINE 2
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09C468CA-2940-466A-AAE8-DCC0C6E9323C}" = Nokia Software Updater
"{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1A0B8239-664B-434A-99D8-C50793513249}" = Audials TV
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool
"{212D202D-487D-49C4-8A76-4D3BB91B8471}" = BOINC
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 19
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{29F05234-DCBB-4FE0-88DC-5160C9250312}" = Adobe Photoshop CS3
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{3C3AB164-964F-419D-A688-810E728B9D7D}" = GalleryImages
"{3EE1008C-11A1-4F4F-8DB7-27573924DE78}" = DMIView B06.1227.01
"{3FF55F91-4296-46D0-B045-1429CD46AF99}" = Adobe Setup
"{41DF6AB7-4F89-478D-8501-D81A7A975D35}" = SP2GalleryImages
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3
"{4E47844E-4A18-454B-A977-EC2CCF3F1472}" = X2 - Die Bedrohung (V1.4)
"{4F2EF73A-02E9-4D10-B73A-6FF68B5F0862}" = TAXMAN 2010 Computerbild Edition
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5869CE1E-BC0B-4648-B1AE-6EF4A985590C}" = Dynamic Energy Saver 1.0 B8.0128.1
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{59624372-3B85-47f4-9B04-4911E551DF1E}" = Lexware Info Service
"{5B3A354B-C059-4861-A85B-CA46F1089E15}" = Creative USB Headsets
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{66FF4C48-0083-4E60-8556-B883AB200091}" = Heroes of Might & Magic V: Hammers of Fate
"{66FF4C48-0083-4E60-8556-B883AB200092}" = Heroes of Might and Magic V - Tribes of the East
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7D386596-0E80-4808-8AAE-C1DDA8212F7F}" = Adobe Setup
"{7EB0C45E-3514-4332-BE49-784C0FEB8C58}" = AOL Download Assistent
"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA
"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture
"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw
"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP
"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content
"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters
"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{878B631B-E0F9-41B9-83D9-BC9DFB0B9F2B}" = Ebad
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{989112B0-74DB-4A40-932F-580049CD0B97}" = Visual Basic for Applications (R) Core - German
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A5154441-DAF4-49A6-BFEE-DE9B1928DEF0}" = Realtek Ethernet Teaming and VLAN Utility for Windows Vista
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS 
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications (R) Core - English
"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA
"{C1080852-065E-4991-9260-F3756E3CC182}" = CursorFX
"{c7e96372-fc16-4d84-aa52-80aba026d668}" = Nero 9 Essentials
"{C9D456FD-C25B-49DE-AA71-6B76D6550B23}" = Adobe Fireworks CS3
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0
"{D299837D-74C1-41A9-8783-966610A9BED7}" = Preispiraten
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications (R) Core
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{DCD22647-6D31-479D-8F97-16D0AA934D9E}" = PC Connectivity Solution
"{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1" = John's Background Switcher 3.6
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E117043B-5227-47E9-AC4C-BFB792D5820F}" = Yu-Gi-Oh! ONLINE 3
"{E285F3B1-A840-414F-9A95-47627A16E633}" = AvalonHeroesEU
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E76FCE6B-9999-4250-8C75-B2DA4AD41268}" = Face_Wizard B07.1219.01
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}" = Adobe Setup
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{F1A14CB2-A048-45A6-AFDA-3571296E1D76}" = Creative Media Toolbox 6
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Ralink Wireless LAN Card
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"aborange VertippTop_is1" = aborange VertippTop - Deinstallation
"Ace DivX Player_is1" = Ace DivX Player v2.1
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_25db75244653b42cb93dc27939d1c0e" = Adobe Dreamweaver CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_5f143314a5d434c8511097393d17397" = Adobe Photoshop CS3
"Adobe_6c7ed6c08f4acf68bf0512885eec384" = Adobe Fireworks CS3
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Age of Empires 2.0" = Microsoft Age of Empires II
"Akamai" = Akamai NetSession Interface
"ALchemy X-Fi" = Creative ALchemy (X-Fi Edition)
"A-Shop" = Dailsley A-Shop
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Premium
"Canon MP620 series Benutzerregistrierung" = Canon MP620 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Inkjet Printer/Scanner Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Casino Club Poker" = Casino Club Poker
"CASINO-CLUB Deutsch" = CASINO-CLUB Deutsch
"CDCoverEasyLayout" = CDCover! - Einfach Drucken
"City Life" = City Life
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"CursorFX" = CursorFX
"Direct MIDI to MP3 Converter_is1" = Direct MIDI to MP3 Converter Version 6.1.2.43
"DRI Tool 2.0_is1" = DRI Tool 2.0
"DVD Flick_is1" = DVD Flick
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"EasyTune5Pro" = EasyTune5Pro
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.50
"Fast MP3 Cutter Joiner" = Fast MP3 Cutter Joiner 2.6 build 1198
"FileZilla Client" = FileZilla Client 3.2.4.1
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free DVD Video Burner_is1" = Free DVD Video Burner version 1.1
"Free Studio_is1" = Free Studio version 4.2
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 1.1
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.1
"Free YouTube Download_is1" = Free YouTube Download 2.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Google Updater" = Google Updater
"Inkscape" = Inkscape 0.46
"InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3
"InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"KompoZer_is1" = KompoZer 0.77
"Lauge_is1" = Lauge 2.23
"Live-Player" = Live-Player
"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)
"MAGIX Fotos auf CD & DVD 9 D" = MAGIX Fotos auf CD & DVD 9 9.0.1.16 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Speed burnR D" = MAGIX Speed burnR
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"mp3-2-wav" = mp3-2-wav converter 1.14
"NCH Toolbar" = NCH Toolbar
"PartyCasino" = PartyCasino
"PartyPoker" = PartyPoker
"PhotoClean Express" = Shortcut PhotoClean Express
"PreisHai_is1" = PreisHai 4.1
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Rainlendar2" = Rainlendar2 (remove only)
"ScreenshotCaptor_is1" = Screenshot Captor 2.56.01
"Supreme Auction_is1" = Supreme Auction
"SysInfo" = Creative Systeminformationen
"The KMPlayer" = The KMPlayer (remove only)
"TrueCrypt" = TrueCrypt
"TV" = TV
"TVISTA - Tuning Vista_is1" = DATA BECKER TVISTA - Tuning Vista
"UK's Kalender_is1" = UK's Kalender 2.2.1
"UN070618" = BUFFALO TurboUSB for FLASH/HDD
"UN090430" = BUFFALO SecureLockManagerEasy for HD
"UnderCoverXP_is1" = UnderCoverXP 1.08
"Uninstall_is1" = Uninstall 1.0.0.1
"Uninstaller_B4736000_Creative Media Toolbox 6" = Creative Media Toolbox 6 (Shared Components)
"UniversalPlayer" = Universal Player
"Vista Icon Pack ST_is1" = Vista Icon Pack ST
"WavePad" = WavePad Sound Editor
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR
"XMedia Recode" = XMedia Recode 2.0.8.3
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"eBay Shortcuts" = eBay Shortcuts
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---
Alt 06.11.2010, 16:39   #2
markusg
/// Malware-holic
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


hi, es gibt kein programm welches 100 % erkennungsrate bietet, da muss man als user selbst mit hand anlegen.
poste otl logs nach folgenden angaben.

ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide logs posten.
__________________

__________________
Alt 08.11.2010, 17:11   #3
Blacky64
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


Hallo Markusg

Danke für die schnelle Antwort.
Eine Frage noch..ist das die generelle Vorgehensweise
oder variiert das ganze zwischen den Unterschiedlichen Systemen?
Hier die Log's:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 08.11.2010 16:36:16 - Run 2
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\*\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 6138 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 14,12 Gb Free Space | 12,05% Space Free | Partition Type: NTFS
Drive D: | 117,19 Gb Total Space | 88,20 Gb Free Space | 75,26% Space Free | Partition Type: NTFS
Drive E: | 231,38 Gb Total Space | 208,67 Gb Free Space | 90,18% Space Free | Partition Type: NTFS
 
Computer Name: OUTLAND | User Name: * | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Destination\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Destination\AppData\Roaming\Neti\qyiz.exe (Online Solutions)
PRC - C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\BOINC\boinc.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\BUFFALO\SLManagerEasy\Inputps.exe (BUFFALO INC.)
PRC - C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe (BUFFALO INC.)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
PRC - C:\Program Files (x86)\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
PRC - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Windows\SysWOW64\PSIService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\*\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Akamai) -- C:/Program Files (x86)/Common Files/Akamai/netsession_win_062a651.dll ()
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (Bufssvr) -- C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe (BUFFALO INC.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative Media Toolbox 6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs)
SRV - (Creative ALchemy AL1 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (Creative HOAL Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTHOALLicensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
SRV - (GEST Service) -- C:\Program Files (x86)\GIGABYTE\GEST\GSvr.exe ()
SRV - (PSI_SVC_2) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (ProtexisLicensing) -- C:\Windows\SysWOW64\PSIService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (netr7364) -- C:\Windows\SysNative\DRIVERS\netr7364.sys File not found
DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (ASPI) -- C:\Windows\SysNative\DRIVERS\ASPI32.sys File not found
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\DRIVERS\avipbb.sys (Avira GmbH)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\DRIVERS\usbser_lowerfltx64j.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\DRIVERS\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdcx64) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcdx64) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia)
DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia)
DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (btusb64h) -- C:\Windows\SysNative\drivers\btusb64h.sys (BUFFALO INC.)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\DRIVERS\usbser.sys (Microsoft Corporation)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys ()
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (skfiltv) -- C:\Windows\SysNative\drivers\skfiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (acedrv10) -- C:\Windows\SysNative\drivers\acedrv10.sys (Protect Software GmbH)
DRV:64bit: - (acehlp10) -- C:\Windows\SysNative\drivers\acehlp10.sys (Protect Software GmbH)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation                                            )
DRV:64bit: - (TEAM) Realtek Virtual Miniport Driver for Teaming (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTTEAMPT) Realtek Teaming Protocol Driver (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTVLANPT) Realtek Vlan Protocol Driver (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtVlan60.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV:64bit: - (rt61x64) -- C:\Windows\SysNative\DRIVERS\netr6164.sys (Ralink Technology Inc.)
DRV:64bit: - (RT61) -- C:\Windows\SysNative\DRIVERS\RT61.sys (Ralink Technology Inc.)
DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (ET5Drv) -- C:\Windows\ET5Drv.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (RT61) -- C:\Windows\SysWOW64\drivers\rt61.sys (Ralink Technology Inc.)
DRV - (ASPI) -- C:\Windows\SysWOW64\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,MenuText = eBay.de
IE - HKLM\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Ask"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.6
FF - prefs.js..extensions.enabledItems: {EC1B67CA-A2CD-4931-915A-63D5341D1285}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {144D1513-0819-4538-AD26-D515AF443AE7}:1.1.0.1
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.9.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.0.4
FF - prefs.js..extensions.enabledItems: {B1FC0AB8-EEDC-451A-9185-A0D5E308BBDD}:1.0.0.8
FF - prefs.js..extensions.enabledItems: {4B4D630E-AAE2-4EA9-A0CB-5F045AAF2EC2}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {7A7EF87E-95DB-4A84-83E8-E0FE7B20017F}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {89506680-e3f4-484c-a2c0-ed711d481eda}:0.9.5
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:3.3.7
FF - prefs.js..extensions.enabledItems: {3F4D6A2C-841D-403C-8CD8-48E54192DDEB}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.0.1
FF - prefs.js..extensions.enabledItems: {da7f40f0-8675-11db-b606-0800200c9a66}:3.01
FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20090117
FF - prefs.js..keyword.URL: "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.31 20:36:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.10.31 20:36:03 | 000,000,000 | ---D | M]
 
[2008.08.28 06:54:15 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Extensions
[2010.10.02 11:56:08 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions
[2008.08.28 07:16:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2009.01.05 23:12:20 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2008.08.28 06:54:46 | 000,000,000 | ---D | M] (Aero Fox) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2008.12.11 16:24:37 | 000,000,000 | ---D | M] (Firefox Showcase) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda}
[2010.10.02 11:56:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2008.09.17 02:47:37 | 000,000,000 | ---D | M] (FOXSCAPE) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{da7f40f0-8675-11db-b606-0800200c9a66}
[2008.12.10 19:03:06 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009.01.21 18:48:20 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\nasanightlaunch@example.com
[2008.12.24 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com
[2008.12.24 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com-trash
[2010.03.30 23:07:01 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2008.09.20 16:52:23 | 000,000,000 | ---D | M] (Amazon Startcenter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{144D1513-0819-4538-AD26-D515AF443AE7}
[2008.09.20 16:52:24 | 000,000,000 | ---D | M] (Google Kontextmen&#252;) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB}
[2008.09.20 16:52:23 | 000,000,000 | ---D | M] (eBay-Kontextmen&#252;) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{4B4D630E-AAE2-4EA9-A0CB-5F045AAF2EC2}
[2008.09.20 16:52:22 | 000,000,000 | ---D | M] (eBay-Startcenter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{7A7EF87E-95DB-4A84-83E8-E0FE7B20017F}
[2008.09.20 16:52:20 | 000,000,000 | ---D | M] (eBay Statusbar Button) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{B1FC0AB8-EEDC-451A-9185-A0D5E308BBDD}
[2008.09.20 16:52:25 | 000,000,000 | ---D | M] (Preispiraten) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C}
[2008.09.20 16:52:24 | 000,000,000 | ---D | M] (Amazon Kontextmen&#252;) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{EC1B67CA-A2CD-4931-915A-63D5341D1285}
[2009.09.04 17:12:06 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions\ashopffx@a-shop.com
[2010.10.31 20:36:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.31 20:36:01 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.31 20:36:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.31 20:36:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.31 20:36:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O2 - BHO: (amazon) - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\Program Files (x86)\Preispiraten\IEButtonAmazonInterface.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll (Google Inc.)
O2 - BHO: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O2 - BHO: (eBay) - {CD9B7762-DFBC-42B1-BB30-02A78287B456} - C:\Program Files (x86)\Preispiraten\IEButtonEbayInterface.dll ()
O2 - BHO: (Preispiraten) - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\Program Files (x86)\Preispiraten\IEButtonPPInterface.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\..\Toolbar\WebBrowser: (NCH Toolbar) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvSvc] C:\Windows\SysNative\nvsvc64.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [boincmgr] C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000..\Run: [{E7E6456B-F161-1299-E5E2-9E9A5B5CF4C2}] C:\Users\Destination\AppData\Roaming\Neti\qyiz.exe (Online Solutions)
O4 - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten\\preispiraten.html ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Destination\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten\\preispiraten.html ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Destination\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten\preispiraten3ie.exe ()
O9 - Extra 'Tools' menuitem : Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten\preispiraten3ie.exe ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} -  File not found
O9 - Extra 'Tools' menuitem : Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} -  File not found
O9 - Extra Button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: eBay - {E79005A3-0F92-434B-9F7B-51131FC7168F} -  File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Destination\Pictures\Hintergrund\darkness_2560x1600.jpg
O24 - Desktop BackupWallPaper: C:\Users\Destination\Pictures\Hintergrund\darkness_2560x1600.jpg
O32 - HKLM CDRom: AutoRun - 0
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\adobe\command - "" = F:\goodies\ar405deu.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\aocsetup.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\log\command - "" = F:\goodies\machine\machine.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\machine\command - "" = F:\goodies\machine\machine.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\setup\command - "" = F:\aocsetup.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\zone\command - "" = F:\goodies\mszone\zonea660.exe -- File not found
O33 - MountPoints2\{f4a08542-1946-11dd-8f5f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f4a08542-1946-11dd-8f5f-806e6f6e6963}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found
O33 - MountPoints2\{f70c0815-05dd-11df-a6ec-b8b9f2bcdc3f}\Shell - "" = AutoRun
O33 - MountPoints2\{f70c0815-05dd-11df-a6ec-b8b9f2bcdc3f}\Shell\AutoRun\command - "" = K:\Windows\CHECK\DriveNavigator.exe -- File not found
O33 - MountPoints2\{f820cbf8-a59f-11dd-bbc9-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f820cbf8-a59f-11dd-bbc9-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Run.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^Users^Destination^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk - C:\PROGRA~2\OPENOF~1.4\program\QUICKS~1.EXE - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Destination^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: A-Shop - hkey= - key= - C:\Program Files (x86)\A-Shop\A-Shop.exe (Dailsley Limited)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: CanonMyPrinter - hkey= - key= - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
MsConfig:64bit - StartUpReg: CanonSolutionMenu - hkey= - key= - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
MsConfig:64bit - StartUpReg: Corel File Shell Monitor - hkey= - key= - C:\Program Files (x86)\Corel\Corel MediaOne\CorelIOMonitor.exe File not found
MsConfig:64bit - StartUpReg: Corel Photo Downloader - hkey= - key= - C:\Program Files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe File not found
MsConfig:64bit - StartUpReg: EasyTuneVPro - hkey= - key= - C:\Program Files (x86)\Gigabyte\ET5Pro\ETcall.exe ()
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Destination\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: ICQ - hkey= - key= - C:\Program Files (x86)\ICQ6\ICQ.exe File not found
MsConfig:64bit - StartUpReg: IJNetworkScanUtility - hkey= - key= - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (CANON INC.)
MsConfig:64bit - StartUpReg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: jnjnj - hkey= - key= - c:\users\destination\appdata\local\jnjnj.exe File not found
MsConfig:64bit - StartUpReg: Kalender - hkey= - key= - C:\Program Files (x86)\Kalender\Kalender.exe (Ulrich Krebs)
MsConfig:64bit - StartUpReg: LexwareInfoService - hkey= - key= - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Lexware GmbH & Co. KG)
MsConfig:64bit - StartUpReg: MS AntiSpyware 2009 - hkey= - key= - C:\ProgramData\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe File not found
MsConfig:64bit - StartUpReg: MsnMsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe File not found
MsConfig:64bit - StartUpReg: NapsterShell - hkey= - key= - C:\Program Files (x86)\Napster\napster.exe File not found
MsConfig:64bit - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe File not found
MsConfig:64bit - StartUpReg: NokiaMServer - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: NokiaMusic FastStart - hkey= - key= - C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe File not found
MsConfig:64bit - StartUpReg: NokiaOviSuite2 - hkey= - key= - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe File not found
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig:64bit - StartUpReg: Ulead AutoDetector v2 - hkey= - key= - C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe (Ulead Systems, Inc.)
MsConfig:64bit - StartUpReg: Ulead Memory Card Detector - hkey= - key= - C:\Program Files (x86)\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe File not found
MsConfig:64bit - StartUpReg: VolPanel - hkey= - key= - C:\Program Files (x86)\Creative\USB Headsets\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe ()
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: WudfPf - Driver
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {0E699A53-7B0C-F822-774F-DB1437A9E4D0} - Microsoft Windows Media Player
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {526CED71-B8C8-F163-6061-1D37F87F5908} - Microsoft VM
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {BC388F63-628B-1303-70BA-1991DB4F2AF8} - Microsoft Windows Media Player
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CE57425B-CB74-5F5A-130A-146C92385DA7} - Internet Explorer
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {D7043845-7610-D38D-A0EA-55DDE44AD7EC} - Microsoft Windows Media Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.divxa32 - C:\Windows\SysWow64\divxa32.acm (Kristal StudioDFileDescription)
Drivers32: msacm.iac2 - C:\Windows\SysWOW64\iac25_32.ax (Intel Corporation)
Drivers32: msacm.sl_anet - C:\Windows\SysWow64\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\SysWow64\i420vfw.dll (www.helixcommunity.org)
Drivers32: VIDC.IV41 - C:\Windows\SysWow64\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.06 17:00:09 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\My Games
[2010.11.06 15:54:19 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\*\Desktop\OTL.exe
[2010.11.06 15:50:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\alaplaya
[2010.11.06 15:33:51 | 686,257,826 | ---- | C] (Acresso Software Inc.                                        ) -- C:\Users\Destination\Desktop\101022_AvalonHeroesEU.exe
[2010.11.06 15:33:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Akamai
[2010.11.03 23:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\BOINC
[2010.11.03 23:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BOINC
[2010.10.31 21:20:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GIMP-2.0
[2010.10.31 10:47:49 | 000,000,000 | ---D | C] -- C:\Users\Destination\Documents\The KMPlayer
[2010.10.31 10:47:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The KMPlayer
[2010.10.27 14:23:17 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2010.10.27 14:23:17 | 001,927,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2010.10.27 14:23:17 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2010.10.27 14:23:17 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Apphlpdm.dll
[2010.10.27 14:23:17 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll
[2010.10.27 14:23:16 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2010.10.15 03:08:13 | 000,000,000 | ---D | C] -- C:\Users\Destination\AppData\Roaming\Neti
[2010.10.13 13:59:52 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msshsq.dll
[2010.10.13 13:59:52 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msshsq.dll
[2010.10.13 13:59:47 | 001,915,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll
[2010.10.13 13:59:44 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll
[2010.10.13 13:59:44 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll
[2010.10.13 13:59:42 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll
[2010.10.13 13:59:41 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll
[2010.10.13 13:59:39 | 001,090,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll
[2010.10.13 13:59:39 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll
[2010.10.13 13:59:38 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll
[2010.10.13 13:59:28 | 013,426,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll
[2010.10.13 13:59:26 | 010,627,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll
[2010.10.13 13:59:24 | 008,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL
[2010.10.13 13:59:24 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL
[2010.10.13 13:58:43 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2010.10.13 13:58:43 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2010.10.13 13:58:42 | 000,758,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2010.10.13 13:58:41 | 000,477,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2010.10.13 13:58:40 | 000,485,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2010.10.13 13:58:40 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2010.10.13 13:58:40 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2010.10.13 13:58:40 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2010.10.13 13:58:40 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.10.13 13:58:40 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.10.13 13:58:40 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieencode.dll
[2010.10.13 13:58:40 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieencode.dll
[2010.10.13 13:58:31 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2010.10.13 13:58:31 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2010.10.13 13:58:31 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sscore.dll
[2010.10.13 13:58:31 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.08 16:36:02 | 000,000,310 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.11.08 16:35:00 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B1FCFC34-C21F-4BC1-96D0-40D79054FAC8}.job
[2010.11.08 16:34:00 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2799286350-1403585287-1070279313-1000UA.job
[2010.11.08 16:21:33 | 001,432,694 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.11.08 16:21:33 | 000,623,042 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.11.08 16:21:33 | 000,591,122 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.11.08 16:21:33 | 000,124,978 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.11.08 16:21:33 | 000,102,996 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.11.08 16:15:27 | 000,000,304 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.11.08 16:15:22 | 000,004,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.08 16:15:22 | 000,004,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.08 16:15:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.06 23:04:53 | 002,249,024 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.11.06 15:54:19 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\*\Desktop\OTL.exe
[2010.11.06 15:48:06 | 686,257,826 | ---- | M] (Acresso Software Inc.                                        ) -- C:\Users\Destination\Desktop\101022_AvalonHeroesEU.exe
[2010.11.06 01:34:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2799286350-1403585287-1070279313-1000Core.job
[2010.11.05 22:34:41 | 000,002,117 | ---- | M] () -- C:\Users\*\Desktop\Google Chrome.lnk
[2010.11.03 00:17:24 | 000,081,584 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2010.10.31 21:49:05 | 000,002,025 | ---- | M] () -- C:\Users\*\.recently-used.xbel
[2010.10.31 21:21:07 | 000,000,896 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2010.10.31 10:47:20 | 000,000,840 | ---- | M] () -- C:\Users\*\Desktop\KMPlayer.lnk
[2010.10.31 10:43:22 | 000,000,130 | ---- | M] () -- C:\Users\*\AppData\Roaming\default.rss
[2010.10.31 10:40:39 | 000,097,280 | ---- | M] () -- C:\Users\*\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.28 15:26:21 | 428,622,387 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.06 15:34:44 | 000,360,044 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistMSI7FB1.txt
[2010.11.06 15:34:44 | 000,011,202 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistUI7FB1.txt
[2010.10.31 21:49:05 | 000,002,025 | ---- | C] () -- C:\Users\*\.recently-used.xbel
[2010.10.31 21:21:07 | 000,000,896 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2010.10.31 10:47:20 | 000,000,840 | ---- | C] () -- C:\Users\*\Desktop\KMPlayer.lnk
[2010.10.31 10:43:22 | 000,000,130 | ---- | C] () -- C:\Users\*\AppData\Roaming\default.rss
[2010.07.26 13:58:55 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.07.23 23:29:19 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2010.05.27 16:59:45 | 001,448,214 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.01.21 12:23:38 | 000,009,506 | -H-- | C] () -- C:\Windows\UN070618.INI
[2010.01.21 12:22:53 | 000,009,305 | -H-- | C] () -- C:\Windows\UN090430.INI
[2009.12.13 11:17:19 | 000,000,000 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009.09.22 14:57:07 | 000,001,056 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2009.09.13 15:13:47 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2009.08.18 19:08:40 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.08.18 19:08:05 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.22 15:50:42 | 000,000,058 | ---- | C] () -- C:\Users\*\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2009.05.15 13:58:13 | 000,419,812 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistMSI65FE.txt
[2009.05.15 13:58:12 | 000,145,758 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistUI65FE.txt
[2009.04.12 19:53:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.03.27 16:17:20 | 000,000,532 | -H-- | C] () -- C:\Users\*\AppData\Roaming\vispa.ini
[2009.03.16 16:21:42 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\RagTimeSearch.dll
[2009.02.28 19:17:00 | 000,127,488 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2009.02.28 19:17:00 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2009.02.09 19:56:22 | 000,067,584 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2008.12.07 13:08:06 | 000,795,648 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2008.12.07 13:08:04 | 000,130,048 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2008.09.07 23:57:55 | 000,002,620 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2008.09.07 23:57:55 | 000,000,088 | RHS- | C] () -- C:\ProgramData\A211ADDE53.sys
[2008.08.20 21:04:45 | 000,000,075 | ---- | C] () -- C:\Users\*\AppData\Roaming\default.pls
[2008.08.16 18:50:51 | 000,000,026 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.08.12 20:18:11 | 000,019,684 | ---- | C] () -- C:\Users\*\AppData\Local\internal.grp
[2008.07.13 00:56:36 | 000,000,388 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2008.04.28 16:52:43 | 000,000,486 | ---- | C] () -- C:\ProgramData\GRFolder.ini
[2008.04.28 16:52:43 | 000,000,028 | ---- | C] () -- C:\ProgramData\GRGames.ini
[2008.04.11 20:40:44 | 001,868,944 | ---- | C] () -- C:\Windows\SysWow64\RSA32_16.DLL
[2008.04.11 20:39:08 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008.04.06 19:36:23 | 000,097,280 | ---- | C] () -- C:\Users\*\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.03.29 07:09:48 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.03.29 06:52:17 | 000,016,098 | ---- | C] () -- C:\Windows\German2.ini
[2008.03.29 05:22:09 | 000,295,028 | ---- | C] () -- C:\Windows\SysWow64\Install6x.dll
[2008.03.29 05:03:39 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2008.03.29 04:28:08 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2008.03.29 04:15:22 | 000,000,732 | ---- | C] () -- C:\Users\*\AppData\Local\d3d9caps64.dat
[2007.12.06 08:53:48 | 000,001,209 | R--- | C] () -- C:\Windows\xfiskcfg.ini
[2007.09.04 11:56:10 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2007.02.05 20:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006.04.21 10:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\HtmlHelp.dll
[1997.06.14 12:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
========== LOP Check ==========
 
[2009.09.04 17:12:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\A-Shop
[2008.09.20 17:04:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\aborange VertippTop
[2009.11.12 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Canon
[2008.08.28 21:15:28 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Cornelsen
[2009.01.17 13:49:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DeepBurner
[2008.09.23 14:09:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Desktopicon
[2009.06.22 15:50:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DonationCoder
[2010.10.02 11:56:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.01 16:49:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Egurik
[2010.11.08 16:33:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Fetyl
[2009.12.13 20:50:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\FileZilla
[2008.07.03 13:06:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GetRight
[2008.04.28 16:52:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GetRightToGo
[2010.10.31 21:49:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\gtk-2.0
[2009.08.11 22:48:18 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\ICQ
[2010.07.12 13:49:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\IN-MEDIAKG
[2009.07.04 13:29:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Inkscape
[2010.10.03 14:00:01 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Izando
[2009.05.23 16:27:37 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\johnsadventures.com
[2008.10.04 17:10:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\KompoZer
[2010.08.20 14:48:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Laerf
[2010.07.31 14:17:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Leuvaf
[2010.02.19 16:17:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Lexware
[2010.07.23 23:33:59 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MAGIX
[2008.09.20 16:59:15 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\metaspinner net GmbH
[2010.07.12 13:49:23 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\mresreg
[2010.11.06 17:00:09 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\My Games
[2010.03.12 14:37:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\NCH Swift Sound
[2010.10.15 03:08:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Neti
[2010.05.27 17:23:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Nokia
[2010.05.27 17:23:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Nokia Ovi Suite
[2010.08.01 16:49:52 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Obte
[2008.05.03 22:51:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Odtu
[2010.02.05 13:57:53 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\OpenOffice.org
[2010.02.07 10:19:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Otebma
[2010.08.18 20:38:55 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Oxim
[2010.05.27 17:22:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\PC Suite
[2008.09.22 19:08:12 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\PreisHai4
[2009.03.23 18:38:18 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\ProtectDisc
[2010.08.01 16:49:16 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Qiep
[2009.10.16 08:14:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Qyciro
[2010.02.18 19:58:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\RagTime
[2008.09.02 17:56:19 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Scalabium
[2010.03.07 20:45:27 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Scribus
[2008.09.25 18:36:22 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Supreme Auction
[2008.12.03 20:23:52 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TrueCrypt
[2009.05.10 11:38:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TuneUp Software
[2008.07.13 15:53:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\UK's Kalender
[2009.09.22 14:50:55 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Ulead Systems
[2010.08.20 13:18:56 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Upydew
[2010.08.20 14:48:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Utidxe
[2008.05.11 17:19:59 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\WebCompiler3
[2010.10.22 21:12:43 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Xupay
[2010.07.31 18:42:50 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Ydyrno
[2010.10.22 20:46:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Yroloh
[2010.10.03 11:47:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Yxsy
[2008.11.29 02:15:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Zylom
[2010.11.07 21:33:26 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.11.08 16:35:00 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{B1FCFC34-C21F-4BC1-96D0-40D79054FAC8}.job
[2010.11.08 16:36:02 | 000,000,310 | -H-- | M] () -- C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.11.08 16:15:27 | 000,000,304 | -H-- | M] () -- C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.09.04 17:12:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\A-Shop
[2008.09.20 17:04:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\aborange VertippTop
[2010.08.26 19:51:56 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Adobe
[2008.03.29 06:37:25 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\AdobeUM
[2008.08.11 05:34:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Apple Computer
[2009.07.03 21:19:27 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Avira
[2009.11.12 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Canon
[2009.09.28 19:23:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Corel
[2008.08.28 21:15:28 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Cornelsen
[2009.03.05 13:47:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Creative
[2009.01.17 13:49:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DeepBurner
[2008.09.23 14:09:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Desktopicon
[2009.06.22 15:50:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DonationCoder
[2010.07.02 21:52:49 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DVD Flick
[2010.10.02 11:56:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.01 16:49:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Egurik
[2010.11.08 16:33:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Fetyl
[2009.12.13 20:50:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\FileZilla
[2008.07.03 13:06:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GetRight
[2008.04.28 16:52:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GetRightToGo
[2008.07.04 23:55:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Google
[2010.10.31 21:49:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\gtk-2.0
[2009.08.11 22:48:18 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\ICQ
[2008.11.29 02:15:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Identities
[2010.07.12 13:49:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\IN-MEDIAKG
[2009.07.04 13:29:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Inkscape
[2008.03.29 04:36:52 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\InstallShield
[2010.10.03 14:00:01 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Izando
[2009.05.23 16:27:37 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\johnsadventures.com
[2008.10.04 17:10:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\KompoZer
[2010.08.20 14:48:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Laerf
[2010.07.31 14:17:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Leuvaf
[2010.02.19 16:17:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Lexware
[2008.03.29 11:42:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Macromedia
[2010.07.23 23:33:59 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MAGIX
[2006.11.02 16:06:33 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Media Center Programs
[2009.05.04 16:42:02 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Media Player Classic
[2008.09.20 16:59:15 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\metaspinner net GmbH
[2010.10.04 15:02:43 | 000,000,000 | --SD | M] -- C:\Users\*\AppData\Roaming\Microsoft
[2008.08.28 06:54:15 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mozilla
[2010.08.05 17:58:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mozilla-Cache
[2010.07.12 13:49:23 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\mresreg
[2010.11.06 17:00:09 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\My Games
[2010.03.12 14:37:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\NCH Swift Sound
[2009.11.22 15:35:44 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Nero
[2010.10.15 03:08:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Neti
[2010.05.27 17:23:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Nokia
[2010.05.27 17:23:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Nokia Ovi Suite
[2010.08.01 16:49:52 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Obte
[2008.05.03 22:51:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Odtu
[2010.02.05 13:57:53 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\OpenOffice.org
[2010.01.21 13:36:44 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\OpenOffice.org2
[2010.02.07 10:19:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Otebma
[2010.08.18 20:38:55 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Oxim
[2010.05.27 17:22:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\PC Suite
[2008.09.22 19:08:12 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\PreisHai4
[2009.03.23 18:38:18 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\ProtectDisc
[2010.08.01 16:49:16 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Qiep
[2009.10.16 08:14:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Qyciro
[2010.02.18 19:58:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\RagTime
[2009.05.10 12:26:34 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Real
[2008.09.02 17:56:19 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Scalabium
[2010.03.07 20:45:27 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Scribus
[2010.03.26 15:02:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Skype
[2010.03.26 14:52:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\skypePM
[2008.09.25 18:36:22 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Supreme Auction
[2008.03.29 07:10:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Talkback
[2008.12.03 20:23:52 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TrueCrypt
[2009.05.10 11:38:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TuneUp Software
[2008.07.13 15:53:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\UK's Kalender
[2009.09.22 14:50:55 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Ulead Systems
[2010.08.20 13:18:56 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Upydew
[2010.08.20 14:48:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Utidxe
[2008.05.11 17:19:59 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\WebCompiler3
[2009.10.01 17:58:17 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Winamp
[2008.06.17 05:37:24 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\WinRAR
[2010.10.22 21:12:43 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Xupay
[2010.07.31 18:42:50 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Ydyrno
[2010.10.22 20:46:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Yroloh
[2010.10.03 11:47:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Yxsy
[2008.11.29 02:15:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Zylom
 
< %APPDATA%\*.exe /s >
[2008.08.12 13:43:06 | 000,088,576 | ---- | M] (AD ON Multimedia Advertising GmbH) -- C:\Users\*\AppData\Roaming\Desktopicon\eBayShortcuts.exe
[2008.09.23 13:50:57 | 000,033,433 | ---- | M] () -- C:\Users\*\AppData\Roaming\Desktopicon\uninstall.exe
[2009.07.26 19:29:36 | 001,878,984 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\*\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2009.09.01 18:03:35 | 000,010,134 | R--- | M] () -- C:\Users\*\AppData\Roaming\Microsoft\Installer\{4E47844E-4A18-454B-A977-EC2CCF3F1472}\ARPPRODUCTICON.exe
[2008.12.22 11:27:00 | 000,344,064 | ---- | M] () -- C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
[2008.12.22 11:27:00 | 000,937,984 | ---- | M] () -- C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
[2010.10.15 03:08:13 | 000,135,168 | ---- | M] (Online Solutions) -- C:\Users\Destination\AppData\Roaming\Neti\qyiz.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008.01.19 09:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.03.29 09:05:25 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=05001E1FACCE49DB895B8526B05C7302 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_37cb142cf6008bc1\atapi.sys
[2008.01.19 09:07:46 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2008.03.29 09:05:26 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=BB55C79E0595D8CFBE4A80A3C9EB77EA -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_375215c7dcd73562\atapi.sys
[2009.04.11 08:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008.10.29 07:15:50 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2006.11.02 12:15:52 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=5D768BEB711FF67ADC8FAD4E2F6ABB02 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_ab9c809a352ecf21\explorer.exe
[2009.04.11 08:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\explorer.exe
[2009.04.11 08:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2008.03.29 09:09:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_b61f6f46696c67ab\explorer.exe
[2008.10.28 03:30:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008.03.29 09:09:34 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=819D88EC82C2C44B556DC32ED22044DE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_ac3dc19d4e3a6405\explorer.exe
[2008.10.29 07:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2008.03.29 09:09:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_b6926bef829b2600\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2008.10.30 06:30:07 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008.01.19 09:00:15 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008.03.29 09:09:34 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=FCBF8AC1855EF986CDEC2387760F71C6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_abcac4f4350ba5b0\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_b5f12aec698f911c\explorer.exe
[2008.01.19 08:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:11:31 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.01.19 09:03:01 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_61f43b1d27cd0ab4\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SysWOW64\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SysWOW64\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009.04.11 08:11:16 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
[2006.11.02 12:18:47 | 000,684,032 | ---- | M] (Microsoft Corporation) MD5=BFAB28B54DF41208CF3490FF26E53FD9 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_579f90caf36c48b9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2008.01.19 09:08:50 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2006.11.02 12:19:09 | 000,239,616 | ---- | M] (Microsoft Corporation) MD5=32EF13F20B28966D29DE5EABE036431D -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_91f5bbe3948dcf74\scecli.dll
[2008.01.19 09:03:55 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_9c4a6635c8ee916f\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SysWOW64\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SysWOW64\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009.04.11 08:11:23 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll
 
< MD5 for: USER32.DLL  >
[2006.11.02 10:44:25 | 000,646,656 | ---- | M] (Microsoft Corporation) MD5=00B53DCA0408CCD8F6BAF13994F6E3A0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_3174f01b5d2fa18f\user32.dll
[2008.03.29 09:01:30 | 000,646,656 | ---- | M] (Microsoft Corporation) MD5=296BA70E2A302E639CBD9E2A32DC65C4 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_31ad02315d0545af\user32.dll
[2008.01.19 09:04:23 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
[2008.01.19 08:32:19 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll
[2008.03.29 09:01:30 | 000,646,656 | ---- | M] (Microsoft Corporation) MD5=437C1C0CB2A42EA20083F21E9CAEF461 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_32359eb27623cc22\user32.dll
[2008.03.29 09:01:30 | 000,810,496 | ---- | M] (Microsoft Corporation) MD5=707CD582A4F93DB789336A5CE9527970 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_275857df28a483b4\user32.dll
[2006.11.02 12:19:10 | 000,810,496 | ---- | M] (Microsoft Corporation) MD5=95D5555CC7BD8F520996E35D36491EEF -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_272045c928cedf94\user32.dll
[2009.04.11 07:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\SysWOW64\user32.dll
[2009.04.11 07:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\SysWOW64\user32.dll
[2009.04.11 07:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_35972b23573c7daf\user32.dll
[2008.03.29 09:01:30 | 000,810,496 | ---- | M] (Microsoft Corporation) MD5=E4E3ED1E0D1D8C33A9C94ABEA1C8BC96 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_27e0f46041c30a27\user32.dll
[2009.04.11 08:11:27 | 000,820,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_2b4280d122dbbbb4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
[2006.11.02 12:16:15 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=46D5B6B80E4A5997F508F938F96B7628 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_3610939d8d22586d\userinit.exe
[2008.01.19 09:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008.01.19 09:00:45 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 12:16:20 | 000,397,312 | ---- | M] (Microsoft Corporation) MD5=9642EED809219A2F914DD8E40A09C48B -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_c9aada9e9063dc57\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.19 07:37:47 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys
[2006.11.02 10:47:52 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=C4EE49DB7EADC812DBC0ECCF2E7FB929 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_a96e7a5c834006a3\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< End of report >
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 08.11.2010 16:36:17 - Run 2
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\*\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 6138 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 14,12 Gb Free Space | 12,05% Space Free | Partition Type: NTFS
Drive D: | 117,19 Gb Total Space | 88,20 Gb Free Space | 75,26% Space Free | Partition Type: NTFS
Drive E: | 231,38 Gb Total Space | 208,67 Gb Free Space | 90,18% Space Free | Partition Type: NTFS
 
Computer Name: OUTLAND | User Name: * | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2799286350-1403585287-1070279313-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 0F A7 DD 32 A2 D3 C8 01  [binary data]
"VistaSp2" = 07 2A 6C 45 32 20 CA 01  [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5D518AF4-DAEC-459D-B3B5-8248C9547B82}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{8426FA12-7676-44F5-839B-2040E6DD88AB}" = lport=49162 | protocol=6 | dir=in | name=akamai netsession interface | 
"{9AB882CF-12F2-4AE6-A271-D5995A549379}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{D601C36F-53A8-41DB-B6DD-5E9569BAC4E0}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{E74BACFF-8443-4F52-8B55-D262AFCFD89A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{EBE0B715-A207-4CCA-AB8C-226D730D7D27}" = lport=51761 | protocol=6 | dir=in | name=akamai netsession interface | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{19C5BA7C-7C9D-48F1-BDF6-88039B2BABB2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{58B42055-E167-4CEB-A47B-8E7B044CE5F0}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{73F15264-B524-4FD2-B476-B4651EA0E61C}" = dir=in | app=c:\program files (x86)\windows live\messenger\livecall.exe | 
"{9096F57F-3689-4830-A3EA-B9EF1BC6272A}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{A024A855-56E5-4A9F-BC34-6612C54966AD}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{C2CBF6D3-100F-4793-B02A-1D3DBA368DEA}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{D01ADD1C-B3EF-4838-8C5A-0A4C9C9B0774}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F1C50BD4-82AC-449C-961B-16257E801CC0}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F39A293B-AF1C-45CB-857A-347575CA1F13}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"TCP Query User{0AAC4F41-CD44-46BC-8A39-E6241B05975D}C:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"TCP Query User{0DA5ABE1-7006-45D2-970E-329ED20CDDB9}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"TCP Query User{133E6721-8BE0-4ADC-9C67-E68087ED39A2}D:\ageofempires\empires2.icd" = protocol=6 | dir=in | app=d:\ageofempires\empires2.icd | 
"TCP Query User{1393886A-4624-4ECB-AB90-E430E1BCB1A6}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"TCP Query User{1B1E4AF0-CC6B-4C80-BF5B-BE8A7EC4236A}C:\program files (x86)\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"TCP Query User{37CC4674-0871-466A-915D-02332D508C14}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"TCP Query User{3AC9AC8B-ED87-4729-849D-AC0A4A8DDBF8}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"TCP Query User{478C1426-5F17-4623-B333-2C3448281AC1}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 
"TCP Query User{512D6662-BDE6-4657-AF4C-0E107A3AACFA}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"TCP Query User{5B20D1D3-3C6A-4055-AB43-E41FE5BB2FF4}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"TCP Query User{66731C37-61AA-478B-8E79-F22F152D12C5}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"TCP Query User{73A6E86E-59C2-4CCE-BEE3-0943B7BF6919}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"TCP Query User{82A4C78D-4B48-495C-9996-6A601B8767C0}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"TCP Query User{8A63C899-8C96-43C8-83D8-78FAFF33A741}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"TCP Query User{9308E9EF-4F73-42A2-A478-1FDCE0637D9E}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{9946101F-A31B-4F88-8186-0B1701DB5E5F}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"TCP Query User{99E52062-3F6A-473A-A8D6-D8CB17209D83}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"TCP Query User{A4FA6FC8-DEE4-4549-9AFA-ED1C853AE097}D:\ageofempires\empires2.icd" = protocol=6 | dir=in | app=d:\ageofempires\empires2.icd | 
"TCP Query User{B923B75A-5181-48B3-8D0E-ADEBB22BFBD1}C:\casino\casino-club deutsch\casino.exe" = protocol=6 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"TCP Query User{CA7E3F50-483A-49DB-8640-41F1886F8DEA}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 
"TCP Query User{D4AE5C12-389D-4F76-8340-00596802FE02}C:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe | 
"TCP Query User{E8004BEF-99AB-407E-B06F-5D831D02C817}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{EC6B0BF7-6800-45CE-928B-A67EB522BF0C}C:\casino\casino-club deutsch\casino.exe" = protocol=6 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"TCP Query User{F45D4612-76E1-448D-B42A-0CE72B45E05D}C:\program files (x86)\tv\tv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tv\tv.exe | 
"UDP Query User{14A349A0-7A23-4EF1-919B-63035A22B7AE}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"UDP Query User{158124A5-2238-4192-8CF6-A238D2DA41D5}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"UDP Query User{1B3A05B2-69F8-44E0-B6DD-EDE430D585F8}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"UDP Query User{251ACD28-5D28-42D3-8E03-9821AA3F5A42}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"UDP Query User{482878E5-70AE-48FD-94BE-B5C7A61D3F54}D:\ageofempires\empires2.icd" = protocol=17 | dir=in | app=d:\ageofempires\empires2.icd | 
"UDP Query User{55CB546C-AA80-486B-B482-53CFFEA484BD}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"UDP Query User{60607505-5DA6-4BF0-8824-B46AEFF16B0B}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"UDP Query User{63CD4C7C-AE04-4ACD-BCDE-435375D7B086}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{6ECFF6A9-92B3-4C5A-A121-D900D078E58A}C:\program files (x86)\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"UDP Query User{6FEA2B6B-E19D-4717-A818-52D320B9CAA2}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"UDP Query User{74C5769B-E913-4C50-9D00-67C35DF2BA8A}C:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{9C98250C-C909-4B86-A6B2-13D9BBEBD156}C:\casino\casino-club deutsch\casino.exe" = protocol=17 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"UDP Query User{A70DD689-49AB-4E3B-BEBA-0A7E81BF59B2}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"UDP Query User{AB56C72A-C7D4-4682-A0CB-CDFC7A987168}C:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe | 
"UDP Query User{B10B61BD-3323-4B4D-BACA-D05FDE2AAC98}D:\ageofempires\empires2.icd" = protocol=17 | dir=in | app=d:\ageofempires\empires2.icd | 
"UDP Query User{B3EABC40-9631-4CD2-9E42-F5A493AD08A6}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"UDP Query User{CE4395EC-D6FD-4F5E-87B8-4E2928A2748B}C:\program files (x86)\tv\tv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tv\tv.exe | 
"UDP Query User{D5E17357-B0B7-4320-BD7E-37AEDAB75329}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 
"UDP Query User{DA77EB6A-CFD9-4914-A4D1-999770487183}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"UDP Query User{DE1162CD-25F4-43E5-8716-EC6B8EBACB78}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"UDP Query User{DF991D98-9E8E-486F-B3CE-AAB3C507B3DF}C:\casino\casino-club deutsch\casino.exe" = protocol=17 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"UDP Query User{E9B59C77-D4E5-4A8F-B1C2-91DE98BFD6A7}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 
"UDP Query User{EB349035-1174-4249-93C5-0C67186516F8}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"UDP Query User{F0B78BA3-7883-4A7C-86C6-B2127940D058}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series" = Canon MP620 series MP Drivers
"{4575935D-9457-4517-8750-2341F4286F5F}" = iTunes
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{52784483-7088-4A4C-81E2-808303AD98F5}" = Apple Mobile Device Support
"{53480120-0D50-4084-A168-E87F11EB3BF6}" = O&O DiskRecovery
"{7F05E704-30A6-421A-97A7-8EEB1C7FF011}" = Corel Shell Extension - 64Bit
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D7829DCF-B68F-4A8A-A368-992D37DFA4C1}" = Systemsteuerung "MobileMe"
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3
"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW(R) Graphics Suite X4
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00B93E18-7F40-4DA9-8156-8340936DCD2F}" = Yu-Gi-Oh! ONLINE 2
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09C468CA-2940-466A-AAE8-DCC0C6E9323C}" = Nokia Software Updater
"{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1A0B8239-664B-434A-99D8-C50793513249}" = Audials TV
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool
"{212D202D-487D-49C4-8A76-4D3BB91B8471}" = BOINC
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 19
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{29F05234-DCBB-4FE0-88DC-5160C9250312}" = Adobe Photoshop CS3
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{3C3AB164-964F-419D-A688-810E728B9D7D}" = GalleryImages
"{3EE1008C-11A1-4F4F-8DB7-27573924DE78}" = DMIView B06.1227.01
"{3FF55F91-4296-46D0-B045-1429CD46AF99}" = Adobe Setup
"{41DF6AB7-4F89-478D-8501-D81A7A975D35}" = SP2GalleryImages
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3
"{4E47844E-4A18-454B-A977-EC2CCF3F1472}" = X2 - Die Bedrohung (V1.4)
"{4F2EF73A-02E9-4D10-B73A-6FF68B5F0862}" = TAXMAN 2010 Computerbild Edition
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5869CE1E-BC0B-4648-B1AE-6EF4A985590C}" = Dynamic Energy Saver 1.0 B8.0128.1
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{59624372-3B85-47f4-9B04-4911E551DF1E}" = Lexware Info Service
"{5B3A354B-C059-4861-A85B-CA46F1089E15}" = Creative USB Headsets
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{66FF4C48-0083-4E60-8556-B883AB200091}" = Heroes of Might & Magic V: Hammers of Fate
"{66FF4C48-0083-4E60-8556-B883AB200092}" = Heroes of Might and Magic V - Tribes of the East
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7D386596-0E80-4808-8AAE-C1DDA8212F7F}" = Adobe Setup
"{7EB0C45E-3514-4332-BE49-784C0FEB8C58}" = AOL Download Assistent
"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA
"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture
"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw
"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP
"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content
"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters
"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{878B631B-E0F9-41B9-83D9-BC9DFB0B9F2B}" = Ebad
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{989112B0-74DB-4A40-932F-580049CD0B97}" = Visual Basic for Applications (R) Core - German
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A5154441-DAF4-49A6-BFEE-DE9B1928DEF0}" = Realtek Ethernet Teaming and VLAN Utility for Windows Vista
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS 
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications (R) Core - English
"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA
"{C1080852-065E-4991-9260-F3756E3CC182}" = CursorFX
"{c7e96372-fc16-4d84-aa52-80aba026d668}" = Nero 9 Essentials
"{C9D456FD-C25B-49DE-AA71-6B76D6550B23}" = Adobe Fireworks CS3
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0
"{D299837D-74C1-41A9-8783-966610A9BED7}" = Preispiraten
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications (R) Core
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{DCD22647-6D31-479D-8F97-16D0AA934D9E}" = PC Connectivity Solution
"{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1" = John's Background Switcher 3.6
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E117043B-5227-47E9-AC4C-BFB792D5820F}" = Yu-Gi-Oh! ONLINE 3
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E76FCE6B-9999-4250-8C75-B2DA4AD41268}" = Face_Wizard B07.1219.01
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}" = Adobe Setup
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{F1A14CB2-A048-45A6-AFDA-3571296E1D76}" = Creative Media Toolbox 6
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Ralink Wireless LAN Card
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"aborange VertippTop_is1" = aborange VertippTop - Deinstallation
"Ace DivX Player_is1" = Ace DivX Player v2.1
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_25db75244653b42cb93dc27939d1c0e" = Adobe Dreamweaver CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_5f143314a5d434c8511097393d17397" = Adobe Photoshop CS3
"Adobe_6c7ed6c08f4acf68bf0512885eec384" = Adobe Fireworks CS3
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Age of Empires 2.0" = Microsoft Age of Empires II
"Akamai" = Akamai NetSession Interface
"ALchemy X-Fi" = Creative ALchemy (X-Fi Edition)
"A-Shop" = Dailsley A-Shop
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Premium
"Canon MP620 series Benutzerregistrierung" = Canon MP620 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Inkjet Printer/Scanner Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Casino Club Poker" = Casino Club Poker
"CASINO-CLUB Deutsch" = CASINO-CLUB Deutsch
"CDCoverEasyLayout" = CDCover! - Einfach Drucken
"City Life" = City Life
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"CursorFX" = CursorFX
"Direct MIDI to MP3 Converter_is1" = Direct MIDI to MP3 Converter Version 6.1.2.43
"DRI Tool 2.0_is1" = DRI Tool 2.0
"DVD Flick_is1" = DVD Flick
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"EasyTune5Pro" = EasyTune5Pro
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.50
"Fast MP3 Cutter Joiner" = Fast MP3 Cutter Joiner 2.6 build 1198
"FileZilla Client" = FileZilla Client 3.2.4.1
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free DVD Video Burner_is1" = Free DVD Video Burner version 1.1
"Free Studio_is1" = Free Studio version 4.2
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 1.1
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.1
"Free YouTube Download_is1" = Free YouTube Download 2.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Google Updater" = Google Updater
"Inkscape" = Inkscape 0.46
"InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3
"InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"KompoZer_is1" = KompoZer 0.77
"Lauge_is1" = Lauge 2.23
"Live-Player" = Live-Player
"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)
"MAGIX Fotos auf CD & DVD 9 D" = MAGIX Fotos auf CD & DVD 9 9.0.1.16 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Speed burnR D" = MAGIX Speed burnR
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"mp3-2-wav" = mp3-2-wav converter 1.14
"NCH Toolbar" = NCH Toolbar
"PartyCasino" = PartyCasino
"PartyPoker" = PartyPoker
"PhotoClean Express" = Shortcut PhotoClean Express
"PreisHai_is1" = PreisHai 4.1
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Rainlendar2" = Rainlendar2 (remove only)
"ScreenshotCaptor_is1" = Screenshot Captor 2.56.01
"Supreme Auction_is1" = Supreme Auction
"SysInfo" = Creative Systeminformationen
"The KMPlayer" = The KMPlayer (remove only)
"TrueCrypt" = TrueCrypt
"TV" = TV
"TVISTA - Tuning Vista_is1" = DATA BECKER TVISTA - Tuning Vista
"UK's Kalender_is1" = UK's Kalender 2.2.1
"UN070618" = BUFFALO TurboUSB for FLASH/HDD
"UN090430" = BUFFALO SecureLockManagerEasy for HD
"UnderCoverXP_is1" = UnderCoverXP 1.08
"Uninstall_is1" = Uninstall 1.0.0.1
"Uninstaller_B4736000_Creative Media Toolbox 6" = Creative Media Toolbox 6 (Shared Components)
"UniversalPlayer" = Universal Player
"Vista Icon Pack ST_is1" = Vista Icon Pack ST
"WavePad" = WavePad Sound Editor
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR
"XMedia Recode" = XMedia Recode 2.0.8.3
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2799286350-1403585287-1070279313-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"eBay Shortcuts" = eBay Shortcuts
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---
__________________
Alt 08.11.2010, 17:31   #4
markusg
/// Malware-holic
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


die auswertung ist von pc zu pc unterschiedlich, aber otl is nen guter anfang, da hier einiges gelistet wird.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-2799286350-1403585287-1070279313-1000..\Run: [{E7E6456B-F161-1299-E5E2-9E9A5B5CF4C2}] C:\Users\Destination\AppData\Roaming\Neti\qyiz.exe
(Online Solutions)
[2010.08.01 16:49:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Egurik
[2010.11.08 16:33:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Fetyl
[2010.10.15 03:08:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Neti
:FILES
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.

öffne mein computer, c: _OTL rechtsklick aauf moved files, zu moved files.zip oder rar hinzufügen.
archiv zu uns hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 08.11.2010, 21:10   #5
Blacky64
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


Hier die Text Datei:

Files\Folders moved on Reboot...
C:\Users\Destination\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...


Alt 08.11.2010, 21:24   #6
markusg
/// Malware-holic
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


du solltest dich jetzt ans daten sichern machen und dann den pc neu aufsetzen, ich gebe dir dazu eine anleitung, damit du ihn etwas sicherer bekommst.
__________________
--> Sparkasssentrojaner

Alt 13.12.2010, 16:03   #7
Blacky64
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


Hallo

also ich habe jetzt meine Daten gesichert, die ich noch brauche, meine Festplatte formatiert und Windows neu drauf gezogen. Welche Tips hast kannst Du mir geben, damit ich vor Trojaner einiger maßen sicher bin? Danke

Alt 13.12.2010, 16:11   #8
markusg
/// Malware-holic
 
Sparkasssentrojaner - Standard

Sparkasssentrojaner


servicepack2 für vista:
http://www.microsoft.com/downloads/d...displaylang=DE
internet explorer 8:
Mit Sicherheit ins Internet.
windows update:
Microsoft Windows Update
hier instalierst du so lange updates, bis es keine neuen mehr gibt.
windows updates automatisch laden/instalieren:
Aktivieren oder Deaktivieren von automatischen Updates
damit dein system ab sofort immer aktuell bleibt.

du solltest nur noch als eingeschrenkter nutzer arbeiten , das admin konto ist nur für instalationen gedacht.
klicke start, tippe unter suchen (ausführen) systemsteuerung. wähle dort Benutzerkonten hinzufügen/entfernen.
wähle "neues konto erstellen"
Wähle standard benutzer.

die konten sollten mit einem passwort geschützt werden.
dazu auf konto endern klicken und passwörter vergeben.
die folgenden konfigurationen als administrator durchführen

dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen.

SEHOP aktivieren:
Aktivieren von SEHOP &#40;Structured Exception Handling Overwrite Protection&#41; in Windows-Betriebssystemen
klicke auf "Feature automatisch aktivieren"
und folge den anweisungen

avira genauestens nach anleitung instalieren:
http://www.trojaner-board.de/54192-a...tellungen.html
achte darauf, das der auftrag im planer wirklich über lokale laufwerke läuft, sonst werden scan einstellungen nicht gültig.
unter avira, konfiguration, guard, autostart, haken raus lassen.

als browser solltest du den opera nutzen, er ist sicherer und schneller.
wenn er dir nicht gefällt passe ich meine anleitung für den ff an.
Opera Webbrowser | Schneller & sicherer | Die neuen Internet-Browser kostenlos herunterladen
mit diesem tool lässt sich ein werbeblocker laden
mit diesem tool lässt sich ein werbeblocker laden
Opera URLFilter Downloader ? OperaWiki
dies sollte 1x pro woche durchgeführt werden.
zusätzlich kannst du das auch manuell erledigen, falls mal etwas nicht geblockt wird:
Computerbase - Werbung blockieren
auch diese tutorial seite mal ansehen.
Opera Tutorial- Übersicht
hier besonders die abschnitte sicherheit (kookies) und passwort durchlesen


um das surfen sicherer zu machen, würde ich Sandboxie empfehlen.
Download:
drop.io
(als pdf)
hier noch ein paar zusatzeinstellungen, nicht verunsichern lassen, wenn du das programm instaliert hast, werden sie klar.
den direkten datei zugriff bitte auf opera beschrenken,
bei
Internetzugriff:
opera.exe
öffne dann sandboxie, dann oben im menü auf sandbox klickem, wähle deine sandbox aus und klicke dann auf sandboxeinstellung.
dort auf anwendung, webbrowser, andere dort auf direkten zugriff auf opera bookmarks erlauben. dann auf hinzufügen und ok.
somit kannst du deine lesezeichen auch in der sandbox dauerhaft abspeichern.

wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen.
1. es gibt dann noch ein paar mehr funktionen.
2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig.
3. ist die lizenz lebenslang gültig, kostenpunkt rund 30 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen.

autorun deaktivieren:
über diesen weg werden sehr häufig schaddateien verbreitet, schalte die funktion also ab.
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
usb sticks, festplatten etc, sollte man mit panda vaccine impfen:
ANTIMALWARE: Panda USB Vaccine - Download FREE - PANDA SECURITY
so holt man sich keine infektionen ins haus, wenn man mal die festplatte etc verleit.
hake an:
run panda usb vaccine automatically when computer boots
automatically vaccine any new insert usb key
enable ntfs file suport

Updates sind für dein system genauso wichtig, wie ein antivirenscanner. Sehr häufig gelangen schädlinge nur aufs system, weil der user veraltete software nutzt.
instaliere die folgenden update checker.
Secunia:
http://www.trojaner-board.de/83959-s...ector-psi.html
und file hippo update checker:
FileHippo.com Update Checker - FileHippo.com
das file Hippo Symbol wird im infobereich neben der uhr auftauchen, mache bitte nen rechtsklick darauf, wähle settings, results, setze einen haken bei "hide beta updates" klicke ok.
dann doppelklicke file hippo, eine Internetseite wird geöffnet, auf der dier die aktuellsten updates gezeigt werden, diese downloaden und instalieren.

Beide programme sollten im autostart bleiben, und sobald eines der programme updates anzeigt sollten diese umgehend instaliert werden.


achtung:
bei einigen programmen werden englische setups angeboten. das sollte man ersehen können, die setupdateien sollten ein .en oder .us enthalten. wenn dem so ist, sollte man beim hersteller schauen, dort gibts die deutschen setups zu laden.
Falls du die hersteller seite nicht kennst, google wird bestimmt behilflich sein :-)

regelmäßige Backups des systems sind sehr wichtig, du weist nie, ob deine festplatte mal kaputt geht.
Paragon Backup & Recovery Free Edition - Das Produkt
außerdem kannst du, bei neuerlichem malware befall das system zurücksetzen.
Das Backup sollte möglichst auf eine externe festplatte etc emacht werden, nicht auf die selbe, wo sich die zu sichernden daten befinden.
Von sehr wichtigen Daten könnte man noch eine zusätzliche Sicherung auf dvds/cds erstellen, dazu könnte man auch wiederbeschreibbare verwenden (rws) falls die sammlung mal erneuert werden soll.



allgemeines.
- verzichte auf tuning programme, sie bringen nichts.
- keine illegalen downloads.
90 % bringen malware mit sich!
- keine streaming seiten wie kino.to sie verbreiten malware.
- wenn möglich, instalationen immer benutzerdefiniert ausführen, dann kannst du unnötiges zeug abwählen.
- programme patches etc immer nur vom hersteller direkt laden.
online banking:

ich würde zu online banking mit chipcard raten, dazu benötigst du, ein lesegerät, lasse dich von deiner bank beraten, es sollte aber mindestens ein klasse2 lesegerät sein, besser sogar ein klasse3 leser, das sind die besten für den privat kunden.
Kartenlesegerät ? Wikipedia

instaliere jetzt die von dir benötigten programme.
endere alle passwörter.
danach, bitte nur noch im standard nutzer konto einloggen, und dort in der sandbox surfen, mit klick auf "sandboxed web browser".
diese einstellungen, sollten dich nun rund um schützen.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Sparkasssentrojaner
adobe, akamai, askbar, avg, avgntflt.sys, avira, becker, benutzerregistrierung, bho, bonjour, buffalo, canon, components, conduit, converter, defender, down, error, firefox, firefox.exe, flash player, format, install.exe, launch, lexware, location, logfile, mozilla, mp3, oldtimer, otl logfile, otl.exe, plug-in, programdata, realtek, registry, rundll, saver, scan, sched.exe, searchplugins, security, shell32.dll, shortcut, skype.exe, studio, svchost.exe, syswow64, tan's, trojane, trojaner, udp, vista


« Werde umgeleitet von Google auf nicht ausgewählte Seiten | Paranoid vielleicht :) »


Zum Thema Sparkasssentrojaner - Hallo Ich weiß, das dieses Thema schon mehrmals hier angesprochen wurde. Leider gibts es hier keine wirkliche Hilfestellung für Leien. Ich hab das mal mit dem OTL gemacht. Habe nämlich - Sparkasssentrojaner...
Archiv
Du betrachtest: Sparkasssentrojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131