| |
| |||||||
Log-Analyse und Auswertung: Internet Explorer öffnet sich selber und zeigt werbung!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
01.12.2010, 15:49
| #1 |
| |  Internet Explorer öffnet sich selber und zeigt werbung! Kann mir bitte jemand sagen warum sich mein internet Explorer öffnet obwohl ich ihn nicht starte und es kommt immer werbung !! ich habe gesucht aber ich finde nichts . mfg Angelika Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:36:22, on 01.12.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programme\iTunes\iTunesHelper.exe C:\Programme\SweetIM\Messenger\SweetIM.exe C:\Programme\Logitech\SetPointP\SetPoint.exe C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe C:\WINDOWS\system32\DrvMon.exe C:\Programme\Stardock\CursorFX\CursorFX.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe C:\Programme\ObjectDock\ObjectDock.exe C:\Programme\Gemeinsame Dateien\LogiShrd\KHAL3\KHALMNPR.EXE C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\FsUsbExService.Exe C:\WINDOWS\system32\svchost.exe C:\Programme\ICQ6Toolbar\ICQ Service.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Mobiola Headset for iPhone\MobiolaWaveService.exe C:\Programme\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\svchost.exe C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe C:\Programme\TeamViewer\Version5\TeamViewer.exe C:\Programme\iPod\bin\iPodService.exe C:\Programme\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe C:\Programme\HP\Digital Imaging\bin\hpqbam08.exe C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Pdunea.exe C:\Programme\Totalcmd 7.5\TOTALCMD.EXE C:\DOKUME~1\Papa2000\LOKALE~1\Temp\Pcs.exe C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe C:\Programme\Internet Explorer\iexplore.exe C:\DOKUME~1\Papa2000\LOKALE~1\Temp\Pcr.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Mozilla Firefox\plugin-container.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\Programme\BlueSoleil\PrintTpl\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\Programme\BlueSoleil\PrintTpl\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe O1 - Hosts: 74.208.10.249 gs.apple.com O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\SnagIt 7\SnagItBHO.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\Microsoft Office 2010\Office14\GROOVEEX.DLL O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\Microsoft Office 2010\Office14\URLREDIR.DLL O2 - BHO: TBSB00982 - {DA3D342F-FF20-4E31-9E82-22334155730C} - C:\Programme\Antbar\Ant.com Toolbar\tbcore3.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: kikin Plugin - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - Toolbar: Ant.com Toolbar - {6CD56C02-CB4D-41B5-A0FE-B479061CCB41} - C:\Programme\Antbar\Ant.com Toolbar\tbcore3.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll O4 - HKLM\..\Run: [hpqSRMon] C:\Programme\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe O4 - HKLM\..\Run: [EvtMgr6] C:\Programme\Logitech\SetPointP\SetPoint.exe /launchGaming O4 - HKLM\..\Run: [BCSSync] "C:\Programme\Microsoft Office 2010\Office14\BCSSync.exe" /DelayServices O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\System32\wfreg.exe O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe O4 - HKCU\..\Run: [CursorFX] "C:\Programme\Stardock\CursorFX\CursorFX.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\System32\wfreg.exe O4 - HKCU\..\Run: [JP595IR86O] C:\DOKUME~1\Papa2000\LOKALE~1\Temp\Pcr.exe O4 - HKLM\..\Policies\Explorer\Run: [] O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\System32\wfreg.exe O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\System32\wfreg.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user') O4 - S-1-5-19 Startup: BTTray.lnk = ? (User 'LOKALER DIENST') O4 - S-1-5-19 Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe (User 'LOKALER DIENST') O4 - S-1-5-20 Startup: BTTray.lnk = ? (User 'NETZWERKDIENST') O4 - S-1-5-20 Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe (User 'NETZWERKDIENST') O4 - Startup: Stardock ObjectDock.lnk = C:\Programme\ObjectDock\ObjectDock.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\Microsoft Office 2010\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\Microsoft Office 2010\Office14\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://c:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Save YouTube Video as MP3 - res://C:\Programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll O9 - Extra 'Tools' menuitem: My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIE.dll O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIELinkedNotes.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - c:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O15 - Trusted Zone: hxxp://*.mcafee.com O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\Skype4COM.dll O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O20 - Winlogon Notify: RelevantKnowledge - C:\Programme\RelevantKnowledge\rlls.dll O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - - (no file) O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: SAMSUNG AllShare Service (AllShare) - Unknown owner - C:\Programme\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\Bluetooth\lbtserv.exe O23 - Service: Mobiola Wave Service - Unknown owner - C:\Programme\Mobiola Headset for iPhone\MobiolaWaveService.exe O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Programme\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe -- End of file - 13705 bytes |
|
01.12.2010, 16:10
| #2 |
| /// Malware-holic   | Internet Explorer öffnet sich selber und zeigt werbung! ootl:
__________________Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten
__________________ |
|
01.12.2010, 19:19
| #3 |
| | Internet Explorer öffnet sich selber und zeigt werbung! hallo hier mal teil eins
__________________OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.12.2010 19:07:18 - Run 2 OTL by OldTimer - Version 3.2.17.3 Folder = D:\ Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 73,00% Memory free 5,00 Gb Paging File | 4,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 341,80 Gb Total Space | 246,63 Gb Free Space | 72,16% Space Free | Partition Type: NTFS Drive D: | 589,70 Gb Total Space | 261,06 Gb Free Space | 44,27% Space Free | Partition Type: NTFS Drive K: | 1397,26 Gb Total Space | 325,74 Gb Free Space | 23,31% Space Free | Partition Type: NTFS Drive N: | 1,89 Gb Total Space | 1,87 Gb Free Space | 98,91% Space Free | Partition Type: FAT32 Drive O: | 15,22 Gb Total Space | 12,72 Gb Free Space | 83,59% Space Free | Partition Type: FAT32 Computer Name: PRIVAT-59D871E0 | User Name: Papa2000 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - D:\OTL.exe (OldTimer Tools) PRC - C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Temp\Pcr.exe () PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\TeamViewer\Version5\TeamViewer.exe (TeamViewer GmbH) PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe (Symantec Corporation) PRC - C:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.) PRC - C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe () PRC - C:\Programme\Mobiola Headset for iPhone\MobiolaWaveService.exe () PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Totalcmd 7.5\TOTALCMD.EXE (C. Ghisler & Co.) PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis) PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Stardock\CursorFX\CursorFX.exe (Stardock Corporation) PRC - C:\Programme\ObjectDock\ObjectDock.exe (Stardock) PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\WINDOWS\system32\DrvMon.exe (Alcor Micro, Corp.) ========== Modules (SafeList) ========== MOD - D:\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) MOD - C:\Programme\SweetIM\Messenger\mgAdaptersProxy.dll (SweetIM Technologies Ltd.) MOD - C:\Programme\Stardock\CursorFX\CurXP0.dll ( ) MOD - C:\Programme\ObjectDock\DockShellHook.dll () MOD - C:\WINDOWS\system32\BtMmHook.dll (Broadcom Corporation.) MOD - C:\Programme\SweetIM\Messenger\msvcr71.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AASW2_Service) -- File not found SRV - (TeamViewer5) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (NAV) -- C:\Programme\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe (Symantec Corporation) SRV - (LBTServ) -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe () SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme\Microsoft Office 2010\Office14\GROOVE.EXE (Microsoft Corporation) SRV - (AllShare) -- C:\Programme\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe () SRV - (Mobiola Wave Service) -- C:\Programme\Mobiola Headset for iPhone\MobiolaWaveService.exe () SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.) ========== Driver Services (SafeList) ========== DRV - (VcommMgr) -- C:\WINDOWS\System32\Drivers\VcommMgr.sys File not found DRV - (VComm) -- C:\WINDOWS\System32\DRIVERS\VComm.sys File not found DRV - (Btcsrusb) -- C:\WINDOWS\System32\Drivers\btcusb.sys File not found DRV - (BT) -- C:\WINDOWS\System32\DRIVERS\btnetdrv.sys File not found DRV - (BlueletAudio) -- C:\WINDOWS\System32\DRIVERS\blueletaudio.sys File not found DRV - (NAVEX15) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20101201.003\NAVEX15.SYS (Symantec Corporation) DRV - (eeCtrl) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (NAVENG) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20101201.003\NAVENG.SYS (Symantec Corporation) DRV - (BHDrvx86) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101104.001\BHDrvx86.sys (Symantec Corporation) DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (IDSxpx86) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101130.001\IDSXpx86.sys (Symantec Corporation) DRV - (SymEFA) -- C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMEFA.SYS (Symantec Corporation) DRV - (SRTSP) -- C:\WINDOWS\System32\Drivers\NAV\1201000.025\SRTSP.SYS (Symantec Corporation) DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\WINDOWS\system32\drivers\NAV\1201000.025\SRTSPX.SYS (Symantec Corporation) DRV - (SYMTDI) -- C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMTDI.SYS (Symantec Corporation) DRV - (SymIRON) -- C:\WINDOWS\system32\drivers\NAV\1201000.025\Ironx86.SYS (Symantec Corporation) DRV - (SymDS) -- C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMDS.SYS (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (PnkBstrK) -- C:\WINDOWS\system32\drivers\PnkBstrK.sys () DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (teamviewervpn) -- C:\WINDOWS\system32\drivers\teamviewervpn.sys (TeamViewer GmbH) DRV - (MOBIOLA_Wave) Mobiola Wave Audio Device (WDM) -- C:\WINDOWS\system32\drivers\mobiolawave.sys (SHAPE Services) DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation) DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.) DRV - (tdrpman228) Acronis Try&Decide and Restore Points filter (build 228) -- C:\WINDOWS\system32\DRIVERS\tdrpm228.sys (Acronis) DRV - (timounter) -- C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis) DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis) DRV - (snapman) -- C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.) DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative) DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation) DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation) DRV - (nvsmu) -- C:\WINDOWS\system32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (nvgts) -- C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation) DRV - (WsAudio_DeviceS(1)) WsAudio_DeviceS(1) -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys (Wondershare) DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys () DRV - (ss_bmdm) -- C:\WINDOWS\system32\drivers\ss_bmdm.sys (MCCI Corporation) DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\WINDOWS\system32\drivers\ss_bbus.sys (MCCI) DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys (MCCI Corporation) DRV - (BtHidBus) -- C:\WINDOWS\System32\Drivers\BtHidBus.sys (IVT Corporation.) DRV - (btnetBUs) -- C:\WINDOWS\system32\drivers\btnetBus.sys () DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia) DRV - (IvtBtBUs) -- C:\WINDOWS\system32\drivers\IvtBtBus.sys (IVT Corporation.) DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Windows (R) Codename Longhorn DDK provider) DRV - (NPF_devolo) NetGroup Packet Filter Driver (devolo) -- C:\WINDOWS\system32\drivers\npf_devolo.sys (CACE Technologies) DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Windows (R) Codename Longhorn DDK provider) DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia) DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia) DRV - (Aspi32) -- C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (phaudlwr) -- C:\WINDOWS\system32\drivers\phaudlwr.sys (Philips Applied Technologies) DRV - (SPC530) -- C:\WINDOWS\system32\drivers\SPC530.sys ( ) DRV - (SPC530m) -- C:\WINDOWS\system32\drivers\SPC530m.sys ( ) DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (KeyMagic) -- C:\WINDOWS\system32\drivers\KeyMagic.sys (Apple Inc.) DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.) DRV - (ElbyCDFL) -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys (SlySoft, Inc.) DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.) DRV - (btwhid) -- C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.) DRV - (BTCAMDRV) -- C:\WINDOWS\system32\drivers\BTCamDrv.sys (Windows (R) 2000 DDK provider) DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.) DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.) DRV - (BTHidEnum) -- C:\WINDOWS\system32\drivers\VBTEnum.sys () DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation) DRV - (Ser2pl) -- C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = c:\Programme\BlueSoleil\PrintTpl\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = hxxp://search.msn.com/spbasic.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = c:\Programme\BlueSoleil\PrintTpl\blank.htm IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [binary data] IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/" FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.4 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: firefox@meebo.com:1.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.10 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0 FF - prefs.js..extensions.enabledItems: {6E19037A-12E3-4295-8915-ED48BC341614}:1.3.326.1 FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=" FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=" FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.07.11 21:44:46 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010.10.28 05:42:42 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Programme\RelevantKnowledge [2010.11.19 10:45:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.11.03 08:02:36 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.10.30 09:59:19 | 000,000,000 | ---D | M] [2009.08.10 23:49:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Extensions [2009.08.10 23:49:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com [2010.11.30 21:44:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\extensions [2010.06.05 19:23:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.07.04 20:53:55 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.08.08 12:53:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.09.03 22:03:29 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847} [2010.03.12 20:35:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\extensions\firefox@meebo.com [2010.12.01 07:10:44 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\searchplugins\icqplugin-1.xml [2010.10.28 14:19:32 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla\Firefox\Profiles\d398gaur.default\searchplugins\icqplugin.xml [2010.11.30 21:44:04 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2009.10.22 06:20:25 | 000,000,000 | ---D | M] (BlueSoleil Extension) -- C:\Programme\Mozilla Firefox\extensions\{231D7D17-4F1B-4933-AB61-E502DB82FD11}(2) [2010.01.23 07:26:28 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.05.18 09:40:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.08.07 22:34:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.23 01:09:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.10.23 01:09:14 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2009.08.03 15:29:12 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Programme\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll [2010.09.16 09:17:28 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.09.16 09:17:28 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.09.16 09:17:28 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.09.16 09:17:28 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.09.16 09:17:28 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.10.06 13:05:25 | 000,001,070 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 im.adtech.de O1 - Hosts: 127.0.0.1 adserver.adtech.de O1 - Hosts: 127.0.0.1 adtech.de O1 - Hosts: 127.0.0.1 ar.atwola.com O1 - Hosts: 127.0.0.1 atwola.com O1 - Hosts: 127.0.0.1 adserver.71i.de O1 - Hosts: 127.0.0.1 adicqserver.71i.de O1 - Hosts: 127.0.0.1 71i.de O1 - Hosts: 74.208.10.249 gs.apple.com O2 - BHO: (HelperObject Class) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\SnagIt 7\SnagItBHO.dll (TechSmith Corporation) O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (TBSB00982 Class) - {DA3D342F-FF20-4E31-9E82-22334155730C} - C:\Programme\Antbar\Ant.com Toolbar\tbcore3.dll () O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin) O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O3 - HKLM\..\Toolbar: (Ant.com Toolbar) - {6CD56C02-CB4D-41B5-A0FE-B479061CCB41} - C:\Programme\Antbar\Ant.com Toolbar\tbcore3.dll () O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (SnagIt) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\SnagIt 7\SnagItIEAddin.dll (TechSmith Corporation) O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\Toolbar\WebBrowser: (Ant.com Toolbar) - {6CD56C02-CB4D-41B5-A0FE-B479061CCB41} - C:\Programme\Antbar\Ant.com Toolbar\tbcore3.dll () O3 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..\Toolbar\WebBrowser: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O4 - HKLM..\Run: [BCSSync] C:\Programme\Microsoft Office 2010\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [EvtMgr6] C:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [HKLM] C:\WINDOWS\system32\wfreg.exe (Twain Working Group) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [CursorFX] C:\Programme\Stardock\CursorFX\CursorFX.exe (Stardock Corporation) O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe (Alcor Micro, Corp.) O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [HKCU] C:\WINDOWS\system32\wfreg.exe (Twain Working Group) O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [JP595IR86O] C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Temp\Pcr.exe () O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [PlayNC Launcher] File not found O4 - HKU\.DEFAULT..\RunOnce: [] File not found O4 - HKU\S-1-5-18..\RunOnce: [] File not found O4 - HKU\S-1-5-19..\RunOnce: [] File not found O4 - HKU\S-1-5-20..\RunOnce: [] File not found O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Dokumente und Einstellungen\Papa2000\Startmenü\Programme\Autostart\Stardock ObjectDock.lnk = C:\Programme\ObjectDock\ObjectDock.exe (Stardock) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 [2010.12.01 14:15:26 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: = 1 [2010.12.01 14:15:26 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\System32\wfreg.exe (Twain Working Group) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2010.12.01 14:15:26 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2010.12.01 14:15:26 | 000,000,000 | ---D | M] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0 O7 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\System32\wfreg.exe (Twain Working Group) O7 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office 2010\Office14\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam) O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office 2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..Trusted Domains: internet ([]about in Lokales Intranet) O15 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..Trusted Domains: mcafee.com ([]http in Lokales Intranet) O15 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003\..Trusted Domains: mcafee.com ([]https in Lokales Intranet) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Programme\Yahoo!\Common\yinsthelper.dll (YInstStarter Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Value error. - Reg Error: Value error. File not found O20 - Winlogon\Notify\RelevantKnowledge: DllName - C:\Programme\RelevantKnowledge\rlls.dll - C:\Programme\RelevantKnowledge\rlls.dll (TMRG, Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.07.09 18:21:33 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{4d97f3ff-d059-11df-b2e9-0024215bad3a}\Shell - "" = AutoRun O33 - MountPoints2\{4d97f3ff-d059-11df-b2e9-0024215bad3a}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{ee5e72cf-7122-11de-afe5-0024215bad3a}\Shell - "" = AutoRun O33 - MountPoints2\{ee5e72cf-7122-11de-afe5-0024215bad3a}\Shell\AutoRun - "" = Auto&Play O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: SSHNAS - File not found MsConfig - StartUpReg: TomTomHOME.exe - hkey= - key= - Reg Error: Value error. File not found MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: MCODS - Reg Error: Value error. SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: MCODS - Reg Error: Value error. SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error. ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {23W2KY63-T1P0-1J86-DK5B-541KG6047PKJ} - C:\WINDOWS\System32\wfreg.exe ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error. ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error. ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler) Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm () Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (hxxp://www.mp3dev.org/) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) Drivers32: vidc.ffds - C:\WINDOWS\System32\ff_vfw.dll () Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll () Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 30 Days ========== [2010.12.01 14:12:29 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Papa2000\Recent [2010.12.01 12:00:06 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro [2010.11.23 16:22:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\.BitTornado [2010.11.22 18:58:53 | 000,000,000 | ---D | C] -- C:\PCShareManagerUpload [2010.11.22 18:34:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Software Informer [2010.11.21 16:34:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Eigene Dateien\Azureus Downloads [2010.11.21 16:32:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Azureus [2010.11.18 21:07:22 | 000,000,000 | ---D | C] -- C:\Programme\SpeedProject [2010.11.16 16:57:01 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR4 [2010.11.16 16:41:42 | 000,000,000 | ---D | C] -- C:\Programme\ISO Commander [2010.11.08 11:29:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\mkvtoolnix [2010.11.08 11:28:44 | 000,000,000 | ---D | C] -- C:\Programme\MKVtoolnix [2010.11.08 11:10:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Leawo [2010.11.08 10:40:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Eigene Dateien\DreamVideoSoft [2010.11.08 10:40:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\dream-mkv-to-avi-converter [2010.11.07 23:20:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Moyea [2010.11.07 23:20:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Eigene Dateien\Leawo [2010.11.07 23:19:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Leawo [2010.11.07 23:19:35 | 000,000,000 | ---D | C] -- C:\Programme\RelevantKnowledge [2010.11.07 23:19:01 | 000,139,264 | ---- | C] (hxxp://www.xvid.org) -- C:\WINDOWS\System32\xvid.ax [2010.11.07 23:18:58 | 000,000,000 | ---D | C] -- C:\Programme\Leawo [2009.10.06 12:02:46 | 000,484,864 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\SPC530.sys [2009.10.06 12:02:46 | 000,007,680 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\SPC530m.sys [2009.07.10 01:56:36 | 000,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\pcouffin.sys [2004.11.24 19:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.12.01 18:33:46 | 000,000,294 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.12.01 17:28:18 | 000,016,574 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\Kerstin Theiss Lebenslauf.docx [2010.12.01 13:51:27 | 000,001,788 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\HP Digital Imaging Monitor.lnk [2010.12.01 13:51:18 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.12.01 13:50:37 | 000,253,748 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml [2010.12.01 13:50:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.12.01 13:22:57 | 000,013,156 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Eigene Dateien\SN Photoshop CS5 Anleitung.docx [2010.12.01 00:10:00 | 000,051,200 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.11.27 14:48:28 | 000,000,600 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\winscp.rnd [2010.11.27 14:43:24 | 000,002,121 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Desktop\iTunes 10.lnk [2010.11.19 10:08:09 | 000,016,209 | -H-- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Papa2000log.dat [2010.11.15 10:00:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010.11.08 22:46:41 | 000,488,070 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.11.08 22:46:41 | 000,465,472 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.11.08 22:46:41 | 000,096,672 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.11.08 22:46:41 | 000,080,496 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.11.08 11:12:58 | 000,000,671 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\vso_ts_preview.xml [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.12.01 13:22:57 | 000,013,156 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Eigene Dateien\SN Photoshop CS5 Anleitung.docx [2010.12.01 02:14:32 | 000,000,294 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.10.20 11:13:15 | 000,001,940 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Anwendungsdaten\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini [2010.10.20 11:08:13 | 000,001,940 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini [2010.10.17 22:08:45 | 000,000,020 | ---- | C] () -- C:\WINDOWS\animated_waterfalls2.ini [2010.09.30 17:05:53 | 000,013,816 | ---- | C] () -- C:\WINDOWS\System32\unikey.sys [2010.08.05 22:44:59 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll [2010.08.05 22:44:59 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys [2010.08.05 22:44:46 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\$_hpcst$.hpc [2010.07.07 03:42:44 | 000,695,912 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2010.07.04 00:50:13 | 000,676,864 | ---- | C] () -- C:\WINDOWS\System32\mxMonecSocket.dll [2010.06.30 06:25:33 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\advd.dll [2010.06.30 06:25:33 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\auth.dll [2010.06.30 06:25:31 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2010.06.30 06:25:29 | 000,693,765 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\unins000.exe [2010.06.30 06:25:29 | 000,007,307 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\unins000.dat [2010.05.18 00:49:12 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\winscp.rnd [2010.04.06 18:05:13 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\PnkBstrK.sys [2010.03.07 16:41:43 | 000,000,120 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc [2009.12.14 14:43:38 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009.12.14 14:43:36 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009.12.14 14:43:36 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009.10.24 19:00:35 | 000,139,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009.09.17 11:49:36 | 000,000,290 | ---- | C] () -- C:\WINDOWS\game.ini [2009.08.15 23:13:45 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2009.07.31 21:27:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BsMobileModel.ini [2009.07.12 22:42:22 | 000,011,860 | ---- | C] () -- C:\WINDOWS\System32\drivers\VBTEnum.sys [2009.07.11 13:30:46 | 000,051,200 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.07.10 18:28:41 | 000,000,760 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\setup_ldm.iss [2009.07.10 13:26:24 | 000,011,796 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log [2009.07.10 02:17:16 | 000,000,041 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib [2009.07.10 02:13:06 | 000,000,068 | ---- | C] () -- C:\WINDOWS\GDINST.INI [2009.07.10 02:01:56 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2009.07.10 02:01:56 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2009.07.10 02:01:56 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2009.07.10 02:01:56 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2009.07.10 02:01:56 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2009.07.10 02:01:56 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2009.07.10 02:01:49 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll [2009.07.10 01:56:57 | 000,000,671 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\vso_ts_preview.xml [2009.07.10 01:56:39 | 000,000,034 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\pcouffin.log [2009.07.10 01:56:36 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\inst.exe [2009.07.10 01:56:36 | 000,007,887 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\pcouffin.cat [2009.07.10 01:56:36 | 000,001,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\pcouffin.inf [2009.07.09 19:12:28 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008.12.19 15:15:58 | 004,338,246 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008.12.17 17:41:18 | 000,884,237 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008.12.17 17:22:58 | 000,093,184 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008.12.17 17:22:48 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008.12.17 17:17:34 | 000,239,247 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008.12.17 16:59:54 | 000,560,802 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008.12.07 11:44:54 | 000,030,088 | ---- | C] () -- C:\WINDOWS\System32\drivers\btnetBus.sys [2008.11.17 15:53:01 | 000,401,408 | ---- | C] () -- C:\WINDOWS\System32\StepButtonS.dll [2008.10.07 08:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll [2008.10.07 08:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll [2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll [2008.07.29 19:17:46 | 000,491,520 | ---- | C] () -- C:\WINDOWS\System32\mp3lib.dll [2007.10.25 16:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2007.02.27 17:48:38 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2007.02.27 17:29:32 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2006.07.06 13:23:37 | 000,016,209 | -H-- | C] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Papa2000log.dat [2004.10.03 17:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2002.05.16 00:38:40 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\mp4fil32.dll [2002.05.04 14:19:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\avisynthEx.dll [2002.03.21 13:39:02 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL [2002.03.20 20:01:06 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys [2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll [2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll [2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll [2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll [2001.11.14 12:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll [2000.04.14 15:50:02 | 000,343,040 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll [1998.06.11 12:08:06 | 000,095,232 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll ========== LOP Check ========== [2010.06.08 19:51:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ACD Systems [2009.07.10 17:32:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis [2009.09.05 11:52:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo [2009.08.21 00:20:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Awem [2009.07.12 23:03:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2010.04.13 14:14:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess [2009.07.30 01:17:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\createpart [2009.07.30 01:22:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\deletepart [2009.11.09 19:42:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DelinvFile [2010.04.06 17:46:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts [2010.01.31 12:21:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2009.07.30 01:16:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\explauncher [2010.07.04 20:53:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2009.07.09 20:50:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2009.07.30 01:16:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\launcher [2010.11.08 11:10:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Leawo [2009.07.30 01:25:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mergeparts [2009.08.10 14:46:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MumboJumbo [2009.07.31 18:51:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2009.07.15 12:14:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\pdc [2009.10.06 12:03:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Philips [2009.07.30 01:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\redistpart [2010.09.03 22:03:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM [2009.10.18 23:16:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SWTCWRH [2010.12.01 02:22:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2010.05.21 00:03:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WindSolutions [2009.09.05 21:13:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{404C1499-24DB-49AC-BF11-F0AD2C046836} [2010.04.25 17:19:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009.10.09 10:05:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009.07.11 19:31:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [2009.11.04 12:57:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{C4C0E335-EDDF-46A0-A57D-F3802AE44275} [2009.09.26 19:10:05 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\.# [2010.11.23 16:22:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\.BitTornado [2009.07.11 19:39:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ACD Systems [2009.07.10 13:36:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acoustica [2009.08.07 19:02:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acreon [2009.07.10 17:33:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acronis [2010.05.18 21:53:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Any DVD Converter Professional [2010.02.03 22:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ashampoo [2009.11.08 03:12:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ashampoo Cover Studio 2 [2010.11.21 16:45:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Azureus [2010.06.30 06:27:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\concept design [2009.07.10 13:19:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\CopyTrans [2009.10.02 00:13:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\CopyTransDoctor [2009.11.09 19:42:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DelinvFile [2010.07.04 00:50:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Desktopicon [2010.11.08 11:07:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\dream-mkv-to-avi-converter [2010.08.08 12:53:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DVDVideoSoftIEHelpers [2010.01.31 12:22:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\elsterformular [2010.08.11 15:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\FDRLab [2009.08.03 15:29:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Foxit [2009.07.31 18:51:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GARMIN [2010.02.18 15:33:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GetRightToGo [2010.10.05 17:08:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GHISLER [2010.06.21 00:07:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\gtk-2.0 [2009.10.12 09:32:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\iCloner [2010.09.05 00:40:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ICQ [2009.11.30 21:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\iLibs_old [2009.07.10 18:08:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ImgBurn [2010.07.17 18:14:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ImTOO [2009.07.10 02:09:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\InterVideo [2009.08.21 00:14:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Jewel Master Karibik [2010.08.28 18:08:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\kikin [2010.09.16 09:57:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Leadertech [2010.11.08 11:10:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Leawo [2010.04.14 15:01:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\McLoad [2010.03.12 20:29:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Meebo [2010.11.08 11:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\mkvtoolnix [2010.11.07 23:20:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Moyea [2009.07.10 13:18:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mp3tag [2009.07.10 17:08:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ordner HP Share-to-Web [2009.07.31 18:51:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\PC Suite [2009.07.10 18:19:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Razer [2010.03.07 16:41:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ripdev [2010.08.05 22:44:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Samsung [2010.03.19 17:13:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\SHAPE Services [2010.01.01 21:15:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\SharePod [2010.11.22 18:35:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Software Informer [2010.05.18 01:45:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Spesoft Audio Converter [2010.06.29 13:24:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Stereoscopic Player [2010.03.24 18:30:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\TeamViewer [2010.10.05 16:53:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Telstra [2009.07.29 20:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Thinstall [2010.05.31 15:25:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\tidysongs15.27F6A35B76E5883BF9E6FEE514586561E60595CA.1 [2009.08.10 23:49:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\TomTom [2010.08.09 21:36:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\TS3Client [2009.11.04 12:57:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Uniblue [2010.01.14 07:41:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\URSoft [2010.11.30 23:36:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\uTorrent [2009.08.29 23:19:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ViquaSoft [2010.11.08 11:12:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Vso [2010.05.21 00:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions [2010.08.11 15:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Wuala [2010.05.18 01:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Xilisoft [2009.11.08 02:52:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\XLMSoft [2010.12.01 18:33:46 | 000,000,294 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2009.09.26 19:10:05 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\.# [2010.11.23 16:22:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\.BitTornado [2009.07.11 19:39:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ACD Systems [2009.07.10 13:36:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acoustica [2009.08.07 19:02:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acreon [2009.07.10 17:33:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acronis [2010.05.31 15:25:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Adobe [2010.05.18 21:53:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Any DVD Converter Professional [2009.11.16 14:18:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Apple Computer [2009.10.06 12:05:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ArcSoft [2010.02.03 22:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ashampoo [2009.11.08 03:12:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ashampoo Cover Studio 2 [2010.08.05 19:50:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\AVS4YOU [2010.11.21 16:45:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Azureus [2010.06.30 06:27:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\concept design [2009.07.10 13:19:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\CopyTrans [2009.10.02 00:13:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\CopyTransDoctor [2009.11.09 19:42:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DelinvFile [2010.07.04 00:50:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Desktopicon [2009.07.11 20:49:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DivX [2010.11.08 11:07:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\dream-mkv-to-avi-converter [2010.11.09 19:59:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\dvdcss [2010.08.08 12:53:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\DVDVideoSoftIEHelpers [2010.01.31 12:22:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\elsterformular [2010.08.11 15:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\FDRLab [2009.08.03 15:29:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Foxit [2009.07.31 18:51:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GARMIN [2010.02.18 15:33:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GetRightToGo [2010.10.05 17:08:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GHISLER [2010.07.07 21:38:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\GRETECH [2010.06.21 00:07:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\gtk-2.0 [2009.07.29 17:49:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Help [2009.07.10 13:34:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\HP [2010.12.01 18:48:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\HPAppData [2009.10.12 09:32:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\iCloner [2010.09.05 00:40:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ICQ [2009.07.09 18:25:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Identities [2009.11.30 21:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\iLibs_old [2009.07.10 18:08:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ImgBurn [2010.07.17 18:14:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ImTOO [2009.07.10 02:09:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\InterVideo [2009.08.21 00:14:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Jewel Master Karibik [2010.08.28 18:08:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\kikin [2010.09.16 09:57:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Leadertech [2010.11.08 11:10:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Leawo [2010.09.16 09:56:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Logishrd [2010.09.16 09:59:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Logitech [2009.07.10 02:33:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Macromedia [2010.04.20 10:27:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\McAfee [2010.04.14 15:01:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\McLoad [2009.12.19 01:40:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Media Player Classic [2010.03.12 20:29:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Meebo [2010.10.10 19:36:13 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Microsoft [2010.11.08 11:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\mkvtoolnix [2010.11.07 23:20:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Moyea [2009.07.09 18:45:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mozilla [2009.07.10 13:18:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Mp3tag [2010.09.16 16:35:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\NVIDIA 3D Vision Video Player [2009.07.10 17:08:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ordner HP Share-to-Web [2009.07.31 18:51:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\PC Suite [2009.07.10 18:19:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Razer [2010.03.07 16:41:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Ripdev [2010.08.05 22:44:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Samsung [2010.03.19 17:13:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\SHAPE Services [2010.01.01 21:15:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\SharePod [2010.10.14 20:01:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Skype [2010.10.14 18:15:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\skypePM [2010.11.22 18:35:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Software Informer [2010.05.18 01:45:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Spesoft Audio Converter [2010.06.29 13:24:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Stereoscopic Player [2009.12.01 01:37:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Sun [2010.09.14 23:20:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\teamspeak2 [2010.03.24 18:30:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\TeamViewer [2010.10.05 16:53:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Telstra [2009.07.29 20:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Thinstall [2010.05.31 15:25:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\tidysongs15.27F6A35B76E5883BF9E6FEE514586561E60595CA.1 [2009.08.10 23:49:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\TomTom [2010.08.09 21:36:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\TS3Client [2009.11.04 12:57:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Uniblue [2010.01.14 07:41:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\URSoft [2010.11.30 23:36:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\uTorrent [2009.08.29 23:19:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ViquaSoft [2010.10.26 13:39:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\vlc [2010.11.08 11:12:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Vso [2010.07.10 06:26:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Winamp [2010.05.21 00:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions [2010.11.16 16:57:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WinRAR [2010.08.11 15:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Wuala [2010.05.18 01:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Xilisoft [2009.11.08 02:52:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\XLMSoft < %APPDATA%\*.exe /s > [2009.07.10 01:56:36 | 000,087,608 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\inst.exe [2010.06.30 06:25:07 | 000,693,765 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\unins000.exe [2009.08.07 19:03:03 | 000,272,384 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Acreon\WowMatrix\Modules\curl.exe [2010.07.17 18:12:17 | 021,855,283 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\ImTOO\iPhone Transfer Plus\iphone-transfer-plus.exe [2010.05.31 15:25:16 | 000,038,784 | ---- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2010.09.16 09:57:30 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe [2009.12.04 00:18:04 | 000,010,398 | R--- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Microsoft\Installer\{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}\_6FA99008F6BBB97A091E2D.exe [2009.12.04 00:18:04 | 000,025,214 | R--- | M] () -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Microsoft\Installer\{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}\_E38944F26F8D876B004311.exe [2010.08.05 23:07:29 | 089,280,248 | ---- | M] (Samsung Electronics Co., Ltd. ) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe [2010.09.03 19:34:46 | 005,436,584 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\CopyTrans.exe [2010.09.03 19:34:51 | 002,680,544 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\CopyTransControlCenter.exe [2010.09.03 19:34:47 | 001,225,944 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\CopyTransDoctor.exe [2010.09.03 19:39:59 | 006,951,096 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\CopyTransManager.exe [2010.09.03 19:34:48 | 003,514,024 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\iCloner.exe [2010.09.03 19:34:48 | 003,347,616 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\Papa2000\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\iLibs.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys < MD5 for: ATAPI.SYS > [2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2008.04.14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll [2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll < MD5 for: EXPLORER.EXE > [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\system32\dllcache\explorer.exe < MD5 for: NETLOGON.DLL > [2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll [2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll < MD5 for: NVGTS.SYS > [2009.07.08 20:43:25 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=75E2E77C5497F34E60491D27BF03F1CB -- C:\WINDOWS\NLDRV\001\nvgts.sys [2009.07.08 20:48:47 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=75E2E77C5497F34E60491D27BF03F1CB -- C:\WINDOWS\NLDRV\007\nvgts.sys [2009.07.08 20:54:34 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=75E2E77C5497F34E60491D27BF03F1CB -- C:\WINDOWS\NLDRV\014\nvgts.sys [2009.07.08 21:02:31 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=75E2E77C5497F34E60491D27BF03F1CB -- C:\WINDOWS\NLDRV\021\nvgts.sys [2009.07.08 21:02:31 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=75E2E77C5497F34E60491D27BF03F1CB -- C:\WINDOWS\system32\drivers\nvgts.sys [2009.07.08 20:43:29 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EB82606FCD8C5D039ADA33BD46FE7F8 -- C:\WINDOWS\NLDRV\002\nvgts.sys [2009.07.08 20:48:50 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EB82606FCD8C5D039ADA33BD46FE7F8 -- C:\WINDOWS\NLDRV\008\nvgts.sys [2009.07.08 20:54:36 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EB82606FCD8C5D039ADA33BD46FE7F8 -- C:\WINDOWS\NLDRV\015\nvgts.sys [2009.07.08 21:02:34 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EB82606FCD8C5D039ADA33BD46FE7F8 -- C:\WINDOWS\NLDRV\022\nvgts.sys < MD5 for: SCECLI.DLL > [2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll [2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll < MD5 for: USER32.DLL > [2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll [2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe [2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe [2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2009.07.09 20:10:59 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2009.07.09 20:10:59 | 001,093,632 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2009.07.09 20:10:59 | 000,483,328 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2008.04.14 13:00:00 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll [2008.04.14 13:00:00 | 000,357,888 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll [2008.04.14 13:00:00 | 000,205,312 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] ========== Alternate Data Streams ========== @Alternate Data Stream - 208 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:B3D74A13 @Alternate Data Stream - 168 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CE11B51 @Alternate Data Stream - 144 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D1B5B4F1 @Alternate Data Stream - 118 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:9D1B94FD @Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:FB1B13D8 @Alternate Data Stream - 112 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:95E14BBC < End of report > |
|
01.12.2010, 19:20
| #4 |
| | Internet Explorer öffnet sich selber und zeigt werbung! teil 2: OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 01.12.2010 18:50:20 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = D:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 72,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 341,80 Gb Total Space | 246,66 Gb Free Space | 72,17% Space Free | Partition Type: NTFS
Drive D: | 589,70 Gb Total Space | 261,06 Gb Free Space | 44,27% Space Free | Partition Type: NTFS
Drive K: | 1397,26 Gb Total Space | 325,74 Gb Free Space | 23,31% Space Free | Partition Type: NTFS
Drive N: | 1,89 Gb Total Space | 1,87 Gb Free Space | 98,91% Space Free | Partition Type: FAT32
Drive O: | 15,22 Gb Total Space | 12,72 Gb Free Space | 83,59% Space Free | Partition Type: FAT32
Computer Name: PRIVAT-59D871E0 | User Name: Papa2000 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\Programme\ACD Systems\ACDSee\6.0\ACDSee6.exe" "%1" (ACD Systems Ltd.)
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1 -- [2010.12.01 14:15:26 | 000,000,000 | ---D | M]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1 -- [2010.12.01 14:15:26 | 000,000,000 | ---D | M]
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1 -- [2010.12.01 14:15:26 | 000,000,000 | ---D | M]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1 -- [2010.12.01 14:15:26 | 000,000,000 | ---D | M]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig" = 0
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1 -- [2010.12.01 14:15:26 | 000,000,000 | ---D | M]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqpse.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ.exe -- File not found
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- File not found
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- File not found
"L:\1\utorrent16.exe" = L:\1\utorrent16.exe:*:Enabled:µTorrent -- File not found
"C:\Programme\InterVideo\DVD7\WinDVD.exe" = C:\Programme\InterVideo\DVD7\WinDVD.exe:*:Enabled:WinDVD -- (InterVideo Inc.)
"C:\Programme\Electronic Arts\BattleForge\Bootstrapper.exe" = C:\Programme\Electronic Arts\BattleForge\Bootstrapper.exe:*:Enabled:BattleForge™ Launcher -- (EA Phenomic)
"C:\Programme\Electronic Arts\BattleForge\BattleForge.exe" = C:\Programme\Electronic Arts\BattleForge\BattleForge.exe:*:Enabled:BattleForge™ -- (EA Phenomic)
"D:\BlueSoleil 6.4.237.0 PATCHED\BlueSoleilCS.exe" = D:\BlueSoleil 6.4.237.0 PATCHED\BlueSoleilCS.exe:*:Enabled:BlueSoleilCS -- File not found
"C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- File not found
"C:7\1\utorrent16.exe" = C:7\1\utorrent16.exe:*:Enabled:utorrent16.exe
"C:9\1\utorrent16.exe" = C:9\1\utorrent16.exe:*:Enabled:utorrent16.exe
"C:\Programme\CrossLoop\CrossLoopConnect.exe" = C:\Programme\CrossLoop\CrossLoopConnect.exe:*:Enabled:CrossLoop - Simple Secure Screen Sharing -- File not found
"D:9\1\utorrent16.exe" = D:9\1\utorrent16.exe:*:Enabled:utorrent16.exe
"C:\Programme\Mobiola Remote Control for S60\RemoteControlServer_S60.exe" = C:\Programme\Mobiola Remote Control for S60\RemoteControlServer_S60.exe:*:Enabled:Mobiola ® Remote Control Server -- File not found
"C:\Programme\Ultima Online 2D Client\client.exe" = C:\Programme\Ultima Online 2D Client\client.exe:*:Enabled:Ultima Online Client -- File not found
"C:\Programme\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe" = C:\Programme\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Programme\CryptLoad_1.1.6\RouterClient.exe" = C:\Programme\CryptLoad_1.1.6\RouterClient.exe:*:Enabled:RouterClient -- (hxxp://cryptload.info)
"C:\Programme\Totalcmd 7.5\TOTALCMD.EXE" = C:\Programme\Totalcmd 7.5\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit -- (C. Ghisler & Co.)
"C:\Programme\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe" = C:\Programme\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Games\Wolfenstein\MP\Wolf2MP.exe" = C:\Games\Wolfenstein\MP\Wolf2MP.exe:*:Enabled:Wolfenstein(TM) -- (Activision)
"C:\Games\Wolfenstein\MP\Wolf2MPLite.exe" = C:\Games\Wolfenstein\MP\Wolf2MPLite.exe:*:Enabled:Wolfenstein(TM) -- (Activision)
"L:\2\kffxhm.exe" = L:\2\kffxhm.exe:*:Enabled:kffxhm -- File not found
"L:\2\Patrick.exe" = L:\2\Patrick.exe:*:Enabled:Patrick -- File not found
"C:5\1\utorrent16.exe" = C:5\1\utorrent16.exe:*:Enabled:µTorrent
"D:\Renegade Paintball\PaintballGame.exe" = D:\Renegade Paintball\PaintballGame.exe:*:Enabled:Renegade Paintball -- File not found
"M:\Call of Duty 4 - Modern Warfare\iw3mp.exe" = M:\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) -- File not found
"O:\utorrent16.exe" = O:\utorrent16.exe:*:Enabled:µTorrent -- File not found
"N:\utorrent16.exe" = N:\utorrent16.exe:*:Enabled:µTorrent -- ()
"C:\Programme\Philips\Intelligent Agent\Philips Intelligent Agent.exe" = C:\Programme\Philips\Intelligent Agent\Philips Intelligent Agent.exe:*:Enabled:Philips Intelligent Agent -- (Philips Consumer Electronics)
"C:\Programme\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe" = C:\Programme\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Programme\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe" = C:\Programme\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"C:\Programme\World of Warcraft\Launcher.exe" = C:\Programme\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment)
"C:\Programme\iPhone Tunnel Suite\iTunnel\iTunnel.exe" = C:\Programme\iPhone Tunnel Suite\iTunnel\iTunnel.exe:*:Enabled:iTunnel -- File not found
"K:\utorrent16.exe" = K:\utorrent16.exe:*:Enabled:µTorrent -- File not found
"K:\Call of Duty 4 - Modern Warfare\iw3mp.exe" = K:\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:iw3mp -- File not found
"M:\utorrent16.exe" = M:\utorrent16.exe:*:Enabled:µTorrent -- File not found
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqpse.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"L:\utorrent16.exe" = L:\utorrent16.exe:*:Enabled:µTorrent -- File not found
"C:\Programme\Winamp\winamp.exe" = C:\Programme\Winamp\winamp.exe:*:Enabled:Winamp -- (Nullsoft)
"C:\Programme\Mobiola Headset for iPhone\HeadsetForIPhone.exe" = C:\Programme\Mobiola Headset for iPhone\HeadsetForIPhone.exe:*:Enabled:Mobiola Headset Server for iPhone -- (SHAPE Services)
"C:\Dokumente und Einstellungen\Papa2000\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Dokumente und Einstellungen\Papa2000\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- File not found
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe" = C:\Programme\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2 -- (EA Digital Illusions CE AB)
"D:\teamspeak3-server_win32\ts3server_win32.exe" = D:\teamspeak3-server_win32\ts3server_win32.exe:*:Enabled:TeamSpeak 3 Server -- File not found
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ.exe -- File not found
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03A7C57A-B2C8-409b-92E5-524A0DFD0DD3}" = Status
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0668DCFD-BC30-457D-85FC-A766E47A68D7}" = Deutsch - Custom
"{087A66B8-1F0F-4a8d-A649-0CFE276AA7C0}" = WebReg
"{08ED8855-4C2E-429B-A878-F129E1F624FA}" = SweetIM for Messenger 3.2
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.2 Build #3129 Banner Remover 1.0
"{0ADF1B89-17EA-489C-86DF-6E33DA8520A6}_is1" = flatster
"{0E37765E-45AE-4830-A12C-E5DADD758472}" = HP Photosmart D5400 Printer Driver Software 12.0 Rel .3
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A20BC22-8F21-4A2A-9F4A-E31FC0E5C7E3}" = ACDSee 6.0 PowerPack
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20EFC9AA-BBC1-4DFD-81FF-99654F71CBF8}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23C3F5C0-566B-478B-AAB6-197ADAD0C945}" = Uniblue SpeedUpMyPC 2009
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}" = SAMSUNG PC Share Manager
"{2A329FB6-389D-4396-A974-29656D6864AE}" = MarketResearch
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{31228E31-2BFF-11D2-8866-00805F0D9D40}" = QPST
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4360BB46-507E-4361-8DCB-4FF9BDC9907B}" = SnagIt 7
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CF669C6-D0E7-4755-B5D1-77A64923331E}" = Stereoscopic Player
"{4D304678-738E-42a0-931A-2B022F49DEB8}" = TrayApp
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{634F79E1-2A41-4C40-9E8D-89EC740AC9D6}" = Logitech Harmony Remote Software
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{69D598A7-A9C5-4396-8C92-39465FF2C874}" = Philips SPC530NC Webcam
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B36DEBF-27D0-4B1E-858D-D397091C6C7D}" = HP Precisionscan Pro 3.1
"{6EED4269-588D-45b8-A80C-26A9CA62EE4E}" = HPSSupply
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.4.8.123
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77E68EC4-4DC2-49D4-97A4-95C4928EB41F}_is1" = CD goes MP3 5
"{7B1AB7D9-EE2A-4446-ABC2-6F5E925F1DA2}_is1" = Leawo MKV Converter Version 3.0.0.1
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D42B43A-EA63-4234-B00A-757C15B2B185}_is1" = Leawo AVI Converter Version 3.0.0.1
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{800E784D-53E3-4948-B491-9E7FA5EACBDC}" = SmartWebPrinting
"{83258E90-1F76-4E13-9F60-A0F8ED41E76F}" = PC Connectivity Solution
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{35355EBA-4636-40B2-A995-FEB4CDBD92B3}" =
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 14
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90885A82-9673-49EA-AB39-AF776639C67C}" = InterVideo WinDVD 7
"{915B97D7-585F-48DE-9E62-47F916514854}" = D5400
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9603DE6D-4567-4b78-B941-849322373DE2}" = SolutionCenter
"{993A94A9-DCE3-4774-B35D-D8C74FC1E0BE}" = Royale Remixed Theme
"{99E66BC9-E4B6-485F-ABFC-31EFCE36DFDF}" = Microsoft Keyboard Layout Creator 1.4
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D1B99B7-DAD8-440d-B4FB-1915332FBCC2}" = HPProductAssistant
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6CC2CA2-2779-4F10-88BF-A3C9EB874C24}" = SweetIM Toolbar for Internet Explorer 3.9
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AAF4238F-7C29-451D-9925-C753271A5728}" = Microsoft Visual C++ Run Time Lib Setup
"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B28635AB-1DF3-4F07-BFEA-975D911B549B}" = hpphotosmartdisclabelplugin
"{B3C125F4-D272-494C-B55F-7D74763056B0}" = RealOptimizer ACD plug-in
"{B63FAB20-EA87-4C20-AA28-32DC973D5751}" = Pandora's GUI
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1080852-065E-4991-9260-F3756E3CC182}" = CursorFX
"{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}" = iPhoneBrowser
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}" = Nokia Connectivity Cable Driver
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C9FB868B-2086-4EE2-BD4F-BFBA36B131F4}" = NCsoft Launcher
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1E0E859-F46D-4708-A41D-ED90C0C1822A}" = Acronis*True*Image*Home
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{D9D8F2CF-FE2D-4644-9762-01F916FE90A9}" = HPPhotoSmartDiscLabel_PaperLabel
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E192A201-E9B4-406A-82D5-7886F3BB63D5}" = PS_SF_03_D5400_Software_Min
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin 2.4
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster 2010
"{E76EE654-B511-438F-B636-501C06A4A9CD}" = ithemeit v1.2
"{EA57A1B9-0DD2-44DD-9B70-64E8DA553F6F}" = Philips VLounge
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE37E5AB-7CFB-48F7-90E2-B0FC864BC6E0}_is1" = freundin - Ice Cream Rush
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0EA8DA6-8EF1-48FF-A00D-BE0BA4D25BE8}_is1" = Jewel Master - Reise um die Welt
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F648FD09-7CEA-4257-BC68-A8389189FD51}" = GPBaseService2
"{F769B78E-FF0E-4db5-95E2-9F4C8D6352FE}" = DeviceDiscovery
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"{FE3B9518-9FF3-4D89-8A8D-E540C9CCAF3B}" = NVIDIA 3D Vision Video Player
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"181B29655BDD6EA3FC483A7E4D1C2ED7735873F0" = Windows Driver Package - Apple Inc. Apple Keyboard (08/30/2007 2.0.1.4)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"5D5FAC15E9954C7F600E51E3590586168AA03196" = Windows Driver Package - Apple Inc. Apple Keyboard (07/18/2007 2.0.0.7)
"6784A318842714811EC3F8409C3C0F7983B90972" = Windows Driver Package - Apple Inc. Apple Built-in iSight (04/09/2007 1.3.0.0)
"756BFB266C8760D1D00122B70966CA693484E29B" = Windows-Treiberpaket - Philips (SPC530) Image (02/27/2008 1.00.4.6100)
"91D233945AC579799497E31FDBCE2ADE532DFF57" = Windows Driver Package - Apple Inc. Apple Trackpad Enabler (04/19/2007 1.3.0.2)
"A2F03250749AF7ECADB8B8894CA30D5E0AD9CBEF" = Windows-Treiberpaket - Philips CL (phaudlwr) MEDIA (02/19/2008 1.0.2.9)
"Acoustica CD/DVD Label Maker" = Acoustica CD/DVD Label Maker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AFAB78AF95690158BFA2E1AF801302F4B19957D7" = Windows Driver Package - Apple Inc. Apple Trackpad (04/19/2007 1.3.0.2)
"Animated Waterfalls II_is1" = Animated Waterfalls II
"Any DVD Converter Professional_is1" = Any DVD Converter Professional 3.7.1
"Ashampoo Burning Studio 2010_is1" = Ashampoo Burning Studio 2010
"Ashampoo Burning Studio 9 Theme Pack_is1" = Ashampoo Burning Studio 9 Theme Pack
"Ashampoo Burning Studio 9_is1" = Ashampoo Burning Studio 9.12
"Audio 180%" = Audio 180%
"AVIConverter" = AVIConverter 5.1.6
"AviSynth" = AviSynth 2.5
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS Video Recorder_is1" = AVS Video Recorder 2.4
"AVS Video ReMaker_is1" = AVS Video ReMaker 3.1.1.83
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"Bejeweled Twist" = Bejeweled Twist
"BitTornado" = BitTornado 0.3.18
"CCleaner" = CCleaner (remove only)
"ClassicPro" = ClassicPro© v1.14
"ClicKalender_is1" = ClicKalender 1.24.1
"CloneCD" = CloneCD
"CTDVDAudio Plugin" = Creative DVD Audio Plugin for Audigy Series
"CursorFX" = CursorFX
"Daniusoft Digital Music Converter_is1" = Daniusoft Digital Music Converter(Build 2.4.1.0)
"DelinvFile_is1" = DelinvFile - 4.03
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"dlanconf" = devolo dLAN-Konfigurationsassistent
"DSGPlayer" = DEUTSCHLAND SPIELT GAME CENTER
"dslmon" = devolo Informer
"DVD to DivX Converter 4" = DVD to DivX Converter 4
"ElsterFormular 11.1.2.3848" = ElsterFormular
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FormatFactory" = FormatFactory 2.20
"Foxit Reader" = Foxit Reader
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Convert Youtube FLV to Audio MP3 Converter_is1" = Free Convert Youtube FLV to Audio MP3 Converter 6.1
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"GOM Player" = GOM Player
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 12.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 12.0
"HPExtendedCapabilities" = HP Customer Participation Program 12.0
"ICQToolbar" = ICQ Toolbar
"ImgBurn" = ImgBurn
"ImTOO iPhone Ringtone Maker" = ImTOO iPhone Ringtone Maker
"ImTOO iPhone Transfer Plus" = ImTOO iPhone Transfer Plus
"InstallShield_{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}" = SAMSUNG PC Share Manager
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"IsoBuster_is1" = IsoBuster 2.8
"JDownloader" = JDownloader
"Joboshare DVD Copy" = Joboshare DVD Copy
"Joboshare DVD Creator" = Joboshare DVD Creator
"Joboshare iPhone Video Converter" = Joboshare iPhone Video Converter
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.1.0 (Basic)
"LabelsWin Lite" = LabelsWin Lite
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MKVtoolnix" = MKVtoolnix 4.4.0
"Mobiola Headset for iPhone_is1" = Mobiola Headset for iPhone 1.0.36
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"Mp3tag" = Mp3tag v2.46a
"NAV" = Norton AntiVirus
"NAVIGON Fresh" = NAVIGON Fresh 1.6.2
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"ObjectDock" = ObjectDock
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Philips Intelligent Agent_is1" = Philips Intelligent Agent
"PunkBusterSvc" = PunkBuster Services
"RapidShare Plus 4 1.00" = RapidShare Plus 4 1.00
"Registry First Aid_is1" = Registry First Aid
"Registry Mechanic_is1" = Registry Mechanic 8.0
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"Shop for HP Supplies" = Shop for HP Supplies
"Shutdown4U" = Shutdown4U
"SP6" = Logitech SetPoint 6.15
"Spesoft Audio Converter_is1" = Spesoft Audio Converter 1.80
"TBSB00982.TBSB00982Toolbar" = Ant.com Toolbar
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Teamspeak German" = Teamspeak German
"TeamViewer 5" = TeamViewer 5
"Totalcmd" = Total Commander (Remove or Repair)
"UnderCoverXP_is1" = UnderCoverXP 1.22
"Uniblue SpeedUpMyPC 2009" = Uniblue SpeedUpMyPC 2009
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"VLC media player" = VLC media player 1.0.5
"WBFS Manager 3.0" = WBFS Manager 3.0
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinGimp-2.0_is1" = GIMP 2.6.3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 beta 1 (32-bit)
"WMFDist11" = Windows Media Format 11 runtime
"World of Warcraft" = World of Warcraft
"Xilisoft DVD to DivX Converter 5" = Xilisoft DVD to DivX Converter 5
"Xilisoft MKV Converter" = Xilisoft MKV Converter
"XP Codec Pack" = XP Codec Pack
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar mit Pop-Up-Blocker
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager
"Youtube Downloader HD_is1" = Youtube Downloader HD v. 1.7
"YU2010_is1" = Your Uninstaller! 2010
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CopyTrans Suite" = Nur Deinstallierung der CopyTrans Suite möglich.
"Meebo Notifier" = Meebo Notifier
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 01.12.2010 01:53:24 | Computer Name = PRIVAT-59D871E0 | Source = WinMgmt | ID = 10
Description = Ereignisfilter mit Abfrage "SELECT * FROM __InstanceOperationEvent
WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct'"
konnte im Namespace "//./ROOT/SecurityCenter" nicht (re-)aktiviert werden aufgrund
des Fehlers 0x80041010. Ereignisse können möglicherweise nicht durch diesen Filter
geschickt
werden, bis dieses Problem gelöst ist.
Error - 01.12.2010 01:53:24 | Computer Name = PRIVAT-59D871E0 | Source = SecurityCenter | ID = 1804
Description = Es konnten keine Instanzen von AntiVirusProduct aus der WMI geladen
werden.
Error - 01.12.2010 02:36:11 | Computer Name = PRIVAT-59D871E0 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 6.0.2900.5512, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x02340fa3.
Error - 01.12.2010 04:17:52 | Computer Name = PRIVAT-59D871E0 | Source = WinMgmt | ID = 10
Description = Ereignisfilter mit Abfrage "SELECT * FROM __InstanceOperationEvent
WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct'"
konnte im Namespace "//./ROOT/SecurityCenter" nicht (re-)aktiviert werden aufgrund
des Fehlers 0x80041010. Ereignisse können möglicherweise nicht durch diesen Filter
geschickt
werden, bis dieses Problem gelöst ist.
Error - 01.12.2010 04:17:52 | Computer Name = PRIVAT-59D871E0 | Source = SecurityCenter | ID = 1804
Description = Es konnten keine Instanzen von AntiVirusProduct aus der WMI geladen
werden.
Error - 01.12.2010 05:29:29 | Computer Name = PRIVAT-59D871E0 | Source = Bonjour Service | ID = 100
Description = 372: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 01.12.2010 06:33:21 | Computer Name = PRIVAT-59D871E0 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 6.0.2900.5512, fehlgeschlagenes
Modul mgtoolbarie.dll, Version 3.9.0.7, Fehleradresse 0x00069dd8.
Error - 01.12.2010 08:48:16 | Computer Name = PRIVAT-59D871E0 | Source = MsiInstaller | ID = 11719
Description = Product: TrayApp -- Error 1719. The Windows Installer Service could
not be accessed. This can occur if you are running Windows in safe mode, or if
the Windows Installer is not correctly installed. Contact your support personnel
for assistance.
Error - 01.12.2010 08:51:10 | Computer Name = PRIVAT-59D871E0 | Source = WinMgmt | ID = 10
Description = Ereignisfilter mit Abfrage "SELECT * FROM __InstanceOperationEvent
WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct'"
konnte im Namespace "//./ROOT/SecurityCenter" nicht (re-)aktiviert werden aufgrund
des Fehlers 0x80041010. Ereignisse können möglicherweise nicht durch diesen Filter
geschickt
werden, bis dieses Problem gelöst ist.
Error - 01.12.2010 08:51:10 | Computer Name = PRIVAT-59D871E0 | Source = SecurityCenter | ID = 1804
Description = Es konnten keine Instanzen von AntiVirusProduct aus der WMI geladen
werden.
[ OSession Events ]
Error - 05.08.2009 02:27:59 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 936
seconds with 180 seconds of active time. This session ended with a crash.
Error - 06.10.2009 07:32:16 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 10
seconds with 0 seconds of active time. This session ended with a crash.
Error - 29.10.2009 07:21:46 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 15
seconds with 0 seconds of active time. This session ended with a crash.
Error - 31.10.2009 15:13:49 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 44
seconds with 0 seconds of active time. This session ended with a crash.
Error - 16.11.2009 17:20:41 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 20
seconds with 0 seconds of active time. This session ended with a crash.
Error - 03.12.2009 18:10:13 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 68
seconds with 60 seconds of active time. This session ended with a crash.
Error - 09.12.2009 01:52:58 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 167
seconds with 120 seconds of active time. This session ended with a crash.
Error - 01.03.2010 01:59:07 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16
seconds with 0 seconds of active time. This session ended with a crash.
Error - 03.08.2010 12:45:09 | Computer Name = PRIVAT-59D871E0 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 55
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 30.11.2010 22:05:05 | Computer Name = PRIVAT-59D871E0 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 30.11.2010 22:08:45 | Computer Name = PRIVAT-59D871E0 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 30.11.2010 22:09:40 | Computer Name = PRIVAT-59D871E0 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 30.11.2010 22:12:50 | Computer Name = PRIVAT-59D871E0 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 01.12.2010 01:53:25 | Computer Name = PRIVAT-59D871E0 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "KeyAgent" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 01.12.2010 01:53:25 | Computer Name = PRIVAT-59D871E0 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Mac HAL" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 01.12.2010 04:17:52 | Computer Name = PRIVAT-59D871E0 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "KeyAgent" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 01.12.2010 04:17:52 | Computer Name = PRIVAT-59D871E0 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Mac HAL" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 01.12.2010 08:51:10 | Computer Name = PRIVAT-59D871E0 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "KeyAgent" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 01.12.2010 08:51:10 | Computer Name = PRIVAT-59D871E0 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Mac HAL" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
< End of report >
|
|
01.12.2010, 19:33
| #5 |
| /// Malware-holic | Internet Explorer öffnet sich selber und zeigt werbung! • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. :OTL PRC - C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Temp\Pcr.exe () O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [JP595IR86O] C:\Dokumente und Einstellungen\Papa2000\Lokale Einstellungen\Temp\Pcr.exe () O4 - HKU\S-1-5-21-1202660629-1645522239-682003330-1003..\Run: [HKCU] C:\WINDOWS\system32\wfreg.exe (Twain Working Group) O4 - HKLM..\Run: [HKLM] C:\WINDOWS\system32\wfreg.exe (Twain Working Group) :Files :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten. öffne den arbeitsplatz, c: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. lade das archiv in unserem upload channel hoch. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
01.12.2010, 21:10
| #6 |
| | Internet Explorer öffnet sich selber und zeigt werbung! hallo wie lade ich das bitte in den upload cannal mfg angelika |
|
01.12.2010, 21:13
| #7 |
| | Internet Explorer öffnet sich selber und zeigt werbung! habs hochgeladen  mfg Angelika |
|
01.12.2010, 21:19
| #8 |
| /// Malware-holic | Internet Explorer öffnet sich selber und zeigt werbung! download malwarebytes: Malwarebytes instalieren, öffnen, registerkarte aktualisierung, programm updaten. schalte alle laufenden programme ab, trenne die internetverbindung. registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
01.12.2010, 22:26
| #9 |
| | Internet Explorer öffnet sich selber und zeigt werbung! hier der log mfg Angelika Malwarebytes' Anti-Malware 1.50 www.malwarebytes.org Datenbank Version: 5228 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 01.12.2010 22:26:08 mbam-log-2010-12-01 (22-26-08).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 267081 Laufzeit: 43 Minute(n), 10 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 2 Infizierte Registrierungsschlüssel: 8 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 2 Infizierte Dateien: 13 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: c:\programme\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot. c:\programme\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\6BTOP2GA8A (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Microwsoft (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: c:\programme\relevantknowledge (Spyware.MarketScore) -> Delete on reboot. c:\programme\relevantknowledge\components (Spyware.MarketScore) -> Delete on reboot. Infizierte Dateien: c:\programme\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot. c:\programme\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> Delete on reboot. c:\programme\cryptload_1.1.6\ocr\netload.in\asmcaptcha\test.exe (Malware.Packer) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP639\A0116025.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP639\A0116026.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP639\A0116027.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP639\A0116028.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP639\A0116037.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP640\A0116120.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP640\A0116121.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP640\A0116122.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\system volume information\_restore{a399885d-9654-4f77-8657-fe5c60b4c0f4}\RP640\A0116123.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully. |
|
02.12.2010, 11:23
| #10 |
| /// Malware-holic | Internet Explorer öffnet sich selber und zeigt werbung! bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Internet Explorer öffnet sich selber und zeigt werbung! |
| antispyware, antivirus, bho, bonjour, browser, converter, einstellungen, explorer, firefox, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, intrusion prevention, microsoft office 2010, mozilla, mp3, plug-in, pop-up-blocker, rundll, senden, software, sweetim, symantec, system, temp, warum, werbung, windows, windows xp, öffnet, öffnet sich selber |
Linear-Darstellung
