Trojaner-Board - Achtung Windows gesperrt! 50€ bezahlen damit es wieder funktioniert!

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Achtung Windows gesperrt! 50€ bezahlen damit es wieder funktioniert! (https://www.trojaner-board.de/109182-achtung-windows-gesperrt-50-bezahlen-damit-funktioniert.html)

Achtung Windows gesperrt! 50€ bezahlen damit es wieder funktioniert!

Guten Abend allesamt.
Als ich heute im I-net gesurft bin, öffnete sich plötzlich ein Fenster mit nem roten Schriftzug "Achtung, Ihr Windows wurde gesperrt". Zudem solle ich 50€ bezahlen, damit alles infizierte gelöscht werden kann. Danach konnte ich nur auf den 'bezahlen' Button klicken. Weder der Taskmanager konnte geöffnet werden, noch konnte ich dieses Fenster schließen. Seitdem öffnet sich das Fenster bei jedem Windowsstart.
Zudem habe ich ein Problem mit DDS, wollte nicht starten. Hatte alle Programme geschlossen, aber es lief nicht durch.

MfG marcy

hi,
neustarten, f8 drücken abgesicherter modus mit netzwerk.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hey,
alles klar danke!
Hier erstmal der OTL.txt

Code:

OTL logfile created on: 05.02.2012 21:52:15 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\marcy\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 80,69% Memory free

6,19 Gb Paging File | 5,90 Gb Available in Paging File | 95,16% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 445,75 Gb Total Space | 296,28 Gb Free Space | 66,47% Space Free | Partition Type: NTFS

Drive D: | 19,99 Gb Total Space | 10,33 Gb Free Space | 51,68% Space Free | Partition Type: FAT32

 

Computer Name: MARCY-PC | User Name: marcy | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.02.05 21:50:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\marcy\Desktop\OTL.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2010.03.10 14:41:04 | 000,040,448 | ---- | M] () -- C:\Users\marcy\AppData\Local\Temp\CMDLIN~1.DLL

MOD - [2007.09.20 17:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.10.21 15:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)

SRV - [2011.06.28 19:59:22 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.05.05 14:24:37 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.07.04 18:07:40 | 000,238,952 | ---- | M] (Teruten) [Auto | Stopped] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)

SRV - [2010.02.13 11:43:27 | 000,326,792 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2008.07.26 07:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)

SRV - [2008.07.26 07:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)

SRV - [2008.05.27 13:23:24 | 000,069,120 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe -- (GoogleDesktopManager)

SRV - [2008.04.07 08:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.04.13 17:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Auto | Stopped] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.10.15 09:53:00 | 010,327,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2011.06.28 19:59:23 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 19:59:23 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.07.18 15:41:34 | 000,165,376 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2010.07.18 15:41:32 | 000,018,048 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2010.06.14 08:32:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)

DRV - [2010.04.27 03:25:16 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)

DRV - [2010.04.27 03:25:16 | 000,098,432 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)

DRV - [2010.04.27 03:25:16 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)

DRV - [2010.03.10 00:13:26 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.06.06 11:52:05 | 000,029,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Users\marcy\AppData\Local\Temp\iMSPCLOj.sys -- (iMSPCLOj)

DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.07.26 07:25:02 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)

DRV - [2008.02.15 15:17:14 | 000,041,456 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Stopped] -- C:\Programme\HomeCinema\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.02.14 14:56:02 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.01.17 21:35:30 | 000,041,456 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Stopped] -- C:\Programme\HomeCinema\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B})

DRV - [2008.01.16 17:27:56 | 000,174,600 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\ahcix86s.sys -- (ahcix86s)

DRV - [2007.11.21 11:35:06 | 000,569,344 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)

DRV - [2007.10.12 02:40:14 | 000,010,632 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdide.sys -- (amdide)

DRV - [2007.10.12 01:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)

DRV - [2007.10.12 00:56:00 | 001,279,000 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)

DRV - [2007.09.17 14:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)

DRV - [2007.07.01 12:31:22 | 000,007,680 | ---- | M] (Philips                                                     ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SPC620m.sys -- (SPC620m)

DRV - [2007.07.01 12:31:10 | 000,484,864 | ---- | M] (Philips                                                     ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SPC620.sys -- (SPC620)

DRV - [2006.10.30 16:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Search Results"

FF - prefs.js..browser.search.defaultthis.engineName: "Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Search Results"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3

FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0

FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2

FF - prefs.js..extensions.enabledItems: 4

FF - prefs.js..extensions.enabledItems: 9

FF - prefs.js..extensions.enabledItems: 1

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2

FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=417&q="

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.11.02 17:17:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.05 20:03:13 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.05 14:25:11 | 000,000,000 | ---D | M]

 

[2011.08.06 23:02:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marcy\AppData\Roaming\mozilla\Extensions

[2011.08.04 21:53:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions

[2010.04.27 16:25:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.06.01 06:37:19 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2010.06.24 10:40:54 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2010.04.30 18:28:50 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.03.27 20:34:01 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\engine@conduit.com

[2009.11.11 21:14:22 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\firefox@tvunetworks.com

[2011.05.06 14:59:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marcy\AppData\Roaming\mozilla\Firefox\Profiles\50oc1zhb.default\extensions\nostmp

[2008.09.21 21:56:14 | 000,000,681 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\ask.xml

[2010.07.18 03:58:07 | 000,002,383 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\askcom.xml

[2010.08.05 17:20:01 | 000,000,873 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\conduit.xml

[2012.01.30 16:59:07 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-1.xml

[2009.03.05 22:26:22 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-10.xml

[2009.03.28 19:53:32 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-11.xml

[2009.04.24 18:23:40 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-12.xml

[2009.04.28 21:32:24 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-13.xml

[2009.06.14 21:08:50 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-14.xml

[2009.07.25 13:02:07 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-15.xml

[2009.08.04 03:49:28 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-16.xml

[2009.09.13 20:11:26 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-17.xml

[2009.10.29 17:47:34 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-18.xml

[2009.12.17 14:40:11 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-19.xml

[2008.05.30 10:19:47 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-2.xml

[2010.01.06 17:30:31 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-20.xml

[2010.06.24 10:41:01 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-21.xml

[2010.07.18 16:15:59 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-22.xml

[2010.07.24 20:39:23 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-23.xml

[2010.08.06 01:30:25 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-24.xml

[2010.09.16 13:18:33 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-25.xml

[2010.10.20 22:48:29 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-26.xml

[2010.10.28 20:45:13 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-27.xml

[2010.12.10 16:46:26 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-28.xml

[2011.03.02 23:14:57 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-29.xml

[2008.07.02 16:56:32 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-3.xml

[2011.03.06 12:52:24 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-30.xml

[2011.03.25 00:45:18 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-31.xml

[2011.04.30 19:53:19 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-32.xml

[2011.05.06 15:09:52 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-33.xml

[2008.07.04 00:09:57 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-4.xml

[2008.08.02 11:21:43 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-5.xml

[2008.09.28 11:24:25 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-6.xml

[2008.11.14 17:01:07 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-7.xml

[2008.12.23 00:34:39 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-8.xml

[2009.02.08 18:24:58 | 000,000,950 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin-9.xml

[2010.04.22 12:33:22 | 000,000,945 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\icqplugin.xml

[2011.08.01 20:34:33 | 000,002,497 | ---- | M] () -- C:\Users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\searchplugins\SearchResults.xml

[2012.02.05 20:03:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2008.05.27 14:11:45 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2009.03.18 23:29:30 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.11.11 18:53:21 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.06.22 20:48:58 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.08.01 20:34:33 | 000,002,497 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml

[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Search Results (Enabled)

CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=417&q={searchTerms}

CHR - default_search_provider: suggest_url = 

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.77\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.77\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Skype Toolbars (Enabled) = C:\Users\marcy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll

CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll

CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: RealNetworks(tm) Chrome Background Extension Plug-In (32-bit)  (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll

CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)  (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = c:\program files\real\realplayer\Netscape6\nppl3260.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files\real\realplayer\Netscape6\nprpjplug.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files\real\realplayer\Netscape6\nprjplug.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\marcy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\

CHR - Extension: Skype Click to Call = C:\Users\marcy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\

 

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (ICQ Inc.)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink)

O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()

O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()

O4 - HKLM..\Run: [NPSStartup]  File not found

O4 - HKLM..\Run: [PlayMovie] C:\Program Files\HomeCinema\PlayMovie\PMVService.exe (CyberLink Corp.)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( )

O4 - HKLM..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" File not found

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found

O4 - HKCU..\Run: [Firefox helper] C:\Users\marcy\AppData\Local\Mozilla\Firefox\firefox.exe ()

O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O4 - HKCU..\Run: [igyrn.exe] C:\Users\marcy\AppData\Roaming\Wodi\igyrn.exe File not found

O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

O4 - HKCU..\Run: [Wisdom-soft AutoScreenRecorder 3.1 Free] 0 File not found

O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\marcy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Ranges: GD ([http] in Lokales Intranet)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D332E482-6FF8-4C02-A9CE-E091AB594006}: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\marcy\Desktop\bilder\Urlaub\Kroatien 2010\IMG_0403.JPG

O24 - Desktop BackupWallPaper: C:\Users\marcy\Desktop\bilder\Urlaub\Kroatien 2010\IMG_0403.JPG

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{d0168a31-1e09-11df-b2c0-001d92ea91aa}\Shell - "" = AutoRun

O33 - MountPoints2\{d0168a31-1e09-11df-b2c0-001d92ea91aa}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a

O33 - MountPoints2\{ea445421-2be7-11dd-bdba-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{ea445421-2be7-11dd-bdba-806e6f6e6963}\Shell\AutoRun\command - "" = H:\DemoRun.exe AUTO

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {76C19B34-F0C8-11cf-87CC-0020AFEECF20} - Simp Chinese Language Pack

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

CREATERESTOREPOINT

Error creating restore point.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.02.05 21:50:57 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\marcy\Desktop\OTL.exe

[2012.02.05 20:11:05 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\marcy\Desktop\dds.scr

[2012.01.21 19:58:24 | 000,000,000 | ---D | C] -- C:\Users\marcy\Desktop\Neuer Ordner

[2012.01.18 21:09:25 | 000,000,000 | ---D | C] -- C:\Users\marcy\Desktop\22.12.11

[2012.01.18 21:09:23 | 000,000,000 | ---D | C] -- C:\Users\marcy\Desktop\31.12.11

[2012.01.18 21:09:03 | 000,000,000 | ---D | C] -- C:\Users\marcy\Desktop\04.01.12

[2012.01.18 21:09:00 | 000,000,000 | ---D | C] -- C:\Users\marcy\Desktop\07.01.12

[2012.01.18 21:08:55 | 000,000,000 | ---D | C] -- C:\Users\marcy\Desktop\13.01.12

[2012.01.17 16:29:11 | 000,000,000 | ---D | C] -- C:\Users\marcy\Documents\ESItronic

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.02.05 21:50:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\marcy\Desktop\OTL.exe

[2012.02.05 20:11:07 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\marcy\Desktop\dds.scr

[2012.02.05 20:09:13 | 000,302,592 | ---- | M] () -- C:\Users\marcy\Desktop\sb8t2i0e.exe

[2012.02.05 20:08:40 | 000,050,477 | ---- | M] () -- C:\Users\marcy\Desktop\Defogger.exe

[2012.02.05 20:03:14 | 000,000,850 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.02.05 20:00:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.02.05 19:49:31 | 000,008,592 | ---- | M] () -- C:\Users\marcy\AppData\Local\d3d9caps.dat

[2012.02.05 19:49:29 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.02.05 19:49:20 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.02.05 19:49:20 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.02.05 19:11:00 | 000,000,176 | ---- | M] () -- C:\Users\marcy\defogger_reenable

[2012.02.05 14:22:10 | 000,000,887 | ---- | M] () -- C:\Windows\uninst.ini

[2012.02.05 14:13:02 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.02.04 20:46:20 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{1922FA07-57FA-436F-B50B-CB628AD604EF}.job

[2012.01.27 17:27:38 | 000,095,418 | ---- | M] () -- C:\Users\marcy\Desktop\Microsoft Word - b0027362.pdf

[2012.01.23 21:38:01 | 011,923,854 | ---- | M] () -- C:\Users\marcy\Desktop\geschafft.bmp

[2012.01.23 20:49:07 | 011,923,854 | ---- | M] () -- C:\Users\marcy\Desktop\text.bmp

[2012.01.14 19:05:51 | 003,141,035 | ---- | M] () -- C:\Users\marcy\Desktop\R.I.O feat. U- jean - Turn this Club around HQ.mp3

[2012.01.14 17:16:49 | 000,229,403 | ---- | M] () -- C:\Users\marcy\Desktop\IMG_3770.JPG

[2012.01.14 17:16:34 | 000,249,367 | ---- | M] () -- C:\Users\marcy\Desktop\IMG_3769.JPG

[2012.01.14 17:16:21 | 000,182,603 | ---- | M] () -- C:\Users\marcy\Desktop\IMG_3757.JPG

[2012.01.13 18:07:50 | 000,038,888 | ---- | M] () -- C:\Users\marcy\Desktop\374664_309753175735480_100001024003410_937764_1930566249_n.jpg

[2012.01.13 16:47:09 | 000,054,444 | ---- | M] () -- C:\Users\marcy\Desktop\306864_2314933588382_1100712642_32694846_532874460_n.jpg

[2012.01.13 05:39:01 | 000,019,031 | ---- | M] () -- C:\Users\marcy\Desktop\Fifa11 Leistungen.ods

[2012.01.12 05:36:55 | 000,674,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.12 05:36:55 | 000,634,202 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.12 05:36:55 | 000,146,028 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.12 05:36:55 | 000,119,766 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.07 21:08:45 | 000,063,937 | ---- | M] () -- C:\Users\marcy\Desktop\fotolia_19263684_xs.jpg

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.02.05 20:09:12 | 000,302,592 | ---- | C] () -- C:\Users\marcy\Desktop\sb8t2i0e.exe

[2012.02.05 20:03:14 | 000,000,862 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.02.05 20:03:14 | 000,000,850 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.02.05 19:10:47 | 000,000,176 | ---- | C] () -- C:\Users\marcy\defogger_reenable

[2012.02.05 19:03:20 | 000,050,477 | ---- | C] () -- C:\Users\marcy\Desktop\Defogger.exe

[2012.02.05 14:22:10 | 000,000,887 | ---- | C] () -- C:\Windows\uninst.ini

[2012.01.27 17:27:36 | 000,095,418 | ---- | C] () -- C:\Users\marcy\Desktop\Microsoft Word - b0027362.pdf

[2012.01.23 21:38:01 | 011,923,854 | ---- | C] () -- C:\Users\marcy\Desktop\geschafft.bmp

[2012.01.23 20:49:07 | 011,923,854 | ---- | C] () -- C:\Users\marcy\Desktop\text.bmp

[2012.01.14 19:05:19 | 003,141,035 | ---- | C] () -- C:\Users\marcy\Desktop\R.I.O feat. U- jean - Turn this Club around HQ.mp3

[2012.01.14 17:16:44 | 000,229,403 | ---- | C] () -- C:\Users\marcy\Desktop\IMG_3770.JPG

[2012.01.14 17:16:29 | 000,249,367 | ---- | C] () -- C:\Users\marcy\Desktop\IMG_3769.JPG

[2012.01.14 17:16:17 | 000,182,603 | ---- | C] () -- C:\Users\marcy\Desktop\IMG_3757.JPG

[2012.01.13 18:07:49 | 000,038,888 | ---- | C] () -- C:\Users\marcy\Desktop\374664_309753175735480_100001024003410_937764_1930566249_n.jpg

[2012.01.13 16:47:08 | 000,054,444 | ---- | C] () -- C:\Users\marcy\Desktop\306864_2314933588382_1100712642_32694846_532874460_n.jpg

[2012.01.07 21:08:44 | 000,063,937 | ---- | C] () -- C:\Users\marcy\Desktop\fotolia_19263684_xs.jpg

[2011.12.23 01:08:32 | 000,138,056 | ---- | C] () -- C:\Users\marcy\AppData\Roaming\PnkBstrK.sys

[2011.12.03 16:08:39 | 000,002,682 | ---- | C] () -- C:\Windows\RBSystem.ini

[2011.12.03 16:04:46 | 000,012,800 | ---- | C] () -- C:\Windows\System32\PWUtility.dll

[2011.12.03 16:04:46 | 000,007,168 | ---- | C] () -- C:\Windows\System32\dtctrace.dll

[2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.02.21 20:22:41 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010.07.26 00:49:58 | 000,000,040 | ---- | C] () -- C:\Windows\RSoftInfo.dat

[2010.07.18 15:41:34 | 000,165,376 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2010.07.18 15:41:32 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2010.06.14 13:05:26 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll

[2010.06.14 13:05:26 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys

[2010.06.14 13:05:17 | 000,002,528 | ---- | C] () -- C:\Users\marcy\AppData\Roaming\$_hpcst$.hpc

[2010.04.11 17:07:06 | 000,000,760 | ---- | C] () -- C:\Users\marcy\AppData\Roaming\setup_ldm.iss

[2009.10.11 04:55:25 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2009.09.11 23:18:46 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.11 23:18:46 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.04.05 18:18:52 | 000,000,473 | ---- | C] () -- C:\Windows\eReg.dat

[2009.02.16 19:33:21 | 000,000,007 | ---- | C] () -- C:\Windows\sbacknt.bin

[2009.01.03 01:48:40 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll

[2008.09.17 23:02:23 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.08.07 23:41:09 | 000,140,072 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2008.08.07 23:41:04 | 000,280,904 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2008.08.07 23:40:57 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe

[2008.07.26 07:25:02 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys

[2008.06.06 12:55:44 | 000,008,592 | ---- | C] () -- C:\Users\marcy\AppData\Local\d3d9caps.dat

[2008.05.27 16:16:09 | 000,069,120 | ---- | C] () -- C:\Users\marcy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.05.27 14:11:48 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2008.05.27 13:33:41 | 000,000,093 | ---- | C] () -- C:\Users\marcy\AppData\Local\fusioncache.dat

[2008.04.30 10:28:46 | 000,000,052 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT

[2008.04.01 14:13:07 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll

[2008.04.01 14:13:06 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini

[2008.03.31 11:55:09 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.01.21 08:15:58 | 000,674,344 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 08:15:58 | 000,146,028 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2007.10.25 16:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys

[2007.10.12 00:11:58 | 000,059,500 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,402,328 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,634,202 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,119,766 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2004.01.26 16:15:29 | 000,233,472 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe

[2004.01.26 16:15:29 | 000,233,472 | R--- | C] () -- C:\Users\marcy\AppData\Roaming\MafiaSetup.exe

 
 ========== LOP Check ==========

 

[2010.04.30 00:26:04 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\.purple

[2009.02.04 22:30:26 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Azureus

[2009.01.03 01:48:58 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\concept design

[2010.03.10 00:17:20 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\DAEMON Tools Lite

[2011.02.25 17:37:57 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.06 22:59:49 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\FreeScreenToVideo

[2010.02.14 21:54:04 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\gtk-2.0

[2012.02.02 21:41:55 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\ICQ

[2008.06.02 22:06:29 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\ICQ Toolbar

[2009.01.03 02:03:06 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\JLC's Software

[2012.01.30 16:55:40 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Kofeto

[2008.08.24 21:25:57 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Leadertech

[2008.05.27 15:31:47 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\MusicNet

[2010.04.28 21:38:28 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\OpenOffice.org

[2011.12.23 00:34:19 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Origin

[2010.06.14 13:15:55 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\PC Suite

[2008.08.02 12:40:45 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\ProtectDisc

[2010.09.23 01:29:59 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Samsung

[2009.03.13 23:34:41 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\SecondLife

[2008.08.02 12:41:30 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Summer Athletics 2008

[2010.04.03 01:18:51 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\temp

[2010.02.10 21:06:09 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\TS3Client

[2010.04.13 16:12:57 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Ulead Systems

[2009.02.16 19:32:44 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\vghd

[2012.02.01 17:49:30 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Wodi

[2010.03.15 20:07:17 | 000,000,000 | ---D | M] -- C:\Users\marcy\AppData\Roaming\Zylom

[2012.02.05 03:25:27 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.02.04 20:46:20 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{1922FA07-57FA-436F-B50B-CB628AD604EF}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2011.02.28 00:03:44 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2010.06.14 14:30:06 | 000,000,000 | -HSD | M] -- C:\Boot

[2011.12.03 16:05:10 | 000,000,000 | ---D | M] -- C:\Bosch_PR

[2010.08.01 03:05:33 | 000,000,000 | ---D | M] -- C:\Casino

[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2008.05.27 13:29:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2008.09.21 21:48:37 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft

[2011.08.06 22:58:24 | 000,000,000 | ---D | M] -- C:\Fraps

[2010.01.31 22:09:28 | 000,000,000 | ---D | M] -- C:\games

[2008.08.02 20:56:37 | 000,000,000 | ---D | M] -- C:\I-Magic

[2008.03.28 14:15:05 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2008.04.11 13:08:14 | 000,000,000 | ---D | M] -- C:\MyWorks

[2011.12.23 17:05:14 | 000,000,000 | ---D | M] -- C:\NVIDIA

[2012.02.05 16:00:31 | 000,000,000 | R--D | M] -- C:\Program Files

[2011.12.23 17:09:51 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2008.05.27 13:29:42 | 000,000,000 | -HSD | M] -- C:\Programme

[2011.11.01 18:27:16 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.12.23 17:11:58 | 000,000,000 | R--D | M] -- C:\Users

[2012.02.05 19:49:31 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: AHCIX86S.SYS  >

[2008.01.16 17:27:56 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=8DC09F3B54DDCAEB52E0DCFA1D55B26A -- C:\Windows\System32\drivers\ahcix86s.sys

[2008.01.16 17:27:56 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=8DC09F3B54DDCAEB52E0DCFA1D55B26A -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_957aef9d\ahcix86s.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 21:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll

 
 < MD5 for: EXPLORER.EXE  >

[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2010.02.14 22:34:59 | 000,000,218 | ---- | M] () -- C:\Users\marcy\.recently-used.xbel

[2012.02.05 19:11:00 | 000,000,176 | ---- | M] () -- C:\Users\marcy\defogger_reenable

[2008.05.27 13:55:54 | 000,000,282 | -HS- | M] () -- C:\Users\marcy\desktop.ini

[2012.02.05 21:51:39 | 007,077,888 | -HS- | M] () -- C:\Users\marcy\NTUSER.DAT

[2012.02.05 21:51:39 | 000,262,144 | -H-- | M] () -- C:\Users\marcy\ntuser.dat.LOG1

[2008.05.27 13:33:02 | 000,000,000 | -H-- | M] () -- C:\Users\marcy\ntuser.dat.LOG2

[2012.02.05 19:47:57 | 000,065,536 | -HS- | M] () -- C:\Users\marcy\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2010.03.28 02:20:37 | 000,524,288 | -HS- | M] () -- C:\Users\marcy\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2012.02.05 19:47:57 | 000,524,288 | -HS- | M] () -- C:\Users\marcy\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms

[2008.05.27 13:33:02 | 000,000,020 | -HS- | M] () -- C:\Users\marcy\ntuser.ini

[2010.02.05 20:53:11 | 000,010,240 | -HS- | M] () -- C:\Users\marcy\Thumbs.db

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:2430E4FC

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D1B5B4F1
 

< End of report >

und hier der Extra.txt

Code:

OTL Extras logfile created on: 05.02.2012 21:52:15 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\marcy\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 80,69% Memory free

6,19 Gb Paging File | 5,90 Gb Available in Paging File | 95,16% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 445,75 Gb Total Space | 296,28 Gb Free Space | 66,47% Space Free | Partition Type: NTFS

Drive D: | 19,99 Gb Total Space | 10,33 Gb Free Space | 51,68% Space Free | Partition Type: FAT32

 

Computer Name: MARCY-PC | User Name: marcy | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 1

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0398AB9A-B3AE-4064-9117-835F75D00643}" = rport=137 | protocol=17 | dir=out | app=system | 

"{05E439F8-DB57-4519-BF5E-DCF65356C3F9}" = lport=138 | protocol=17 | dir=in | app=system | 

"{064125E5-8649-4C5F-8E18-58ED991C996B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{2C0A8A13-9113-4538-9AB7-32B4424970F0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{3115B924-649D-4713-9CF0-5F04DFA5211B}" = lport=137 | protocol=17 | dir=in | app=system | 

"{4E09DC49-0C58-4FD1-9AD8-49EAA8B13C96}" = rport=445 | protocol=6 | dir=out | app=system | 

"{53B5BD79-7873-4914-BBC5-336C0D19BBD8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{5D803E7E-02BC-4B8F-98FB-A9E7941CC324}" = rport=139 | protocol=6 | dir=out | app=system | 

"{739A8420-C9B9-4F0D-8ABD-CD22C7C208A7}" = lport=445 | protocol=6 | dir=in | app=system | 

"{778C7B27-D110-490A-9D4B-7C7947B4CBDF}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{C95783CC-C2A3-4714-91D5-79DE9B7FB434}" = lport=139 | protocol=6 | dir=in | app=system | 

"{DFF84325-8013-4F71-873D-6325E1CEF2A5}" = rport=138 | protocol=17 | dir=out | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{01F1790B-A5E8-4754-89A3-35D2749521A7}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 

"{053A1FAF-8CD2-48B5-B1EB-5CAFEBAC4270}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{098E51D9-68AC-4107-B907-8390F783D7B2}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 

"{0B5D962E-548A-4E26-8D83-714EF6420E08}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{1061D305-7CC9-4EA8-ABFF-A7CE78894581}" = protocol=17 | dir=in | app=c:\program files\valve\steam\steam.exe | 

"{1630848E-7711-4B00-A4B0-E0AB243369EC}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 

"{168EB817-6433-4A04-810A-AC6577466E21}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{1906FC9B-4D17-439B-9186-FD9685991CD7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{1AB79F27-39B5-498F-8C06-753ECE7FA2F3}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 

"{1EF86CE3-3F6C-4136-BB26-6738DC91BF67}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{1FCC7A4C-6C45-4BD7-BEB0-BBCCD36273C6}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | 

"{25D00163-1DC7-4CCF-A058-843F5692ACFC}" = protocol=17 | dir=in | app=c:\program files\origin games\battlefield 3\bf3.exe | 

"{2ACA18F1-FD4F-4C52-8553-F72C3294EB83}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 

"{2FBE6E6D-FF0C-48FB-8E79-127CBD40C05B}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{303E5D0F-41C3-489A-A52C-C6E1EF74DAD7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{34EDEA0B-8A8B-4437-BEB9-2CA28353BD42}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{4B81897C-37C6-428B-B48D-1DCAD4D7AB0F}" = protocol=17 | dir=in | app=c:\program files\ea sports\fussball manager 10\manager10.exe | 

"{57597DA3-F650-4ACB-88F6-FB22F386E735}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe | 

"{57ECFFB6-EF28-401C-897A-44476F1ABD67}" = dir=in | app=c:\program files\homecinema\playmovie\playmovie.exe | 

"{599598E6-B2F1-4801-B824-A03F80C5ECE5}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 

"{5B37CC7C-01FF-4045-BCEA-7549ADE59783}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{6747D772-3B64-4012-BD6D-8C15FE64A83F}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{75F2553A-8315-4461-9FB9-19F17D58704D}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe | 

"{789F459A-D9C8-4F49-9008-D65ECC37960F}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{7C1E9A70-A39C-4CFB-93D2-651124FAA7E4}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{83176666-185A-4014-8152-2B23C109B985}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe | 

"{83A546F5-0EBA-42F4-BC4F-B30075AE3D75}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{848F73B3-5A38-497A-83E4-2E1396DE6776}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{8E2B74EB-D5CF-4F7D-814A-66EE66328747}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{948F810F-5D8C-463C-A9A6-9B1E545378D7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{9C14FC8A-2BEA-41B0-AED8-DB4FBB1F4FCC}" = dir=in | app=c:\program files\homecinema\playmovie\pmvservice.exe | 

"{A4EDA1C8-7BFE-4A5E-AB66-A70704AB586C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{B089A094-E426-4BD4-80A1-14E1AB308168}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{B8BD1C29-1369-446D-BFE4-65BD15B550F6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{BD628CA2-4A24-40F2-BAF7-A2BFF4DA9C74}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{C113E491-5907-4193-A384-0ACE1030D270}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{C1FEC15C-F7AB-4AEF-A36B-A0717628D495}" = protocol=6 | dir=in | app=c:\program files\valve\steam\steam.exe | 

"{C2305E0C-B8F1-4AEE-B832-EC3F8934AB45}" = dir=in | app=c:\program files\homecinema\powerdvd\powerdvd.exe | 

"{C36B294E-F31B-4705-9604-4A38AADF220E}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 

"{C3AEA97A-D973-4E64-B32F-59B71D351344}" = protocol=6 | dir=in | app=c:\program files\ea sports\fussball manager 10\manager10.exe | 

"{C51FF937-B0F4-40D3-A88B-B51E24ABCC3B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CDAB2233-53FC-42BF-A690-FC0993F84A07}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{D51B741C-B7F5-4FC3-BCB8-47FFCAAC9247}" = dir=in | app=c:\program files\homecinema\makedisc\makedisc.exe | 

"{EC45660C-A814-447C-934B-65A798B2A260}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 

"{ED94B4BC-7EAE-47E5-9CE7-29F18C79613A}" = protocol=6 | dir=in | app=c:\program files\origin games\battlefield 3\bf3.exe | 

"{EDB520B4-E54F-498B-BDCD-D9A8779A754B}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{F5F0D389-4138-4D42-921B-64B2B0F406F3}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{F90CC516-3F3F-40E5-B548-93325050B5DB}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | 

"TCP Query User{1497FA16-6095-4C01-AF54-A6CF61417A28}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 

"TCP Query User{14CBDE29-00EA-4FB3-99C9-016B808439B5}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe | 

"TCP Query User{1FA7115C-D227-4829-86F0-9AC03E7E6470}C:\program files\metin2_germany\metin2.bin" = protocol=6 | dir=in | app=c:\program files\metin2_germany\metin2.bin | 

"TCP Query User{2201DF63-34E6-4933-92B3-CC071BF7DC34}C:\program files\valve\steam\steamapps\marcy2317\deathmatch classic\hl.exe" = protocol=6 | dir=in | app=c:\program files\valve\steam\steamapps\marcy2317\deathmatch classic\hl.exe | 

"TCP Query User{3331056C-42C5-42DF-A48C-80FCBFE720F7}C:\program files\valve\steam\steamapps\marcy2317\ricochet\hl.exe" = protocol=6 | dir=in | app=c:\program files\valve\steam\steamapps\marcy2317\ricochet\hl.exe | 

"TCP Query User{425F1F07-12AC-4006-979B-686C7978EF75}C:\program files\teamspeak2_rc2\server_windows.exe" = protocol=6 | dir=in | app=c:\program files\teamspeak2_rc2\server_windows.exe | 

"TCP Query User{4791F0F4-6FF2-4FFE-B18C-3E95FE9AB92F}C:\program files\valve\steam\steamapps\marcy2317\condition zero\hl.exe" = protocol=6 | dir=in | app=c:\program files\valve\steam\steamapps\marcy2317\condition zero\hl.exe | 

"TCP Query User{4846A3E5-83A6-4BCE-81A1-DE33BCBC3746}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 

"TCP Query User{49FF6869-5B2D-463C-A45D-3F0900BFAD43}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"TCP Query User{4E4DC5DA-6A63-41D7-BB7C-F4E2531FEE65}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 

"TCP Query User{566C4796-CA14-4855-8A72-5BB40DE74945}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 

"TCP Query User{61099848-5324-4518-B8C9-68E4AEEBF5B9}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe | 

"TCP Query User{65DC3DF3-F012-46B9-A944-4CB1774E1E3D}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{67650639-7CEC-4A15-BA22-7CDEDB8DB4DD}C:\program files\secondlife\slvoice.exe" = protocol=6 | dir=in | app=c:\program files\secondlife\slvoice.exe | 

"TCP Query User{7216A0E8-FC6B-45CC-A056-9B79DBBE89BE}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 

"TCP Query User{808E14FF-C356-45BF-A276-74E93397FE91}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"TCP Query User{8E64B095-64FC-4845-B5E2-D60828AC64D1}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 

"TCP Query User{C8455AB2-4FFD-4605-B72A-C97119DF6455}C:\program files\pidgin\pidgin.exe" = protocol=6 | dir=in | app=c:\program files\pidgin\pidgin.exe | 

"TCP Query User{C916F196-1EF1-458F-830F-27C0C20AB334}C:\program files\concept design\onlinetv 4\onlinetv.exe" = protocol=6 | dir=in | app=c:\program files\concept design\onlinetv 4\onlinetv.exe | 

"TCP Query User{CADAE763-7438-489A-B549-48C6C86F0594}C:\program files\railroad tycoon 3\rt3.exe" = protocol=6 | dir=in | app=c:\program files\railroad tycoon 3\rt3.exe | 

"TCP Query User{D796D9BB-CED0-4AA0-9DBB-2C5C65F7FFD9}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 

"TCP Query User{DD7AF676-1EAE-4CCF-98CF-EF1CCDC88258}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 

"TCP Query User{E58BAA1A-2856-48EF-9DA8-EC12F24D6DDB}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 

"TCP Query User{EF5F0E83-BCB3-4E10-8C4E-0B7F5A589982}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 

"TCP Query User{F3E0F2A8-5E3D-47E4-83D6-05D97CF69F15}C:\program files\utherverse digital inc\rude virtual 3d client\utherverse.exe" = protocol=6 | dir=in | app=c:\program files\utherverse digital inc\rude virtual 3d client\utherverse.exe | 

"TCP Query User{F771CC7D-27D9-4983-8CF3-33630D5B83C2}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{160BDB99-AF0A-451D-B85B-075985E26974}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe | 

"UDP Query User{18F96965-C1A1-4FCB-8EDB-8B8619D4E93B}C:\program files\pidgin\pidgin.exe" = protocol=17 | dir=in | app=c:\program files\pidgin\pidgin.exe | 

"UDP Query User{289D537A-50C6-41A8-8B1A-0B0211A6D302}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{36242CF0-A029-441B-87FA-B7951A8707EE}C:\program files\valve\steam\steamapps\marcy2317\deathmatch classic\hl.exe" = protocol=17 | dir=in | app=c:\program files\valve\steam\steamapps\marcy2317\deathmatch classic\hl.exe | 

"UDP Query User{4339F5A4-E638-4D2F-99B0-0192CD97354D}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 

"UDP Query User{4798A70E-51BD-4D91-837A-B6462B3F4CC6}C:\program files\metin2_germany\metin2.bin" = protocol=17 | dir=in | app=c:\program files\metin2_germany\metin2.bin | 

"UDP Query User{4B973827-8F10-40C3-BEA5-F9CB6818BAB1}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 

"UDP Query User{4EFEFF6D-7449-420A-AEC8-9B13D527660B}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{5A58842D-EB2A-41D7-BFD6-1F7250ABB2AF}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 

"UDP Query User{616837EF-1B51-429C-9C7B-D9DD8263809B}C:\program files\valve\steam\steamapps\marcy2317\ricochet\hl.exe" = protocol=17 | dir=in | app=c:\program files\valve\steam\steamapps\marcy2317\ricochet\hl.exe | 

"UDP Query User{61ADF171-5E0D-496F-9367-0FDA849BB21F}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 

"UDP Query User{8628C29C-8927-414E-AD55-26C3CE078B1D}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 

"UDP Query User{89C8DD2A-87E8-44DD-B81F-A71BC6DE57AA}C:\program files\secondlife\slvoice.exe" = protocol=17 | dir=in | app=c:\program files\secondlife\slvoice.exe | 

"UDP Query User{907C633B-46B1-44DD-9201-289548B1128F}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 

"UDP Query User{932AB02E-AD0F-4EDA-B2A3-4AC85AEE90E7}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 

"UDP Query User{A0225E30-3E2C-4553-B2FA-935A5722A7D0}C:\program files\teamspeak2_rc2\server_windows.exe" = protocol=17 | dir=in | app=c:\program files\teamspeak2_rc2\server_windows.exe | 

"UDP Query User{A27D8E33-C1C7-4C9D-9580-E1479F9CB2CE}C:\program files\railroad tycoon 3\rt3.exe" = protocol=17 | dir=in | app=c:\program files\railroad tycoon 3\rt3.exe | 

"UDP Query User{B166B703-9793-4E98-AD4B-2B8BCF724C9D}C:\program files\valve\steam\steamapps\marcy2317\condition zero\hl.exe" = protocol=17 | dir=in | app=c:\program files\valve\steam\steamapps\marcy2317\condition zero\hl.exe | 

"UDP Query User{B99C5520-42BA-4B86-9EB6-1C8A62BFB418}C:\program files\utherverse digital inc\rude virtual 3d client\utherverse.exe" = protocol=17 | dir=in | app=c:\program files\utherverse digital inc\rude virtual 3d client\utherverse.exe | 

"UDP Query User{BA92A227-3F2A-4994-BD05-C02893C63A64}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 

"UDP Query User{BB1DAFB7-0076-49F8-9CA1-EF5DE8A7EA37}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 

"UDP Query User{C044490F-32C2-421D-9FB1-D9EC0EE38412}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe | 

"UDP Query User{C360FFFE-DC8A-413F-841B-D8B1A78965A4}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{DD8B76F6-49B8-47D0-9B18-DC75CF60412F}C:\program files\concept design\onlinetv 4\onlinetv.exe" = protocol=17 | dir=in | app=c:\program files\concept design\onlinetv 4\onlinetv.exe | 

"UDP Query User{F82FE302-F0D1-4EE4-BA1F-E55D18463DB8}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 

"UDP Query User{F99E7DBB-0497-4766-9814-7C4F87A4B448}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent

"{11AFE21E-B193-430D-B57A-DFF7815BB962}" = Ulead PhotoImpact 12

"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216018F0}" = Java(TM) 6 Update 18

"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26

"{27FDF949-69CE-435A-8372-339F72336AC5}" = MEDIONbox

"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1

"{2F173C40-563E-11D4-89C5-0010ADDAAC33}" = EA.com Matchup

"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform

"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6

"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support

"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{400B8D50-7D8B-4D23-9284-0149ADDC404D}" = KTS

"{44EAFE3D-09A9-4478-A2BF-0EED22F4E49F}" = Die Sims™ 3 Erstelle ein Muster-Tool

"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = Die Sims™ 3 Late Night

"{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync

"{588D9F5F-8C62-4421-BAE9-CCAA57D4E4EE}" = TVsweeper 3

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5CA6F170-E18D-4B4C-8670-3ED096478C41}" = Philips SPC620NC Webcam

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{6DA9102E-199F-43A0-A36B-6EF48081A658}" = Systemsteuerung "MobileMe"

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}" = RollerCoaster Tycoon 2

"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2

"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™

"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1

"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime

"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver

"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX

"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support

"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9AB97F52-512B-43EF-AAEC-4825C17B32ED}" = EA.com Update

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8

"{9F251952-43A3-1305-997C-5B285C76FCAD}" = ATI Catalyst Install Manager

"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Play Movie

"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder

"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5

"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter

"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch

"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8

"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger

"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder

"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer

"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter

"{B145EC69-66F5-11D8-9D75-000129760D75}" = MakeDisc

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player

"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer

"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call

"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!

"{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow

"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer

"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime

"{E58CBA0A-710D-4BDE-ABEA-5446A56AE5E2}_is1" = concept/design onlineTV 4

"{EA57A1B9-0DD2-44DD-9B70-64E8DA553F6F}" = Philips VLounge

"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FD9C31B6-F572-414D-81E3-89368C97A125}_is1" = CamStudio OSS Desktop Recorder

"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"0B2D03E71EB1D3FE229C62259DBF6DA48D997A8A" = Windows-Treiberpaket - Philips USB  (06/29/2007 1.50.1.4830)

"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)

"492EC219175FFD93F13E3144FDB63E9F4E9ED2DA" = Windows-Treiberpaket - Philips (SPC620) Image  (06/29/2007 1.50.1.4830)

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Battlelog Web Plugins" = Battlelog Web Plugins

"Derive 6" = Derive 6

"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters

"EA Installer.1475696318" = EA Installer

"EAX Unified" = EAX Unified

"ESI Prüfwerte" = ESI Prüfwerte

"ESI[tronic] DEMO_4" = ESI[tronic] DEMO_4

"FLV Player" = FLV Player 2.0, build 24

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.34.305

"FUSSBALL MANAGER 11" = FUSSBALL MANAGER 11

"GameSpy Arcade" = GameSpy Arcade

"Google Chrome" = Google Chrome

"Google Desktop" = Google Desktop

"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (nur entfernen)

"Guild Wars" = GUILD WARS

"HOMESTUDENTR" = Microsoft Office Home and Student 2007

"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector

"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio

"MEDION Fotos auf CD Nord D" = MEDION Fotos auf CD Nord

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox 10.0 (x86 de)" = Mozilla Firefox 10.0 (x86 de)

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"Origin" = Origin

"PhotoFiltre" = PhotoFiltre

"PokerStars" = PokerStars

"PokerStars.net" = PokerStars.net

"PunkBusterSvc" = PunkBuster Services

"RealPlayer 12.0" = RealPlayer

"SystemRequirementsLab" = System Requirements Lab

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"TmNationsForever_is1" = TmNationsForever Update 2010-03-15

"Uninstall_is1" = Uninstall 1.0.0.1

"VLC media player" = VideoLAN VLC media player 0.8.6h

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== Last 10 Event Log Errors ==========

 

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

 

< End of report >

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

:OTL

O4 - HKCU..\Run: [Firefox helper] C:\Users\marcy\AppData\Local\Mozilla\Firefox\firefox.exe ()

 :Files

C:\Users\marcy\AppData\Local\Mozilla\Firefox\firefox.exe

:Commands

[purity]

[EMPTYFLASH] 

[emptytemp]

[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Hi,
der Upload hat problemlos geklappt :)
Hier dann noch der Inhalt aus dem Textdokument.
Danke schonmal :)

Code:

All processes killed

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Firefox helper deleted successfully.

C:\Users\marcy\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully.

========== COMMANDS ==========

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

->Flash cache emptied: 56468 bytes

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: marcy

->Flash cache emptied: 1673542 bytes

 

User: Public

 

User: UpdatusUser

->Flash cache emptied: 56468 bytes

 

Total Flash Files Cleaned = 2,00 mb

 

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: marcy

->Temp folder emptied: 2278859132 bytes

->Temporary Internet Files folder emptied: 139717823 bytes

->Java cache emptied: 163021946 bytes

->FireFox cache emptied: 162052520 bytes

->Google Chrome cache emptied: 369944226 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1464643405 bytes

RecycleBin emptied: 607784 bytes

 

Total Files Cleaned = 4.367,00 mb

 

 

OTL by OldTimer - Version 3.2.31.0 log created on 02062012_164650
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

hi
danke für den upload

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Sooo habs ausgeführt und hier ist die Combofix.txt

Code:

ComboFix 12-02-06.02 - marcy 06.02.2012  17:48:49.1.4 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3069.1925 [GMT 1:00]

ausgeführt von:: c:\users\marcy\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Mozilla Firefox\components\AskHPRFF.js

c:\programdata\Microsoft\Windows\Start Menu\Programs\1964.lnk

c:\programdata\ntuser.dat

c:\windows\IsUn0407.exe

c:\windows\TEMP\logishrd\LVPrcInj01.dll

c:\windows\unin0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-01-06 bis 2012-02-06  ))))))))))))))))))))))))))))))

.

.

2012-02-06 16:57 . 2012-02-06 17:01        --------        d-----w-        c:\users\marcy\AppData\Local\temp

2012-02-06 16:57 . 2012-02-06 16:57        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2012-02-06 16:57 . 2012-02-06 16:57        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-02-06 15:46 . 2012-02-06 16:02        --------        d-----w-        C:\_OTL

2012-01-31 16:21 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-01-31 16:21 . 2011-11-16 16:23        278528        ----a-w-        c:\windows\system32\schannel.dll

2012-01-31 16:21 . 2011-11-16 16:23        377344        ----a-w-        c:\windows\system32\winhttp.dll

2012-01-31 16:21 . 2011-11-16 16:23        72704        ----a-w-        c:\windows\system32\secur32.dll

2012-01-31 16:21 . 2011-11-16 16:21        1259008        ----a-w-        c:\windows\system32\lsasrv.dll

2012-01-31 16:21 . 2011-11-16 14:12        9728        ----a-w-        c:\windows\system32\lsass.exe

2012-01-12 03:45 . 2011-10-14 16:03        189952        ----a-w-        c:\windows\system32\winmm.dll

2012-01-12 03:45 . 2011-10-14 16:00        23552        ----a-w-        c:\windows\system32\mciseq.dll

2012-01-12 03:45 . 2011-11-18 20:23        1205064        ----a-w-        c:\windows\system32\ntdll.dll

2012-01-12 03:45 . 2011-11-18 17:47        66560        ----a-w-        c:\windows\system32\packager.dll

2012-01-12 03:45 . 2011-12-01 15:21        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-01-12 03:45 . 2011-11-25 15:59        376320        ----a-w-        c:\windows\system32\winsrv.dll

2012-01-12 03:45 . 2011-10-25 15:58        1314816        ----a-w-        c:\windows\system32\quartz.dll

2012-01-12 03:45 . 2011-10-25 15:58        497152        ----a-w-        c:\windows\system32\qdvd.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-26 23:21 . 2009-10-02 16:41        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-06 04:19 . 2012-02-03 16:15        6557240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DA457F4E-73C1-4918-BFAA-3B5F42917B25}\mpengine.dll

2011-12-26 21:06 . 2008-08-07 22:41        140072        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2011-12-26 21:05 . 2009-06-30 19:41        280904        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2011-12-26 21:05 . 2008-08-07 22:41        280904        ----a-w-        c:\windows\system32\PnkBstrB.exe

2011-12-26 21:01 . 2008-08-07 22:41        280904        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2011-12-23 01:48 . 2011-12-23 00:08        138056        ----a-w-        c:\users\marcy\AppData\Roaming\PnkBstrK.sys

2011-12-23 01:48 . 2008-08-07 22:40        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2011-11-23 13:37 . 2011-12-15 05:45        2043904        ----a-w-        c:\windows\system32\win32k.sys

2011-11-17 13:50 . 2011-05-19 13:11        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2009-05-01 21:02 . 2009-05-01 21:02        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll

2009-05-01 21:02 . 2009-05-01 21:02        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll

2012-01-29 16:12 . 2012-02-05 19:03        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Wisdom-soft AutoScreenRecorder 3.1 Free"="0" [X]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]

"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2011-01-05 133432]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-01-30 91432]

"PlayMovie"="c:\program files\HomeCinema\PlayMovie\PMVService.exe" [2008-02-15 172032]

"RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 5369856]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-05-27 220160]

"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2011-11-02 273528]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

VPro620.lnk - c:\windows\VPro620.exe [2008-9-9 61440]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=  c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux6"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

.

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 22:02]

.

2012-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 22:02]

.

2012-02-06 c:\windows\Tasks\User_Feed_Synchronization-{1922FA07-57FA-436F-B50B-CB628AD604EF}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

IE: Free YouTube to Mp3 Converter - c:\users\marcy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\marcy\AppData\Roaming\Mozilla\Firefox\Profiles\50oc1zhb.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=417&q=

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-10 - (no file)

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe

HKCU-Run-igyrn.exe - c:\users\marcy\AppData\Roaming\Wodi\igyrn.exe

HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe

HKLM-Run-NPSStartup - (no file)

AddRemove-ESI Prüfwerte - c:\windows\IsUn0407.exe

AddRemove-MEDION Fotos auf CD Nord D - c:\program files\ALDI Foto Service Nord\Medion_Fotos_auf_CD_6\instslct.exe

AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe

AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

.

.

.

**************************************************************************

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\HomeCinema\PlayMovie\000.fcl"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]

"ImagePath"="\??\c:\program files\HomeCinema\PowerDVD\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(10856)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

c:\program files\NVIDIA Corporation\Display\nvxdsync.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Avira\AntiVir Desktop\sched.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Microsoft\BingBar\BBSvc.EXE

c:\program files\Microsoft\BingBar\SeaPort.EXE

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\FsUsbExService.Exe

c:\program files\common files\gnab\service\servicecontroller.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Medion\MEDIONbox\Program\GCS.exe

c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\system32\IoctlSvc.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\WUDFHost.exe

c:\windows\system32\WerCon.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\conime.exe

c:\program files\NVIDIA Corporation\Display\nvtray.exe

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-02-06  18:06:58 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-02-06 17:06

.

Vor Suchlauf: 13 Verzeichnis(se), 319.287.373.824 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 319.385.063.424 Bytes frei

.

- - End Of File - - CD8A7C76AE15BC817196220AF2485EA8

internet explorer updaten, auch wenn du einen andern browser nutzt, ist er wichtiger system bestandteil:
Internet Explorer - Webbrowser für Microsoft Windows
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Soo hier die Auswertung von Malwarebytes :)

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.02.06.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 7.0.6002.18005

marcy :: MARCY-PC [Administrator]
 

06.02.2012 18:25:12

mbam-log-2012-02-06 (18-25-12).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 449153

Laufzeit: 1 Stunde(n), 51 Minute(n), 40 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\Program Files\Valve\Steam\SSW4.8.dll (Worm.Conficker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Valve\Steam\SSW4.8.exe (Spyware.OnlineGames) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\_OTL\MovedFiles\02062012_164650\C_Users\marcy\AppData\Local\Mozilla\Firefox\firefox.exe (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

hi,

lade den CCleaner standard:
CCleaner Download - CCleaner 3.15.1643
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Sooo hier die Liste.. kenn mich nicht so gut mit pc's aus.. deshalb hab ich bei recht vielen sachen unbekannt. Mfg marcy

Code:

Activation Assistant for the 2007 Microsoft Office suites        Microsoft Corporation        26.05.2008        14,0MB        unbekannt

Adobe AIR        Adobe Systems Incorporated        03.09.2011        28,4MB        2.7.1.19610  unbekannt

Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        22.09.2010                10.1.53.64 notwendig

Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        16.11.2011                11.1.102.55 notwendig

Adobe Reader X (10.1.1) - Deutsch        Adobe Systems Incorporated        13.09.2011        165,3MB        10.1.1  notwendig

Adobe Shockwave Player 11.6        Adobe Systems, Inc.        26.06.2011        8,62MB        11.6.0.626  notwendig

Apple Application Support        Apple Inc.        19.12.2011        61,1MB        2.1.6  unbekannt

Apple Mobile Device Support        Apple Inc.        19.12.2011        24,1MB        4.0.0.97  unbekannt

Apple Software Update        Apple Inc.        16.08.2011        2,38MB        2.1.3.127  notwendig

ATI Catalyst Install Manager        ATI Technologies, Inc.        27.03.2008        13,9MB        3.0.664.0   unbekannt

Avira AntiVir Personal - Free Antivirus        Avira GmbH        15.10.2011        77,1MB        10.2.0.704   notwendig

Battlefield 2(TM)                03.02.2010        2.099MB            notwenig

Battlefield 3™        Electronic Arts        22.12.2011        16.033MB        1.0.0.0  notwenig

Battlelog Web Plugins        EA Digital Illusions CE AB        22.12.2011        11,1MB        1.104.0  notwendig

Bing Bar        Microsoft Corporation        18.01.2012        26,9MB        7.0.850.0  unbekannt

Bonjour        Apple Inc.        11.10.2011        0,92MB        3.0.0.10  unbekannt

CamStudio OSS Desktop Recorder        CamStudio Open Source Dev Team        31.07.2011        15,0MB        2.6 Beta r294  unbekannt

CCleaner        Piriform        05.02.2012        4,24MB        3.15  

Compatibility Pack für 2007 Office System        Microsoft Corporation        14.12.2011        68,2MB        12.0.6425.1000   unbekannt

concept/design onlineTV 4        concept/design GmbH        02.01.2009        4,37MB        onlineTV 4  unbekannt

CyberLink PowerDirector        CyberLink Corp.        10.04.2008        216MB        6.5.2314  unbekannt

Derive 6        Texas Instruments Incorporated        10.02.2009        9,26MB        6.0   notwendig

Die Sims™ 3        Electronic Arts        03.09.2011        6.052MB        1.24.3  notwendig

Die Sims™ 3 Erstelle ein Muster-Tool        Electronic Arts        15.11.2010        192,3MB        1.0.0  notwendig

Die Sims™ 3 Late Night        Electronic Arts        03.09.2011        2.435MB        6.5.1  notwendig

DivX Codec        DivX, Inc.        08.04.2009        1,40MB        6.8.5 unbekannt

DivX Converter        DivX, Inc.        08.04.2009        30,4MB        7.0.0 unbekannt

DivX Player        DivX, Inc.        08.04.2009        15,4MB        7.1.0 unbekannt

DivX Plus DirectShow Filters        DivX, Inc.        08.04.2009        1,22MB         unbekannt

DivX Web Player        DivX,Inc.        18.06.2009        2,93MB        1.5.0  unbekannt

EA.com Matchup                04.04.2009        2,44MB        notwendig

EA.com Update                04.04.2009        2,43MB        notwendig

EAX Unified                27.12.2009        8,00KB        unbekannt

ESI[tronic] DEMO_4                02.12.2011        948MB        notwendig

FLV Player 2.0, build 24        Martijn de Visser        06.09.2008        1,91MB        2.0, build 24  unnötig

Free Audio CD Burner version 1.4.7        DVDVideoSoft Limited.        23.03.2011        2,60MB        unbekannt

Free YouTube to MP3 Converter version 3.9.34.305        DVDVideoSoft Limited.        23.03.2011        5,53MB  unnötig        

FUSSBALL MANAGER 11        Electronic Arts        20.05.2011        7.376MB        1.0.0.3  notwendig

GameSpy Arcade                03.02.2010        16,1MB        notwendig

Google Chrome        Google Inc.        09.04.2009        133,9MB        16.0.912.77  unnötig

Google Desktop        Google        26.05.2008        7,92MB        -   unbekannt

Google Earth        Google        20.11.2011        92,8MB        6.1.0.5001  unnötig

GTK+ Runtime 2.14.7 rev a (nur entfernen)                28.07.2009  unbekannt                

GUILD WARS                27.05.2008        2.427MB        notwendig

ICQ7.2        ICQ        23.06.2010        50,9MB        7.2  notwendig

iTunes        Apple Inc.        19.12.2011        169,6MB        10.5.2.11   notwendig

Java(TM) 6 Update 18        Sun Microsystems, Inc.        27.04.2010        97,1MB        6.0.180

Java(TM) 6 Update 26        Oracle        21.06.2011        94,9MB        6.0.260

Java(TM) 6 Update 6        Sun Microsystems, Inc.        29.04.2008        171,1MB        1.6.0.60

Logitech QuickCam        Logitech Inc.        23.08.2008        26,3MB        11.80.1065   unbekannt

Logitech Updater        Ihr Firmenname        02.04.2010        1,30MB        1.70  unbekannt  

MakeDisc        CyberLink Corp.        26.05.2008        102,1MB        3.0.2601  unbekannt

Malwarebytes Anti-Malware Version 1.60.1.1000        Malwarebytes Corporation        05.02.2012        11,5MB        1.60.1.1000

MCE Software Encoder 1.1        CyberLink Corporation        26.05.2008        1,33MB        1.1.0.1918  unbekannt

MediaShow        CyberLink Corporation        26.05.2008        33,1MB        3.0.4325  unbekannt

MEDIONbox        Medion        31.03.2008        27,0MB        1.09.0000.00050  unbekannt

Microsoft .NET Framework 1.1                31.03.2008        unbekannt        

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU        Microsoft Corporation        08.08.2009        37,0MB  unbekannt        

Microsoft .NET Framework 3.5 SP1        Microsoft Corporation        07.08.2009        37,0MB        unbekannt

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        25.06.2010        120,3MB        4.0.30319 unbekannt

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        25.06.2010        24,5MB        4.0.30319  unbekannt

Microsoft Office Home and Student 2007        Microsoft Corporation        02.11.2009        300MB        12.0.6425.1000  unbekannt

Microsoft Office Live Add-in 1.5        Microsoft Corporation        13.06.2010        0,49MB        2.0.4024.1  unbekannt

Microsoft Office PowerPoint Viewer 2007 (German)        Microsoft Corporation        14.12.2011        76,5MB        12.0.6425.1000  unbekannt

Microsoft Silverlight        Microsoft Corporation        12.10.2011        3,14MB        4.0.60831.0  unbekannt

Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        14.11.2009        1,74MB        3.1.0000  unbekannt

Microsoft Sync Framework Runtime Native v1.0 (x86)        Microsoft Corporation        06.12.2010        0,61MB        1.0.1215.0  unbekannt

Microsoft Sync Framework Services Native v1.0 (x86)        Microsoft Corporation        06.12.2010        1,45MB        1.0.1215.0  unbekannt

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        28.07.2009        0,25MB        8.0.50727.4053  unbekannt

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        17.06.2011        0,29MB        8.0.61001  unbekannt

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148        Microsoft Corporation        28.07.2009        0,19MB        9.0.30729.4148  unbekannt

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022        Microsoft Corporation        29.04.2008        2,06MB        9.0.21022  unbekannt

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        24.06.2009        0,58MB        9.0.30729  unbekannt

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        03.11.2010        0,58MB        9.0.30729.4148  unbekannt

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        17.06.2011        0,58MB        9.0.30729.6161  unbekannt

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        04.09.2011        15,0MB        10.0.40219  unbekannt

Microsoft Works        Microsoft Corporation        15.12.2010        378MB        9.7.0621  unbekannt

Microsoft WSE 3.0 Runtime        Microsoft Corp.        14.10.2009        0,92MB        3.0.5305.0  unbekannt

Mozilla Firefox 10.0 (x86 de)        Mozilla        04.02.2012        46,8MB        10.0   notwendig

MSXML 4.0 SP2 (KB936181)        Microsoft Corporation        27.03.2008        1,27MB        4.20.9848.0  unbekannt

MSXML 4.0 SP2 (KB941833)        Microsoft Corporation        27.03.2008        1,27MB        4.20.9849.0  unbekannt

MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        11.11.2008        1,28MB        4.20.9870.0  unbekannt

MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        24.11.2009        1,34MB        4.20.9876.0  unbekannt

Nero 8 Essentials        Nero AG        29.04.2008        1.835MB        8.3.124   notwendig

NVIDIA 3D Vision Controller-Treiber 285.62        NVIDIA Corporation        22.12.2011        3,81MB        285.62

NVIDIA 3D Vision Treiber 285.62        NVIDIA Corporation        22.12.2011        22,1MB        285.62

NVIDIA Grafiktreiber 285.62        NVIDIA Corporation        22.12.2011        45,2MB        285.62

NVIDIA PhysX-Systemsoftware 9.11.0621        NVIDIA Corporation        22.12.2011        73,3MB        9.11.0621

NVIDIA Update 1.5.20        NVIDIA Corporation        22.12.2011        3,53MB        1.5.20

OpenOffice.org 3.2        OpenOffice.org        27.04.2010        371MB        3.2.9483  notwendig

Origin        Electronic Arts, Inc.        22.12.2011        115,1MB        8.3.7.3619   notwendig

Paint.NET v3.5.8        dotPDN LLC        30.04.2011        10,4MB        3.58.0   unnötig

PC Connectivity Solution        Nokia        13.06.2010        9,25MB        8.15.0.0  unbekannt

Philips SPC620NC Webcam        Philips        08.09.2008        22,7MB        1.00.000  notwendig

Philips VLounge        ArcSoft        08.09.2008        15,6MB        notwendig

PhotoFiltre                26.05.2009        3,64MB        notwendig

PhotoNow!        CyberLink Corp.        26.05.2008        1,60MB        1.0.4310  unbekannt

Play Movie        CyberLink Corp.        26.05.2008        95,9MB        BD+HD 1.5.3815  unbekannt

PokerStars        PokerStars        18.08.2011        26,7MB        notwendig

PokerStars.net        PokerStars.net        26.05.2008        25,9MB        unnötig

PowerDVD        CyberLink Corporation        26.05.2008        118,9MB        7.3.3730c.0   notwendig

PowerProducer        CyberLink Corp.        26.05.2008        190,2MB        4.2.2612   unbekannt

Project64 1.6        Project64        23.02.2011        3,47MB        1.6 unnötig

PunkBuster Services        Even Balance, Inc.        22.12.2011                0.991  notwendig

QuickTime        Apple Inc.        19.12.2011        73,3MB        7.71.80.42  notwendig

RealPlayer        RealNetworks        01.11.2011        67,7MB        notwendig

Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista        Realtek        27.03.2008        1,37MB        1.00.0000  notwendig

Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        29.04.2008        16,8MB        6.0.1.5591  notwendig

RollerCoaster Tycoon 2                31.07.2010        555MB        unnötig

Samsung New PC Studio        Samsung Electronics Co., Ltd.        22.09.2010        202MB        1.00.0000  notwendig

Samsung New PC Studio USB Driver Installer        Samsung Electronics Co., Ltd.        13.06.2010        8,55MB        1.00.0000   notwendig

SAMSUNG USB Driver for Mobile Phones        SAMSUNG Electronics Co., Ltd.        05.02.2012        35,5MB        1.3.650.0  notwendig

SamsungConnectivityCableDriver        Samsung        13.06.2010        0,62MB        6.83.6.2.1   notwendig

Skype Click to Call        Skype Technologies S.A.        10.11.2011        7,68MB        5.6.8442   notwendig

Skype™ 5.5        Skype Technologies S.A.        10.11.2011        17,0MB        5.5.124  notwendig

Spelling Dictionaries Support For Adobe Reader 8        Adobe Systems        29.04.2008        67,5MB        8.0.0 unbekannt

System Requirements Lab                25.12.2011        0,38MB        unbekannt

Systemsteuerung "MobileMe"        Apple Inc.        24.09.2008        5,12MB        2.1.0.24  unbekannt

TeamSpeak 3 Client        TeamSpeak Systems GmbH        08.02.2010        26,0MB  notwendig        

TmNationsForever Update 2010-03-15        Nadeo        20.05.2010        717MB  notwendig        

TVsweeper 3        Sonavis        29.04.2008        4,11MB        3.0.3  unbekannt

Ulead PhotoImpact 12        Ulead System        26.05.2008        389MB        12.0  notwendig

Uninstall 1.0.0.1                23.03.2011        17,2MB        unbekannt

VideoLAN VLC media player 0.8.6h        VideoLAN Team        03.07.2008        32,5MB        0.8.6h   notwendig

Windows Live Essentials        Microsoft Corporation        06.12.2010        158,3MB        14.0.8117.0416 unbekannt

 
 

Windows Live ID-Anmelde-Assistent        Microsoft Corporation        13.06.2010        4,69MB        6.500.3165.0  unbekannt

Windows Live Sync        Microsoft Corporation        06.12.2010        2,79MB        14.0.8117.416  unbekannt

Windows Live-Uploadtool        Microsoft Corporation        14.11.2009        0,22MB        14.0.8014.1029  unbekannt

Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)        Nokia        13.06.2010                10/12/2007 6.85.4.0 unbekannt

Windows-Treiberpaket - Philips (SPC620) Image  (06/29/2007 1.50.1.4830)        Philips        08.09.2008                06/29/2007 1.50.1.4830 unbekannt

Windows-Treiberpaket - Philips USB  (06/29/2007 1.50.1.4830)        Philips        08.09.2008                06/29/2007 1.50.1.4830 unbekannt

WinRAR                03.07.2008        3,66MB         notwendig

deinstaliere:
Adobe AIR
deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Bing
CamStudio
concept
CyberLink
DivX : alle
FLV
Free Audio
Free YouTube
Google : alle
Java: alle
Download der kostenlosen Java-Software
downloade java jre: instalieren.

deinstaliere:
Paint
PhotoNow
Play Movie
PokerStars.net
Project64
RollerCoaster
Spelling Dictionaries
VideoLAN :
neueste laden,
VideoLAN - Official page for VLC media player, the Open Source video framework!
instalieren.

deinstaliere:
Windows Live Essentials

öffne otl, bereinigen, analysieren.
öffne ccleaner, analysieren, bereinigen, neustarten, testen ob alles läuft wie gewünscht

öhm.. hab grad mit otl bereinigt.. sollte dann neu starten und jetzt ist otl weg!?

das war der plan. remover und otl werden gelöscht.
dann weiter mit der ccleaner bereinigung und dem test des pcs und der programme.