Trojaner-Board - GVU Trojaner 2.07 Anti Malware und OTL Dateien

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - GVU Trojaner 2.07 Anti Malware und OTL Dateien (https://www.trojaner-board.de/120103-gvu-trojaner-2-07-anti-malware-otl-dateien.html)

GVU Trojaner 2.07 Anti Malware und OTL Dateien

Hallo zusammen,
habe mir gestern besagten Trojaner eingefangen.
Im abgesicherten Modus konnte ich eine Systemwiederherstellung machen, so dass der Bildschirm entsperrt war. Damit ist es aber noch nicht getan oder?

Hier mal das Ergebnis von Anti-Malware und die OTL Logfiles:

Anti Malware:

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

 

Datenbank Version: v2012.07.22.04

 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

Malte :: MALTE-PC [Administrator]

 

22.07.2012 12:53:39

mbam-log-2012-07-22 (13-35-19).txt

 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 405092

Laufzeit: 38 Minute(n), 32 Sekunde(n)

 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)

 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)

 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)

 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)

 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)

 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)

 

Infizierte Dateien: 2

C:\Users\Malte\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IR5DXHC2\calc[1].exe (Spyware.Zbot.DG) -> Keine Aktion durchgeführt.

C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

 

(Ende)

OTL:

Extras:

Code:

OTL Extras logfile created on: 22.07.2012 13:40:04 - Run 1

OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Malte\Desktop

64bit- Professional  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 1,80 Gb Available Physical Memory | 45,01% Memory free

8,00 Gb Paging File | 5,62 Gb Available in Paging File | 70,32% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 244,14 Gb Total Space | 17,45 Gb Free Space | 7,15% Space Free | Partition Type: NTFS

Drive D: | 488,28 Gb Total Space | 105,54 Gb Free Space | 21,61% Space Free | Partition Type: NTFS

Drive E: | 198,99 Gb Total Space | 138,67 Gb Free Space | 69,69% Space Free | Partition Type: NTFS

 

Computer Name: MALTE-PC | User Name: Malte | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [ACDSee 14.Manage] -- "C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeQV14.exe" "%1" (ACD Systems International Inc.)

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [ACDSee 14.Manage] -- "C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeQV14.exe" "%1" (ACD Systems International Inc.)

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\PPStream\PPStream.exe" = C:\Program Files (x86)\PPStream\PPStream.exe:*:Enabled:PPStream -- (PPStream.com)

"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla -- ()

"C:\Program Files (x86)\PPStream\PPStream.exe" = C:\Program Files (x86)\PPStream\PPStream.exe:*:Enabled:PPStream -- (PPStream.com)

"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla -- ()

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{171071F6-E83A-40BE-8BF1-19816C316B51}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{19738B6A-DB7F-488F-AF5C-8218039238BE}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{29AC1C33-B01A-4B50-9EF3-8B13608FA9BC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{2CB9502B-9754-4234-B569-4E59F5BBBBB6}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{3021FE33-9574-48C4-B2EC-7399E9B46473}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{35C496A5-11DC-47B3-8C04-63F2EF8C7EB5}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{446DD20C-C1A5-4CC4-8D8F-C9F8543E2077}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{49A58512-EBFD-4C8E-B018-439FD8E9AD09}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{4CC1976E-B527-4D8A-97D1-26CCE81FD750}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{5269FD8E-44B6-42E1-9A14-31802778E010}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{5907306A-1567-4A34-B806-20DF441A2A75}" = lport=445 | protocol=6 | dir=in | app=system | 

"{5AF05E63-ABD0-4C21-A98E-EAD4E0567CCF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{5F2770CB-B381-4A9C-A26D-6956E4FC186D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{658D3CC0-71CF-4234-A7BE-80CDDB7696DE}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{705E408A-0DF7-43CA-B797-FCA8D9318051}" = rport=445 | protocol=6 | dir=out | app=system | 

"{7270C047-1373-4DCC-9998-88DDFA1896BF}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{7A9EDFE0-E9AF-49E8-B3EC-202B18203BD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{7ECDA641-457A-4A6D-92AC-B907376E8A26}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{893219D0-AEEC-461A-AE58-B8BF6DFF53E7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{8EA305FC-1E0B-4F06-81A1-7DC09A560CCF}" = rport=2869 | protocol=6 | dir=out | app=system | 

"{93735F2A-823D-4599-8BE4-FAAE3DECE364}" = rport=137 | protocol=17 | dir=out | app=system | 

"{93AA338C-43FB-4A38-94A7-1553AF714543}" = lport=137 | protocol=17 | dir=in | app=system | 

"{95F7034B-6E16-4581-A4CF-AED8CB83D4AE}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{9F0C7EB3-D889-4E3B-8BE5-FAF52951F166}" = lport=139 | protocol=6 | dir=in | app=system | 

"{A6CD32B0-C03D-4FA8-A454-C96FD6EC0D3B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{A704A2A2-608A-4DA4-976E-23E68FF3F7D6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{A95E4740-AFBD-4BD4-A359-9AE0FF849302}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{A96504B2-46F0-41B0-A62D-1956F88A8353}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{B8BEFA59-ADF4-4BE0-876C-53C69527E39E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{B8D831F5-D3A9-40DB-BEC4-B4A858466A02}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 

"{BEB9145C-C33F-4325-AB30-18649222FC2C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{C2AF9A6A-9F94-4FCF-BA71-3995CB65DF73}" = rport=139 | protocol=6 | dir=out | app=system | 

"{CB063258-CBAB-484A-BCF6-B9EBC4480895}" = rport=138 | protocol=17 | dir=out | app=system | 

"{CFA785BB-3C3D-4F87-8326-F8D1F0BECBAE}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{D528C51A-B565-4B7B-9161-2D6EED384087}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{D5FDBA0C-A4FE-4820-9757-F74377D18E2D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{DF09950E-83B8-41CA-94D6-D878767C4654}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{EE5069CF-6418-4AEE-823C-A84E9803F9A6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{F66B0200-87B4-4CAF-8BC3-270B33011EA6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{F86BC5D2-9CEB-473F-8D97-647227B01866}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{F8E8087F-5433-4EC9-80DB-F9F949B212FF}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 

"{FEE8E290-F677-4E28-9E84-21CED3D03911}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{024B721E-FA55-48F5-AEF0-3A9A3F7164D9}" = protocol=6 | dir=in | app=d:\spiele\gta\rockstar games social club\rgsclauncher.exe | 

"{095CE691-1B9A-42DA-9DE2-4CCE3BCC6B64}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{0A6E3E4E-4DED-4956-98DA-5C9F971C7088}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 

"{0EB599E8-D6B6-4476-8866-B8FE4B15E052}" = dir=in | app=c:\windows\syswow64\mpk\mpkview.exe | 

"{1235400A-D796-4E9E-BFFE-1F23F816236E}" = protocol=6 | dir=out | app=system | 

"{183242B7-379C-49C7-A335-285616C2D9B5}" = protocol=6 | dir=in | app=c:\program files (x86)\netspot device installer\nsdi.exe | 

"{20DE62A9-6C13-4D8D-BEC8-88D00B9B495D}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{21CD5E32-99A8-468F-A191-7CDB158428E8}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 

"{2506D09A-7BDF-4DD2-89EB-5E22FB32946B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{2F1C5C9F-E8C3-4710-A64E-0811D2906665}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 

"{3072D4D3-1454-447B-8C90-F91E9F4CA89F}" = protocol=17 | dir=in | app=d:\spiele\rockstar games\grand theft auto iv\launchgtaiv.exe | 

"{31EE38B1-EEE9-4668-935E-5B20C8658402}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{388083A0-117A-4BAE-9D3A-1C2F6A2A8EA3}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{3B4A3324-F3EA-421B-81A5-BCFE080D2E30}" = dir=in | app=c:\windows\syswow64\mpk\mpk.exe | 

"{41A3D42E-C5B7-4AB6-BEB4-B3E474363B59}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4756B46A-94EF-42E3-B5F8-6809F884E6C0}" = protocol=17 | dir=in | app=c:\program files (x86)\icqlite\icq.exe | 

"{4E843F7F-E14F-4B64-8F44-F365C48A7F8B}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 

"{4FCB3922-5307-4587-AB9E-C3F3512DF7CB}" = protocol=6 | dir=in | app=d:\pps.tv\ppstream\ppsap.exe | 

"{52E34D11-EB3B-4507-8E9C-902621D38512}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{53700BC0-FD1D-4623-9A6C-EBF11717D197}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"{54B11294-14CA-4249-AE7F-7FCDDF6A61B3}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 

"{56D0F265-38CA-44D6-B560-8455ACD1011F}" = protocol=6 | dir=in | app=d:\pps.tv\ppstream\ppstream.exe | 

"{57FC683C-6E63-4E25-8391-A403FAD1857B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{5B233C83-57BE-437A-AAF4-599A902DFF68}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 

"{65486EA4-B3F4-4741-8504-0367C677FE33}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{6B00304E-C4D3-4EDB-9E14-B847AE0DA5D8}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 

"{6BF12513-5C75-4C3D-A638-5B61D1496B97}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{7090A403-3901-4FE0-A591-9858FA15F687}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{735377AF-A542-4858-B5B2-AF81E2979601}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{737FBD03-3E06-4BF4-8082-36D9CDA707C2}" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 

"{76D9D70D-C920-419E-9892-BC13A1E8E7C6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{7F4AAE25-E465-4F75-8613-5ED683986A07}" = protocol=17 | dir=in | app=c:\program files (x86)\icqlite\icq.exe | 

"{8524B2A9-B151-49BD-8747-3115633A12AE}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{957C8E3E-0222-408C-9E47-FA7BF265D8E7}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 

"{97BFF816-31BF-4B15-99F4-B0983C34C616}" = protocol=17 | dir=in | app=d:\spiele\gta\rockstar games social club\rgsclauncher.exe | 

"{9A0DC08D-0E70-4E93-A147-442200003965}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{9E63EADC-4885-470C-9D71-61AA7BC57C45}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{A4E9171B-8AF0-4C35-B917-69F3C3CB9976}" = protocol=6 | dir=in | app=c:\program files (x86)\icqlite\icq.exe | 

"{A9014D1A-73D4-47A9-BE57-132691F36EBF}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"{ABDAB4D9-FB21-4887-93A1-48B2A723AED1}" = protocol=17 | dir=in | app=d:\pps.tv\ppstream\ppsap.exe | 

"{B39E9DF3-671A-4C90-9B90-2EEEF3FE918F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B6593350-F78A-428F-90CE-4E7EFFDA9B42}" = protocol=17 | dir=in | app=c:\program files (x86)\netspot device installer\nsdi.exe | 

"{B792EF20-020F-4D7C-ADA7-39D9612D04C9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{BC924969-A5B3-46C2-92B2-CEFAB3F6D667}" = protocol=6 | dir=in | app=d:\spiele\rockstar games\grand theft auto iv\launchgtaiv.exe | 

"{C2B24581-6BE7-4EBC-A073-A26D0B0680AE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C6CDDE23-F701-4066-A561-D116DF98C3DD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{CAB9F172-AF36-471A-9D0E-519194642251}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{CBB45626-90A1-4DA1-B3F0-5464FDDF0994}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"{D0827389-0338-46F2-99B6-3651D17F4C52}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{D0FC55E3-D74D-40C6-BC2E-5DB9FC10F89B}" = protocol=17 | dir=in | app=d:\pps.tv\ppstream\ppstream.exe | 

"{D60CB6B3-C04D-409C-B6DD-8B492972DCE6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{D7696E78-BEAC-4D39-9BC0-9E135A80D6CE}" = protocol=6 | dir=in | app=c:\program files (x86)\icqlite\icq.exe | 

"{D7AADECA-6B21-4A90-8E0C-42C226E395EB}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 

"{E07E9881-A246-4C98-8967-ACAAF85BB787}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{E1E66172-6F67-47C0-8610-85F952BB524E}" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 

"{F56453D7-3D20-42D5-B22A-5C2EFAC91E88}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 

"{F63BD2BE-F790-4020-A965-0C8DA8533881}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{F741A9BA-95B4-4F38-A563-4DFA066737D0}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 

"{F871761C-2A7E-49DE-842B-30019D25FEE2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{FD455615-7E09-4D63-8418-E163F2A8097B}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"{FDA919C4-8B17-45BF-8107-EA73A1D60B03}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"TCP Query User{04D413E6-399A-4337-986E-D3E862CF922E}C:\program files (x86)\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 

"TCP Query User{056778C6-B53C-4828-AA4A-41F0E017EB8F}C:\program files (x86)\gigabyte\easysaver\updexe.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gigabyte\easysaver\updexe.exe | 

"TCP Query User{05A97B68-2926-4987-B8CB-5111955ACF1E}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"TCP Query User{0734644D-0247-4027-8A22-73AF9E783178}C:\program files (x86)\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 

"TCP Query User{07F64D4E-6462-44F9-8CAF-D34A7A7CA069}C:\program files (x86)\unified remote\remoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\unified remote\remoteserver.exe | 

"TCP Query User{173D0C98-A01F-4B53-BFFC-3640DEBC267E}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"TCP Query User{1A889EEC-82B1-4AF0-BD78-7D97F9A29C28}E:\spiele\xiii\system\xiii.exe" = protocol=6 | dir=in | app=e:\spiele\xiii\system\xiii.exe | 

"TCP Query User{22E5A25B-B02F-457A-B56E-742923F77933}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 

"TCP Query User{2964C58F-4C0C-4FCD-8373-073833D38235}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=6 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe | 

"TCP Query User{305D4B1B-DB0E-4CFB-98A0-81F5A243C267}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 

"TCP Query User{328D922C-702F-4791-81D5-E5034692C77F}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 

"TCP Query User{4C27831A-2E13-4F11-A045-74FFD2926E01}D:\spiele\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=d:\spiele\rockstar games\grand theft auto iv\gtaiv.exe | 

"TCP Query User{522C362E-EEE0-48A0-BE58-5804EEB79E22}D:\spiele\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=d:\spiele\rockstar games\grand theft auto iv\gtaiv.exe | 

"TCP Query User{69FF5535-D80B-4385-BFF3-DA4DDC028F3C}C:\program files (x86)\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tvants\tvants.exe | 

"TCP Query User{83C14EEA-1DAB-477D-BE16-95732F458241}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 

"TCP Query User{84A899DD-59C9-4234-B3D7-565CC2E8E4CD}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 

"TCP Query User{A405BAC2-1629-43D3-9F1A-AFE26E48E8C9}E:\spiele\fifa11\game\fifa.exe" = protocol=6 | dir=in | app=e:\spiele\fifa11\game\fifa.exe | 

"TCP Query User{A44FA39C-FA73-44BC-8142-2D22964823E0}C:\program files (x86)\qip\qip.exe" = protocol=6 | dir=in | app=c:\program files (x86)\qip\qip.exe | 

"TCP Query User{A5A7605D-3908-40A8-8BAF-10B59608DEDD}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 

"TCP Query User{D3F1BA3E-47DD-40D7-92AD-84EB631D9B2A}D:\spiele\fifa 12\game\fifa.exe" = protocol=6 | dir=in | app=d:\spiele\fifa 12\game\fifa.exe | 

"TCP Query User{DC99FEC9-C333-41AE-81DD-4BEC89474C39}E:\spiele\fifa11\game\fifa.exe" = protocol=6 | dir=in | app=e:\spiele\fifa11\game\fifa.exe | 

"TCP Query User{FA2063E4-E01E-4119-B574-96EF4FFB8B15}C:\program files (x86)\ppstream\ppstream.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ppstream\ppstream.exe | 

"TCP Query User{FF261D61-A04D-427A-9EC5-656A4012DD7E}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"UDP Query User{04FB90AE-D59D-467D-B314-AD646DACC1AA}C:\program files (x86)\gigabyte\easysaver\updexe.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gigabyte\easysaver\updexe.exe | 

"UDP Query User{08543477-FF3D-42A7-91AB-362ADCBC67D5}D:\spiele\fifa 12\game\fifa.exe" = protocol=17 | dir=in | app=d:\spiele\fifa 12\game\fifa.exe | 

"UDP Query User{18D796E7-C177-4479-85DE-749C9EAE672B}D:\spiele\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=d:\spiele\rockstar games\grand theft auto iv\gtaiv.exe | 

"UDP Query User{19E83A68-F416-4D0E-9323-BEF553765090}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 

"UDP Query User{27A7C2E6-B502-44AB-8E0B-2331B7912AC1}C:\program files (x86)\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tvants\tvants.exe | 

"UDP Query User{2CC9F211-CDFE-47A8-9120-BE9C3AB1EEC2}C:\program files (x86)\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 

"UDP Query User{3E0A1338-740B-4874-897C-173351923032}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 

"UDP Query User{4222672E-2EB4-4C0C-9A98-C85B611CE55C}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"UDP Query User{472D8410-DDBD-4511-A4EF-A9C93D990A0B}E:\spiele\fifa11\game\fifa.exe" = protocol=17 | dir=in | app=e:\spiele\fifa11\game\fifa.exe | 

"UDP Query User{5FCF7E69-D82C-4961-B980-A7EA7AE635A8}E:\spiele\xiii\system\xiii.exe" = protocol=17 | dir=in | app=e:\spiele\xiii\system\xiii.exe | 

"UDP Query User{689F860F-EDED-49ED-B576-9998E37E2F45}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"UDP Query User{6D95AD8D-BF15-4C78-A34D-C88FDC5C040A}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 

"UDP Query User{7E2D428E-A1D8-4C6A-AAF4-F7DEAED454C5}C:\program files (x86)\qip\qip.exe" = protocol=17 | dir=in | app=c:\program files (x86)\qip\qip.exe | 

"UDP Query User{7EAAF046-3B96-425E-9E0A-43B012CA3B03}C:\program files (x86)\ppstream\ppstream.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ppstream\ppstream.exe | 

"UDP Query User{98FEFF16-121A-4B7F-8365-365B12E15253}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 

"UDP Query User{994D67CB-4DAA-4D01-839F-2B629922B355}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=17 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe | 

"UDP Query User{9D887A7C-745C-41FB-B096-FA4076BA71D8}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 

"UDP Query User{AAD80224-2DB6-4F08-BB6D-A75336002FD3}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"UDP Query User{B406426D-9C04-4811-9001-8EFF2BB2DF15}D:\spiele\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=d:\spiele\rockstar games\grand theft auto iv\gtaiv.exe | 

"UDP Query User{D3D8DEA1-1658-4A79-B1DD-370E15BD7321}C:\program files (x86)\unified remote\remoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\unified remote\remoteserver.exe | 

"UDP Query User{D9395135-7048-4876-975C-516A90679B5B}C:\program files (x86)\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 

"UDP Query User{FABDBA95-A1AA-466A-B0B9-88E6D56DD287}E:\spiele\fifa11\game\fifa.exe" = protocol=17 | dir=in | app=e:\spiele\fifa11\game\fifa.exe | 

"UDP Query User{FE272BE7-7C83-49F2-BE60-C60D22EDBB54}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{0C682623-8F66-46A8-B9B3-93FE1E66A001}" = iTunes

"{14E10342-F2B4-41f7-B955-F5C7BE8BC1FF}" = Autodesk Inventor View 2010 Language Pack - Deutsch

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64

"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64

"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll

"{5783F2D7-8005-0407-0102-0060B0CE6BBA}" = AutoCAD Mechanical 2010

"{5783F2D7-8005-0407-1102-0060B0CE6BBA}" = AutoCAD Mechanical 2010 Language Pack - Deutsch

"{5EC22191-8A56-4e02-8F20-29A9C2EB0771}" = Autodesk Vault 2010 (Client) Language Pack - Deutsch

"{62E86312-9CF7-4A96-9F9E-261C3A4CC20A}" = Autodesk Inventor View 2010

"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64

"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4

"{8A837C47-2B21-4FDF-8370-41A1EB6A26E8}" = Microsoft Xbox 360 Accessories 1.1

"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4

"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64

"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010

"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010

"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4

"{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support

"{98754D03-0B21-4d4a-9B89-93A2828AE26B}" = Autodesk Vault 2010 (Client)

"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.4.28

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)

"{DC9C8BC1-72CE-B5FE-EA4F-6D9127E51746}" = ATI Catalyst Install Manager

"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4

"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"AutoCAD Mechanical 2010" = AutoCAD Mechanical 2010

"Autodesk Inventor View 2010" = Autodesk Inventor View 2010

"Canon LBP2900" = Canon LBP2900

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"Recuva" = Recuva

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"WinRAR archiver" = WinRAR

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM

"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4

"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4

"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club

"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler

"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4

"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4

"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup

"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4

"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4

"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4

"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4

"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB

"{1834A376-697A-43E0-9B3A-54D3A8C09466}" = BlueStacks (beta-1)

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 29

"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4

"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4

"{3B11379A-9196-4228-981A-BB255E13109E}" = Autostart-Manager 2006

"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4

"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin

"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11

"{4925C0C2-E4E2-456B-9791-0F228BDDC428}" = Facebook Messenger 2.1.4570.0

"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{55D9E026-DCB0-46FF-B60A-68B972228CF6}" = Autodesk Design Review 2010

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4

"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support

"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4

"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6C13128C-1782-456F-84A4-017CECE259CA}" = ICQ Lite

"{6F5A71BD-9EC9-4A59-BFBD-CA63CFB4885D}" = ACDSee 14

"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{75F509C3-5F01-48C1-ACB9-B9B38A952E6C}" = Unified Remote

"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4

"{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver

"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4

"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010

"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage

"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4

"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch

"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars

"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX

"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4

"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw

"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3

"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime

"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4

"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4

"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4

"Autodesk Design Review 2010" = Autodesk Design Review 2010

"Autodesk Vault 2010 (Client)" = Autodesk Vault 2010 (Client)

"Autostartmanager" = Autostartmanager 1.45

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"AVMWLANCLI" = AVM FRITZ!WLAN

"ClassicPro" = ClassicPro© v1.13

"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)

"DivX Setup.divx.com" = DivX-Setup

"Fifa 12 (c) Electronic Arts_is1" = Fifa 12 (c) Electronic Arts version 1

"FoxyTunesForFirefox" = FoxyTunes for Firefox

"Free Music Zilla_is1" = Free Music Zilla

"FreePDF_XP" = FreePDF (Remove only)

"GoldWave v5.54" = GoldWave v5.54

"GPL Ghostscript 8.70" = GPL Ghostscript 8.70

"ICQToolbar" = ICQ Toolbar

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"JDownloader" = JDownloader

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300

"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"Office14.PROPLUS" = Microsoft Office Professional Plus 2010

"Shredder (3.0b4)" = Shredder (3.0b4)

"SpeedFan" = SpeedFan (remove only)

"VLC media player" = VLC media player 1.0.1

"Winamp" = Winamp

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 13.07.2012 12:49:21 | Computer Name = Malte-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 13.07.2012 12:49:21 | Computer Name = Malte-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 2757848

 

Error - 13.07.2012 12:49:21 | Computer Name = Malte-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 2757848

 

Error - 13.07.2012 12:49:37 | Computer Name = Malte-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 13.07.2012 12:49:38 | Computer Name = Malte-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 2774010

 

Error - 13.07.2012 12:49:38 | Computer Name = Malte-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 2774010

 

Error - 17.07.2012 12:24:50 | Computer Name = Malte-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: EXCEL.EXE, Version: 14.0.4756.1000,

 Zeitstempel: 0x4b9c08e8  Name des fehlerhaften Moduls: EXCEL.EXE, Version: 14.0.4756.1000,

 Zeitstempel: 0x4b9c08e8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00025c80  ID des fehlerhaften

 Prozesses: 0x13b0  Startzeit der fehlerhaften Anwendung: 0x01cd642d09315d10  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

Berichtskennung:

 ee348693-d02b-11e1-978a-c36abb51b6f5

 

Error - 19.07.2012 06:06:17 | Computer Name = Malte-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: EQNEDT32.EXE, Version: 2000.11.9.0,

 Zeitstempel: 0x3a0acebf  Name des fehlerhaften Moduls: EQNEDT32.EXE, Version: 2000.11.9.0,

 Zeitstempel: 0x3a0acebf  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00025ef1  ID des fehlerhaften

 Prozesses: 0x1390  Startzeit der fehlerhaften Anwendung: 0x01cd65936a328f12  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Berichtskennung:

 60d0cec0-d189-11e1-8ca6-b19bb9bbd0fa

 

Error - 22.07.2012 05:07:22 | Computer Name = Malte-PC | Source = System Restore | ID = 8206

Description = 

 

Error - 22.07.2012 05:28:07 | Computer Name = Malte-PC | Source = Google Update | ID = 20

Description = 

 

[ System Events ]

Error - 22.07.2012 05:03:34 | Computer Name = Malte-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 22.07.2012 05:03:34 | Computer Name = Malte-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 22.07.2012 05:03:34 | Computer Name = Malte-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 22.07.2012 05:04:13 | Computer Name = Malte-PC | Source = DCOM | ID = 10005

Description = 

 

Error - 22.07.2012 05:06:00 | Computer Name = Malte-PC | Source = volsnap | ID = 393252

Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher

 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

 

Error - 22.07.2012 05:07:54 | Computer Name = Malte-PC | Source = VDS Basic Provider | ID = 33554433

Description = 

 

Error - 22.07.2012 05:07:54 | Computer Name = Malte-PC | Source = VDS Basic Provider | ID = 33554433

Description = 

 

Error - 22.07.2012 05:08:03 | Computer Name = Malte-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 22.07.2012 05:08:42 | Computer Name = Malte-PC | Source = Service Control Manager | ID = 7031

Description = Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0"

 wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen

 werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

 

Error - 22.07.2012 05:08:46 | Computer Name = Malte-PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde

 unerwartet beendet. Dies ist bereits 2 Mal passiert.

 

 

< End of report >

Vielen Dank für die Hilfe!

:hallo:

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hallo t´john, vielen Dank für deine Hilfe! Hier die OTL.txt nach dem Customscan:

Code:

OTL logfile created on: 23.07.2012 08:41:00 - Run 2

OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Malte\Desktop

64bit- Professional  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,53 Gb Available Physical Memory | 63,28% Memory free

8,00 Gb Paging File | 6,43 Gb Available in Paging File | 80,43% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 244,14 Gb Total Space | 17,02 Gb Free Space | 6,97% Space Free | Partition Type: NTFS

Drive D: | 488,28 Gb Total Space | 105,54 Gb Free Space | 21,61% Space Free | Partition Type: NTFS

Drive E: | 198,99 Gb Total Space | 138,67 Gb Free Space | 69,69% Space Free | Partition Type: NTFS

 

Computer Name: MALTE-PC | User Name: Malte | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Malte\Desktop\OTL(1).exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

PRC - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.)

PRC - C:\Program Files (x86)\Unified Remote\RemoteServer.exe (Unified Remote)

PRC - C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems)

PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)

PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)

PRC - C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM GmbH Berlin)

PRC - C:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Users\Malte\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\3989b4ca6cf904061992daec9e7d5644\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\42221dddc2b53dc24f14e9c285d1de8f\PresentationFramework.Aero.ni.dll ()

MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\6a6f4be744ed5bc5273cbcf0fcf303e3\System.Management.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\250b525aa8c17327216e102569c0d766\System.ServiceModel.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\dc1f0dbf1d3ba856eccec90b62b55d79\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\e9f8a45b1063d6c6a62718c88a5623d1\System.Runtime.Serialization.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\035910922f160d304fb834aae41f45a6\System.Xaml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\17e020ae92d7fab33bcc1c98b25019d0\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\dd57bc19f5807c6dbe8f88d4a23277f6\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\92cccedc7cda413ff6fc6492cb256b58\System.Data.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\3963e9ce8d44f50e8367e92a8e3e42e6\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\d17606e813f01376bd0def23726ecc62\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\e997d0200c25f7db6bd32313d50b729d\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ac18c2dcd06bd2a0589bac94ccae5716\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\713647b987b140a17e3c4ffe4c721f85\System.Core.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\964da027ebca3b263a05cadb8eaa20a3\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\246f1a5abb686b9dcdf22d3505b08cea\mscorlib.ni.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (BstHdLogRotatorSvc) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.)

SRV - (BstHdAndroidSvc) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe (BlueStack Systems, Inc.)

SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)

SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (RTL8192su) -- C:\Windows\SysNative\drivers\RTL8192su.sys (Realtek Semiconductor Corporation                           )

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)

DRV:64bit: - (WSDScan) -- C:\Windows\SysNative\drivers\WSDScan.sys (Microsoft Corporation)

DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)

DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )

DRV:64bit: - (ENTECH64) -- C:\Windows\SysNative\drivers\Entech64.sys (EnTech Taiwan)

DRV:64bit: - (adfs) -- C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)

DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)

DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\drivers\fwlanusb.sys (AVM GmbH)

DRV - (BstHdDrv) -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys (BlueStack Systems)

DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (adfs) -- C:\Windows\SysWow64\drivers\adfs.sys (Adobe Systems, Inc.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = hxxp://search.qip.ru/?query={searchTerms}

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.qip.ru

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 87 E0 C6 9D 2E 4C CA 01  [binary data]

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - No CLSID value found

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = hxxp://search.qip.ru/?query={searchTerms}

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "google.de"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9

FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67

FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.5.6

FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2

FF - prefs.js..extensions.enabledItems: 5

FF - prefs.js..extensions.enabledItems: 3

FF - prefs.js..extensions.enabledItems: 1

FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6

FF - prefs.js..extensions.enabledItems: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3

FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.7896

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29

FF - prefs.js..extensions.enabledItems: {394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B}:2.0.1

FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20110802

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Malte\AppData\Local\Facebook\Messenger\2.1.4570.0\npFbDesktopPlugin.dll (Facebook, Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.18 18:09:26 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.15 16:55:31 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Shredder 3.0b4\extensions\\Components: C:\Program Files (x86)\Shredder 3.0 Beta 4\components [2010.12.31 21:48:54 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Shredder 3.0b4\extensions\\Plugins: C:\Program Files (x86)\Shredder 3.0 Beta 4\plugins [2010.12.31 21:48:54 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.18 18:09:26 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.15 16:55:31 | 000,000,000 | ---D | M]

 

[2010.03.22 10:57:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Malte\AppData\Roaming\mozilla\Extensions

[2009.10.14 23:52:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Malte\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.07.07 18:57:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions

[2011.01.01 15:27:39 | 000,000,000 | ---D | M] (Image Zoom) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}

[2012.06.05 18:24:41 | 000,000,000 | ---D | M] (LightShot (screenshot tool)) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B}

[2012.05.15 16:56:01 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}

[2011.05.06 16:49:44 | 000,000,000 | ---D | M] (CacheViewer) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}

[2010.04.28 21:22:23 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\firefox@tvunetworks.com

[2010.03.22 12:37:44 | 000,005,310 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\m41l9q0f.default\searchplugins\footiefox.xml

[2010.03.22 10:57:55 | 000,000,687 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\m41l9q0f.default\searchplugins\icq-search.xml

[2010.06.21 17:35:24 | 000,001,042 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\m41l9q0f.default\searchplugins\icqplugin.xml

[2012.05.15 16:55:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2010.01.05 15:06:20 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.07.20 19:06:25 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.07.04 17:37:30 | 000,743,290 | ---- | M] () (No name found) -- C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2012.05.15 16:55:48 | 000,138,614 | ---- | M] () (No name found) -- C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI

[2012.05.15 16:55:50 | 000,325,600 | ---- | M] () (No name found) -- C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\SMARTERWIKI@WIKIATIC.COM.XPI

[2012.06.18 18:09:26 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.10.03 06:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2009.09.21 11:00:44 | 001,447,328 | ---- | M] (1 mal 1 Software GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\NpFv522.dll

[2012.05.15 16:55:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.05.15 16:55:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.05.15 16:55:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.05.15 16:55:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.05.15 16:55:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.05.15 16:55:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - homepage: hxxp://www.google.com/

CHR - default_search_provider: Bing (Enabled)

CHR - default_search_provider: search_url = hxxp://www.bing.com/search?setmkt=de-DE&q={searchTerms}

CHR - default_search_provider: suggest_url = hxxp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}

CHR - homepage: hxxp://www.google.com/

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll

CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gears.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.150.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll

CHR - plugin: Java(TM) Platform SE 6 U15 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Flatcast Viewer Plugin 5.2.2.454 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NpFv522.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll

CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll

CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Windows\system32\TVUAx\npTVUAx.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\Malte\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\Malte\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Skype Extension = C:\Users\Malte\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0\

CHR - Extension: Google Mail = C:\Users\Malte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2008.10.21 20:36:51 | 000,001,231 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O1 - Hosts: 127.0.0.1   activate.adobe.com

O1 - Hosts: 127.0.0.1   practivate.adobe.com

O1 - Hosts: 127.0.0.1   ereg.adobe.com

O1 - Hosts: 127.0.0.1   activate.wip3.adobe.com

O1 - Hosts: 127.0.0.1   wip3.adobe.com

O1 - Hosts: 127.0.0.1   3dns-3.adobe.com

O1 - Hosts: 127.0.0.1   3dns-2.adobe.com

O1 - Hosts: 127.0.0.1   adobe-dns.adobe.com

O1 - Hosts: 127.0.0.1   adobe-dns-2.adobe.com

O1 - Hosts: 127.0.0.1   adobe-dns-3.adobe.com

O1 - Hosts: 127.0.0.1   ereg.wip3.adobe.com

O1 - Hosts: 127.0.0.1   activate-sea.adobe.com

O1 - Hosts: 127.0.0.1   wwis-dubc1-vip60.adobe.com

O1 - Hosts: 127.0.0.1   activate-sjc0.adobe.com

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3:64bit: - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found

O4:64bit: - HKLM..\Run: [RivaTunerStartupDaemon] "C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe" /S File not found

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)

O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)

O4 - HKLM..\Run: [ACSW14DE] C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems)

O4 - HKLM..\Run: [Adobe ARM] REM "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" File not found

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] REM "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found

O4 - HKLM..\Run: [AdobeCS4ServiceManager] REM "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM GmbH Berlin)

O4 - HKLM..\Run: [DivXUpdate] REM "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW File not found

O4 - HKLM..\Run: [FreePDF Assistant] REM C:\Program Files (x86)\FreePDF_XP\fpassist.exe File not found

O4 - HKLM..\Run: [iTunesHelper] REM "C:\Program Files (x86)\iTunes\iTunesHelper.exe" File not found

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [QuickTime Task] REM "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime File not found

O4 - HKLM..\Run: [SunJavaUpdateSched] REM "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" File not found

O4 - HKLM..\Run: [WinampAgent] REM "C:\Program Files (x86)\Winamp\winampa.exe" File not found

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [AdobeBridge] REM "C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [BlueStacks Agent] REM C:\Program Files (x86)\BlueStacks\HD-Agent.exe File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [BlueStacks App Player] REM C:\Program Files (x86)\BlueStacks\HD-FrontEnd.exe Android hidemode File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [DAEMON Tools Lite] REM "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [Facebook Update] C:\Users\Malte\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [ICQ] REM "C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4 File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [PPS Accelerator] REM D:\PPS.tv\PPStream\ppsap.exe File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [RGSC] D:\Spiele\gta\Rockstar Games Social Club\RGSCLauncher.exe (Take-Two Interactive Software, Inc.)

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [Skype] REM "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [SpybotSD TeaTimer] REM C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [Unified Remote v2] C:\Program Files (x86)\Unified Remote\RemoteServer.exe (Unified Remote)

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Malte\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe (Facebook)

O4 - Startup: C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Free Music Zilla.lnk = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 File not found

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} hxxp://download.livetv.ru/livetv.ru/cab/tvants.cab.rar (Reg Error: Key error.)

O16:64bit: - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://dl.pplive.com/PluginSetup.cab (Reg Error: Key error.)

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} hxxp://download.gigabyte.com.tw/object/Dldrv.ocx (Dldrv2 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E01B766-068B-4735-8AC1-E19A2DA4DDA8}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{788A71A4-6AA7-4C47-AB9E-69B0FDEF1EBD}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1DF4B1F-F293-4923-AC1F-6E2BE37477DD}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB23281C-5AF5-4FFD-BD37-D041082C7036}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EFEB0BFD-7137-4F1B-B766-4B1C202F1C92}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202

O18:64bit: - Protocol\Handler\cdo - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.03.02 12:55:37 | 000,000,000 | ---D | M] - E:\Autocad -- [ NTFS ]

O33 - MountPoints2\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\Shell - "" = AutoRun

O33 - MountPoints2\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\Shell\AutoRun\command - "" = H:\Autorun.exe

O33 - MountPoints2\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\Shell - "" = AutoRun

O33 - MountPoints2\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\Shell\AutoRun\command - "" = G:\setup.exe

O33 - MountPoints2\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\Shell - "" = AutoRun

O33 - MountPoints2\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\Shell\AutoRun\command - "" = L:\AutoRunCD.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {1EFA8F9D-5C3B-05FD-F6E2-08055C78C046} - Microsoft Windows Media Player

ActiveX:64bit: {221A16BE-FB08-4424-BE5D-6FC1795C729F} - Microsoft Windows Media Player

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {6218CDB2-2FBD-2EAF-390A-C4F288A74C88} - Microsoft Windows Media Player

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {AA3A4DD5-7705-2555-841D-9384D7A43F32} - Microsoft Windows Media Player

ActiveX:64bit: {B5E971B3-02A7-6ED7-348D-41D1C3DDE54A} - Microsoft Windows Media Player

ActiveX:64bit: {C524B3BE-BE85-6760-0847-0DD93C657498} - Microsoft Windows Media Player

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {D9BCEA74-CB18-B4A1-E473-474AA2018DA5} - Microsoft Windows Media Player

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {72AC7289-44ED-3B15-51C0-615B452209E8} - Java (Sun)

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: VIDC.ACDV - ACDV.dll File not found

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.23 08:37:44 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Malte\Desktop\OTL(1).exe

[2012.07.22 13:33:25 | 000,000,000 | ---D | C] -- C:\Users\Malte\Desktop\Logdateien

[2012.07.22 12:50:53 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Malwarebytes

[2012.07.22 12:50:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.07.22 12:50:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.07.22 12:50:42 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.07.22 12:50:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.07.17 14:45:09 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.07.17 14:41:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint

[2012.07.17 14:41:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

[2012.07.17 14:40:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services

[2012.07.17 14:40:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2012.07.17 14:40:08 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2012.07.17 14:40:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework

[2012.07.17 14:40:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition

[2012.07.17 14:38:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8

[2012.07.17 14:37:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2012.07.17 14:37:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services

[2012.07.17 14:37:03 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Local\Microsoft Help

[2012.07.17 14:36:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2012.07.17 14:35:41 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2012.07.12 18:21:08 | 000,000,000 | ---D | C] -- C:\Users\Malte\Desktop\kostenscheiße

[2012.07.09 23:23:57 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.23 08:41:55 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.23 08:41:55 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.23 08:38:26 | 001,611,160 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.07.23 08:38:26 | 000,696,132 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.07.23 08:38:26 | 000,651,450 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.07.23 08:38:26 | 000,147,428 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.07.23 08:38:26 | 000,120,382 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.07.23 08:37:46 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Malte\Desktop\OTL(1).exe

[2012.07.23 08:35:45 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.07.23 08:33:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.23 08:33:42 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.22 18:46:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.07.22 17:28:00 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001UA.job

[2012.07.22 13:02:40 | 000,052,073 | ---- | M] () -- C:\Users\Malte\Desktop\85104-otl-otlogfile-by-oldtimer.html

[2012.07.22 12:50:43 | 000,001,085 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.22 11:28:02 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001Core.job

[2012.07.21 23:43:45 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad

[2012.07.21 16:22:45 | 000,001,891 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

[2012.07.17 14:48:27 | 003,150,808 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.07.11 19:43:34 | 000,020,783 | ---- | M] () -- C:\Users\Malte\Desktop\FP-A.pdf

[2012.07.09 23:23:57 | 000,001,348 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk

[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.06.26 14:20:10 | 000,526,869 | ---- | M] () -- C:\Users\Malte\Desktop\flug.jpg

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.07.22 13:01:48 | 000,052,073 | ---- | C] () -- C:\Users\Malte\Desktop\85104-otl-otlogfile-by-oldtimer.html

[2012.07.22 12:50:43 | 000,001,085 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.21 16:22:45 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad

[2012.07.21 16:22:45 | 000,001,891 | ---- | C] () -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

[2012.06.27 20:41:14 | 000,020,783 | ---- | C] () -- C:\Users\Malte\Desktop\FP-A.pdf

[2012.06.26 14:20:10 | 000,526,869 | ---- | C] () -- C:\Users\Malte\Desktop\flug.jpg

[2012.06.22 18:09:01 | 000,003,584 | ---- | C] () -- C:\Users\Malte\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.05.23 18:49:34 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2012.05.23 18:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2012.05.23 18:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2012.05.23 18:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2012.05.23 18:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2012.01.31 11:46:13 | 001,588,294 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.08.03 03:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2010.02.10 19:07:36 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.11.22 21:16:38 | 000,015,428 | ---- | C] () -- C:\Users\Malte\RefEdit.exd

[2009.10.13 17:13:20 | 000,007,630 | ---- | C] () -- C:\Users\Malte\AppData\Local\Resmon.ResmonCfg

 
 ========== LOP Check ==========

 

[2012.05.02 11:06:10 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ACD Systems

[2009.10.17 00:42:23 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Autodesk

[2009.11.18 12:33:35 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\com.adobe.ExMan

[2009.10.18 21:27:54 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\DAEMON Tools Lite

[2010.05.04 13:04:57 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Dev-Cpp

[2012.04.27 12:09:59 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\FMZilla

[2012.06.13 12:42:47 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ICQ

[2010.11.09 16:33:28 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Leadertech

[2009.10.27 18:15:53 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Miranda

[2010.05.29 14:14:40 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\OpenOffice.org

[2011.10.19 16:23:36 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ppstream

[2012.06.12 18:54:57 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Samsung

[2009.10.14 23:52:21 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Thunderbird

[2012.01.31 11:50:24 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Unified Remote

[2012.07.22 11:28:02 | 000,001,116 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001Core.job

[2012.07.22 17:28:00 | 000,001,138 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001UA.job

[2012.07.05 21:24:01 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.05.02 11:06:10 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ACD Systems

[2010.01.03 14:34:22 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Adobe

[2010.12.31 21:52:55 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Apple Computer

[2009.10.17 00:42:23 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Autodesk

[2009.11.17 17:23:03 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\AVS4YOU

[2009.11.18 12:33:35 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\com.adobe.ExMan

[2009.10.18 21:27:54 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\DAEMON Tools Lite

[2010.05.04 13:04:57 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Dev-Cpp

[2009.12.21 21:15:39 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\dvdcss

[2012.04.27 12:09:59 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\FMZilla

[2012.06.13 12:42:47 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ICQ

[2009.10.13 19:26:34 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Identities

[2010.11.09 16:33:28 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Leadertech

[2009.10.13 18:20:24 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Macromedia

[2012.07.22 12:50:53 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Malwarebytes

[2009.07.14 20:18:34 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Media Center Programs

[2012.07.17 14:50:15 | 000,000,000 | --SD | M] -- C:\Users\Malte\AppData\Roaming\Microsoft

[2009.10.27 18:15:53 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Miranda

[2009.10.13 20:09:11 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Mozilla

[2012.01.26 15:33:34 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\NVIDIA

[2010.05.29 14:14:40 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\OpenOffice.org

[2011.10.19 16:23:36 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ppstream

[2012.06.12 18:54:57 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Samsung

[2009.11.22 14:36:57 | 000,000,000 | RH-D | M] -- C:\Users\Malte\AppData\Roaming\SecuROM

[2012.04.24 09:28:38 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Skype

[2009.10.14 23:52:21 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Thunderbird

[2012.01.31 11:50:24 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Unified Remote

[2012.07.07 23:12:29 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\vlc

[2012.05.20 14:08:30 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Winamp

[2009.10.26 22:11:48 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

[2011.08.16 14:17:28 | 003,089,056 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Malte\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

[2009.10.13 23:46:08 | 000,411,136 | R--- | M] () -- C:\Users\Malte\AppData\Roaming\Microsoft\Installer\{14E10342-F2B4-41f7-B955-F5C7BE8BC1FF}\InvIcon9.exe

[2009.10.13 23:45:15 | 000,010,134 | R--- | M] () -- C:\Users\Malte\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

[2012.05.24 19:14:32 | 000,958,392 | ---- | M] (Samsung) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\Kies.exe

[2012.05.24 19:14:36 | 000,278,968 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesDriverInstaller.exe

[2012.05.24 19:14:34 | 003,521,464 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesTrayAgent.exe

[2012.05.23 18:50:34 | 000,721,920 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceManager.exe

[2012.05.24 19:14:38 | 000,067,512 | ---- | M] (Samsung) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\Kies_Tutorial.exe

[2012.05.24 19:14:42 | 000,183,736 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\BinaryLoaderMgr.exe

[2012.05.24 19:14:42 | 000,021,432 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\KiesPDLR.exe

[2012.05.24 19:14:44 | 003,570,352 | ---- | M] (Freeware) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\MediaModules\MyFreeCodecPack.exe

[2012.05.24 19:14:46 | 000,371,128 | ---- | M] (ml) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\Temp\Kies.Update.exe

[2012.06.08 13:02:14 | 000,371,128 | ---- | M] (ml) -- C:\Users\Malte\AppData\Roaming\Samsung\Kies\UpdateTemp\Updater\Kies.Update.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

 
 < MD5 for: AHCIX86S.SYS  >

[2009.05.18 11:30:42 | 000,187,704 | ---- | M] (Advanced Micro Devices, Inc) MD5=3C1A384594317899852D777FC53F9E77 -- C:\MBtreiber\win7-64bit\Packages\Drivers\SBDrv\SB7xx\RAID\W7\ahcix86s.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\drivers\nvstor.sys

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 24 bytes -> C:\Windows:80AC0B63AE3AABA0
 

< End of report >

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

:OTL

MOD - C:\Users\Malte\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll () 

SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 

IE - HKLM\..\SearchScopes,DefaultScope = {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 

IE - HKLM\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = http://search.qip.ru/?query={searchTerms} 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\URLSearchHook: - No CLSID value found 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - No CLSID value found 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = http://search.qip.ru/?query={searchTerms} 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms} 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 

FF - prefs.js..browser.search.useDBForOrder: true 

FF - prefs.js..browser.startup.homepage: "google.de" 

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 

FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67 

FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.5.6 

FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 

FF - prefs.js..extensions.enabledItems: 5 

FF - prefs.js..extensions.enabledItems: 3 

FF - prefs.js..extensions.enabledItems: 1 

FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6 

FF - prefs.js..extensions.enabledItems: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3 

FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.7896 

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29 

FF - prefs.js..extensions.enabledItems: {394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B}:2.0.1 

FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20110802 

FF - user.js - File not found 

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 

O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found 

O3:64bit: - HKU\S-1-5-21-2557932159-375623832-2062197235-1001\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found 

O4:64bit: - HKLM..\Run: [RivaTunerStartupDaemon] "C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe" /S File not found 

O4 - HKLM..\Run: [Adobe ARM] REM "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" File not found 

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] REM "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found 

O4 - HKLM..\Run: [AdobeCS4ServiceManager] REM "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin File not found 

O4 - HKLM..\Run: [DivXUpdate] REM "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW File not found 

O4 - HKLM..\Run: [FreePDF Assistant] REM C:\Program Files (x86)\FreePDF_XP\fpassist.exe File not found 

O4 - HKLM..\Run: [iTunesHelper] REM "C:\Program Files (x86)\iTunes\iTunesHelper.exe" File not found 

O4 - HKLM..\Run: [QuickTime Task] REM "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime File not found 

O4 - HKLM..\Run: [SunJavaUpdateSched] REM "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" File not found 

O4 - HKLM..\Run: [WinampAgent] REM "C:\Program Files (x86)\Winamp\winampa.exe" File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [AdobeBridge] REM "C:\Program Files (x86)\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [BlueStacks Agent] REM C:\Program Files (x86)\BlueStacks\HD-Agent.exe File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [BlueStacks App Player] REM C:\Program Files (x86)\BlueStacks\HD-FrontEnd.exe Android hidemode File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [DAEMON Tools Lite] REM "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [Facebook Update] C:\Users\Malte\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [ICQ] REM "C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4 File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [PPS Accelerator] REM D:\PPS.tv\PPStream\ppsap.exe File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [Skype] REM "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1001..\Run: [SpybotSD TeaTimer] REM C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe File not found 

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 

O4 - HKU\S-1-5-21-2557932159-375623832-2062197235-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 

O4 - Startup: C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Malte\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe (Facebook) 

O4 - Startup: C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Free Music Zilla.lnk = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe () 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 

O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 File not found 

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 File not found 

O16:64bit: - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} http://download.livetv.ru/livetv.ru/cab/tvants.cab.rar (Reg Error: Key error.) 

O16:64bit: - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} http://dl.pplive.com/PluginSetup.cab (Reg Error: Key error.) 

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 

O32 - HKLM CDRom: AutoRun - 1 

O33 - MountPoints2\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\Shell - "" = AutoRun 

O33 - MountPoints2\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\Shell\AutoRun\command - "" = H:\Autorun.exe 

O33 - MountPoints2\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\Shell - "" = AutoRun 

O33 - MountPoints2\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\Shell\AutoRun\command - "" = G:\setup.exe 

O33 - MountPoints2\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\Shell - "" = AutoRun 

O33 - MountPoints2\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\Shell\AutoRun\command - "" = L:\AutoRunCD.exe 

Drivers32: VIDC.ACDV - ACDV.dll File not found 
 

[2012.07.21 23:43:45 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad 
 
 

@Alternate Data Stream - 24 bytes -> C:\Windows:80AC0B63AE3AABA0 

[

[2012.05.15 16:55:48 | 000,138,614 | ---- | M] () (No name found) -- C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI 

[2012.05.15 16:55:50 | 000,325,600 | ---- | M] () (No name found) -- C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\SMARTERWIKI@WIKIATIC.COM.XPI 
 

[2012.05.15 16:56:01 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} 
 

[2012.07.23 08:35:45 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 

[2012.07.22 18:46:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 

[2012.07.22 17:28:00 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001UA.job 

[2012.07.22 17:28:00 | 000,001,138 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001UA.job 

[2012.07.22 11:28:02 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001Core.job 

[2012.07.22 11:28:02 | 000,001,116 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001Core.job 

[2012.07.21 23:43:45 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad 

[2012.07.21 16:22:45 | 000,001,891 | ---- | M] () -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 

[2012.05.23 18:49:34 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe 
 

 

:Files
 

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Hier die OTL nach dem fixen:

Code:

All processes killed

Error: Unable to interpret <Code:> in the current context!

========== OTL ==========

Service ICQ Service stopped successfully!

Service ICQ Service deleted successfully!

C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe moved successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\ not found.

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-21-2557932159-375623832-2062197235-1001\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.

C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll moved successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\ not found.

HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.

Registry key HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}\ not found.

Registry key HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}\ not found.

HKU\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

Prefs.js: true removed from browser.search.useDBForOrder

Prefs.js: "google.de" removed from browser.startup.homepage

Prefs.js: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 removed from extensions.enabledItems

Prefs.js: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67 removed from extensions.enabledItems

Prefs.js: smarterwiki@wikiatic.com:4.5.6 removed from extensions.enabledItems

Prefs.js: firefox@tvunetworks.com:2 removed from extensions.enabledItems

Prefs.js: 5 removed from extensions.enabledItems

Prefs.js: 3 removed from extensions.enabledItems

Prefs.js: 1 removed from extensions.enabledItems

Prefs.js: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6 removed from extensions.enabledItems

Prefs.js: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3 removed from extensions.enabledItems

Prefs.js: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.7896 removed from extensions.enabledItems

Prefs.js: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29 removed from extensions.enabledItems

Prefs.js: {394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B}:2.0.1 removed from extensions.enabledItems

Prefs.js: nasanightlaunch@example.com:0.6.20110802 removed from extensions.enabledItems

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.

C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.

File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully.

64bit-Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\RivaTunerStartupDaemon deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeCS4ServiceManager deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FreePDF Assistant deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BlueStacks Agent deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BlueStacks App Player deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update deleted successfully.

C:\Users\Malte\AppData\Local\Facebook\Update\FacebookUpdate.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\KiesAirMessage deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\KiesHelper deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPDLR deleted successfully.

C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\PPS Accelerator deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Skype deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1005\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk moved successfully.

C:\Users\Malte\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe moved successfully.

C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Free Music Zilla.lnk moved successfully.

C:\Program Files (x86)\Free Music Zilla\FMZilla.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.

Starting removal of ActiveX control {4C833081-D026-4FF8-968F-7EAB660D2FBA}

C:\Windows\Downloaded Program Files\SETUP.INF moved successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4C833081-D026-4FF8-968F-7EAB660D2FBA}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C833081-D026-4FF8-968F-7EAB660D2FBA}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4C833081-D026-4FF8-968F-7EAB660D2FBA}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C833081-D026-4FF8-968F-7EAB660D2FBA}\ not found.

Starting removal of ActiveX control {EF0D1A14-1033-41A2-A589-240C01EDC078}

C:\Windows\Downloaded Program Files\install.inf moved successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{EF0D1A14-1033-41A2-A589-240C01EDC078}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{EF0D1A14-1033-41A2-A589-240C01EDC078}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF0D1A14-1033-41A2-A589-240C01EDC078}\ not found.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c28f9800-ebaf-11de-bffe-00241d8f8f2d}\ not found.

File H:\Autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd95d4d1-d425-11de-ba5c-00241d8f8f2d}\ not found.

File G:\setup.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e5dad473-bc1b-11de-b8bf-00241d8f8f2d}\ not found.

File L:\AutoRunCD.exe not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\\VIDC.ACDV deleted successfully.

C:\ProgramData\0tbpw.pad moved successfully.

ADS C:\Windows:80AC0B63AE3AABA0 deleted successfully.

File  not found.

C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI moved successfully.

C:\USERS\MALTE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M41L9Q0F.DEFAULT\EXTENSIONS\SMARTERWIKI@WIKIATIC.COM.XPI moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\Linux\components folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\Linux folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\Darwin\components folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\Darwin folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\defaults\preferences folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\defaults folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\components-js\players folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\components-js\music-updates folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\components-js\anonymous-stats folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\components-js folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\components folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\chrome\icons\default folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\chrome\icons folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\chrome folder moved successfully.

C:\Users\Malte\AppData\Roaming\mozilla\Firefox\Profiles\m41l9q0f.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} folder moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.

C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001UA.job moved successfully.

File C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001UA.job not found.

C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001Core.job moved successfully.

File C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2557932159-375623832-2062197235-1001Core.job not found.

File C:\ProgramData\0tbpw.pad not found.

C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.

C:\Windows\MusiccityDownload.exe moved successfully.

========== FILES ==========
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\Malte\Desktop\cmd.bat deleted successfully.

C:\Users\Malte\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Malte

->Temp folder emptied: 16098190 bytes

->Temporary Internet Files folder emptied: 1238430205 bytes

->Java cache emptied: 6947837 bytes

->FireFox cache emptied: 59111704 bytes

->Google Chrome cache emptied: 19237590 bytes

->Flash cache emptied: 3092511 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 155648 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 18582 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes

RecycleBin emptied: 29122613 bytes

 

Total Files Cleaned = 1.309,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: Malte

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

 

Total Flash Files Cleaned = 0,00 mb

 

 

OTL by OldTimer - Version 3.2.54.0 log created on 07232012_110518
 

Files\Folders moved on Reboot...

C:\Users\Malte\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...

File C:\Users\Malte\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
 

Registry entries deleted on Reboot...

Sehr gut! :daumenhoc

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

hier die Logdatei vom adwcleaner

Code:

# AdwCleaner v1.703 - Logfile created 07/23/2012 at 12:28:07

# Updated 20/07/2012 by Xplode

# Operating system : Windows 7 Professional  (64 bits)

# User : Malte - MALTE-PC

# Running from : C:\Users\Malte\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

File Found : C:\Users\Malte\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll 
 

***** [Registry] *****
 

Key Found : HKLM\SOFTWARE\DT Soft

Key Found : HKLM\SOFTWARE\Wise Solutions
 

***** [Registre - GUID] *****
 

Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}

[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}

[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v8.0.7600.16385
 

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://search.qip.ru

[HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://search.qip.ru

[HKCU\Software\Microsoft\Internet Explorer\Main - Default_Search_URL] = hxxp://search.qip.ru

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://search.qip.ru/ie
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\m41l9q0f.default\prefs.js
 

[OK] File is clean.
 

-\\ Google Chrome v [Unable to get version]
 

File : C:\Users\Malte\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [2856 octets] - [23/07/2012 12:28:07]
 

########## EOF - C:\AdwCleaner[R1].txt - [2984 octets] ##########

und hier nochmal Anit Malware:

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.23.05
 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

Malte :: MALTE-PC [Administrator]
 

23.07.2012 11:33:29

mbam-log-2012-07-23 (11-33-29).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 397228

Laufzeit: 51 Minute(n), 55 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Sehr gut! :daumenhoc

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Für Emisoft AntiMalware wird das Servicepack 1 benötigt, welches ich nicht installiert habe. Soll ich dies jetzt einfach installieren oder hat das irgendeinen Einfluss auf unser bisheriges Vorgehen? ;)

Alle Updates einspielen, danach Emsisoft!

Emsisoft Anti_Malware

Code:

Emsisoft Anti-Malware - Version 6.6

Letztes Update: 23.07.2012 21:40:59
 

Scan Einstellungen:
 

Scan Methode: Detail Scan

Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\

Archiv Scan: An

ADS Scan: An
 

Scan Beginn:        23.07.2012 21:57:56
 

C:\Program Files (x86)\MKV Demux All\win32process.pyd         gefunden: Worm.Win32.RJump!E2

C:\Program Files (x86)\MKV Demux All\pywintypes24.dll         gefunden: Worm.Win32.RJump!E2

C:\Program Files (x86)\MKV Demux All\win32pipe.pyd         gefunden: Worm.Win32.RJump!E2

C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\FormDesigner.exe         gefunden: Riskware.Crack.Formdesigner!E2

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\FormDesigner.exe         gefunden: Riskware.Crack.Formdesigner!E2
 

Gescannt        680142

Gefunden        5
 

Scan Ende:        23.07.2012 22:44:32

Scan Zeit:        0:46:36
 

C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\FormDesigner.exe        Quarantäne Riskware.Crack.Formdesigner!E2

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\FormDesigner.exe        Quarantäne Riskware.Crack.Formdesigner!E2

C:\Program Files (x86)\MKV Demux All\win32process.pyd        Quarantäne Worm.Win32.RJump!E2

C:\Program Files (x86)\MKV Demux All\pywintypes24.dll        Quarantäne Worm.Win32.RJump!E2

C:\Program Files (x86)\MKV Demux All\win32pipe.pyd        Quarantäne Worm.Win32.RJump!E2
 

Quarantäne        5

AdwCleaner

Code:

# AdwCleaner v1.703 - Logfile created 07/23/2012 at 19:01:31

# Updated 20/07/2012 by Xplode

# Operating system : Windows 7 Professional  (64 bits)

# User : Malte - MALTE-PC

# Running from : C:\Users\Malte\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

File Deleted : C:\Users\Malte\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll 
 

***** [Registry] *****
 

Key Deleted : HKLM\SOFTWARE\DT Soft

Key Deleted : HKLM\SOFTWARE\Wise Solutions
 

***** [Registre - GUID] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v8.0.7600.16385
 

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://search.qip.ru --> hxxp://www.google.com

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://search.qip.ru --> hxxp://www.google.com

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Search_URL] = hxxp://search.qip.ru --> hxxp://www.google.com

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://search.qip.ru/ie --> hxxp://www.google.com
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\m41l9q0f.default\prefs.js
 

[OK] File is clean.
 

-\\ Google Chrome v [Unable to get version]
 

File : C:\Users\Malte\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [2973 octets] - [23/07/2012 12:28:07]

AdwCleaner[S1].txt - [2526 octets] - [23/07/2012 19:01:31]
 

########## EOF - C:\AdwCleaner[S1].txt - [2654 octets] ##########

Sehr gut! :daumenhoc

Lasse die Funde loeschen, dann:

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hey t'john...Hier die Eset-log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=2527f6a93a59d34a8f54b18ada874c64

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-07-24 01:11:24

# local_time=2012-07-24 03:11:24 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 100 254236 118631667 74078 0

# compatibility_mode=5893 16776573 100 94 45559 94746210 0 0

# compatibility_mode=8192 67108863 100 0 210 210 0 0

# scanned=204573

# found=3

# cleaned=3

# scan_time=19124

C:\Program Files (x86)\PPStream\XP_SP2_tcpPatch.exe        probably a variant of Win32/Spy.Agent.BZVBALJ trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

C:\Users\Malte\Downloads\ppstream_104641.exe        probably a variant of Win32/Spy.Agent.BZVBALJ trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

C:\Users\Malte\Downloads\SoftonicDownloader56473.exe        a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

Sehr gut! :daumenhoc

Malware mit Combofix beseitigen

Lade Combofix von einem der folgenden Download-Spiegel herunter:

BleepingComputer.com - ForoSpyware.com

und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig!
Beachte die ausführliche Original-Anleitung.

Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:

Windows XP (nur 32-bit)
Windows Vista (32-bit/64-bit)
Windows 7 (32-bit/64-bit)

Vorbereitung und wichtige Hinweise

Bitte während des Scans mit Combofix Antiviren- sowie Antispy-Programme, die Firewall und evtl. vorhandenes Skript-Blocking (Norton) deaktivieren.
Liste der zu deaktivierenden Programme.
Bei Unklarheiten bitte fragen.

ComboFix wird Deine Einstellungen in Bezug auf den Bildschirmschoner zurücksetzen.
Diese Einstellungen kannst Du nach Beendigung unserer Bereinigung wieder ändern.
Mache nichts anderes, wenn es Dir nicht gelungen ist, Combofix laufen zu lassen.
Teile uns das mit und warte auf unsere Anweisungen.

Starte die Combofix.exe mit Rechtsklick => Als Administrator ausführen und folge den Anweisungen.
Während des Laufs von Combofix nichts anderes am Computer machen!
Akzeptiere die Bedingungen (Disclaimer) mit "Ja".

Sollte Combofix eine aktuellere Version anbieten, Downlaod erlauben.
Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.
Es erscheint eine blaue Eingabeaufforderung, Combofix wird für den Suchlauf vorbereitet.
Bitte nicht in dieses Combofix-Fenster klicken.
Das könnte Dein System einfrieren oder hängen bleiben lassen.
Es wird ein Backup Deiner Registry erstellt.
Nun werden die einzelnen Stufen des Programms abgearbeitet, das kann eine Weile dauern.

Wenn ComboFix fertig ist, wird es ein Log erstellen (bitte warten, das dauert einen Moment).
Unbedingt warten, bis sich das Combofix-Fenster geschlossen hat und das Logfile im Editor erscheint.
Bitte poste die Log-Dateien C:\ComboFix.txt und C:\Qoobox\Add-Remove Programs.txt in Code-Tags hier in den Thread.

Hinweis: Combofix macht aus verschiedenen Gründen den Internet Explorer zum Standard-Browser und erstellt ein IE-Icon auf dem Desktop.
Das IE-Desktop-Icon kannst Du nach der Bereinigung wieder löschen und Deinen bevorzugten Browser wieder als Standard-Browser einstellen.

Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!

So hier nun die Combofixlog

Code:

ComboFix 12-07-25.04 - Malte 25.07.2012   8:43.1.4 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4094.2667 [GMT 2:00]

ausgeführt von:: c:\users\Malte\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\security\Database\tmp.edb

c:\windows\SysWow64\DEBUG.log

c:\windows\SysWow64\muzapp.exe

E:\install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-25 bis 2012-07-25  ))))))))))))))))))))))))))))))

.

.

2012-07-23 19:27 . 2012-07-23 21:37        --------        d-----w-        c:\program files (x86)\Emsisoft Anti-Malware

2012-07-23 19:10 . 2012-07-23 19:11        --------        d-----w-        c:\windows\system32\SPReview

2012-07-23 18:51 . 2010-11-20 03:00        2560        ----a-w-        c:\windows\system32\drivers\de-DE\rdpwd.sys.mui

2012-07-23 18:50 . 2010-11-20 03:12        7168        ----a-w-        c:\windows\system32\drivers\de-DE\msdsm.sys.mui

2012-07-23 18:50 . 2010-11-20 03:07        3584        ----a-w-        c:\windows\system32\drivers\de-DE\tsusbflt.sys.mui

2012-07-23 18:50 . 2010-11-20 03:00        4608        ----a-w-        c:\windows\system32\drivers\de-DE\vdrvroot.sys.mui

2012-07-23 18:50 . 2010-11-20 03:07        2560        ----a-w-        c:\windows\system32\drivers\de-DE\disk.sys.mui

2012-07-23 18:44 . 2010-11-20 03:26        3205120        ----a-w-        c:\windows\system32\mmcndmgr.dll

2012-07-23 18:43 . 2010-11-20 03:44        1077248        ----a-w-        c:\windows\system32\Narrator.exe

2012-07-23 18:42 . 2012-07-23 18:42        --------        d-----w-        c:\windows\system32\EventProviders

2012-07-23 09:05 . 2012-07-23 09:05        --------        d-----w-        C:\_OTL

2012-07-22 10:50 . 2012-07-22 10:50        --------        d-----w-        c:\users\Malte\AppData\Roaming\Malwarebytes

2012-07-22 10:50 . 2012-07-22 10:50        --------        d-----w-        c:\programdata\Malwarebytes

2012-07-22 10:50 . 2012-07-22 10:50        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-22 10:50 . 2012-07-03 11:46        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-07-17 12:40 . 2012-07-17 12:40        --------        d-----w-        c:\program files (x86)\Microsoft Synchronization Services

2012-07-17 12:40 . 2012-07-17 12:40        --------        d-----w-        c:\windows\PCHEALTH

2012-07-17 12:40 . 2012-07-17 12:40        --------        d-----w-        c:\program files (x86)\Microsoft Sync Framework

2012-07-17 12:40 . 2012-07-17 12:40        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition

2012-07-17 12:38 . 2012-07-17 12:38        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 8

2012-07-17 12:37 . 2012-07-17 12:37        --------        d-----w-        c:\program files\Microsoft Office

2012-07-17 12:37 . 2012-07-17 12:37        --------        d-----w-        c:\program files (x86)\Microsoft Analysis Services

2012-07-17 12:37 . 2012-07-17 12:37        --------        d-----w-        c:\users\Malte\AppData\Local\Microsoft Help

2012-07-17 12:36 . 2012-07-17 12:46        --------        d-----w-        c:\programdata\Microsoft Help

2012-07-17 12:35 . 2012-07-17 12:35        --------        d-----r-        C:\MSOCache

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-23 19:05 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll

2012-07-23 19:05 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll

2012-06-02 22:19 . 2012-06-19 09:19        38424        ----a-w-        c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-19 09:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-19 09:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-19 09:19        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-19 09:19        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-19 09:19        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-19 09:19        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-02 13:19 . 2012-06-19 09:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-02 13:15 . 2012-06-19 09:19        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-05-29 07:38 . 2012-05-23 16:49        330240        ----a-w-        c:\windows\MASetupCaller.dll

2012-05-23 16:50 . 2012-06-12 16:49        4659712        ----a-w-        c:\windows\SysWow64\Redemption.dll

2012-05-23 16:49 . 2012-05-23 16:49        90112        ----a-w-        c:\windows\MAMCityDownload.ocx

2012-05-23 16:49 . 2012-05-23 16:49        974848        ----a-w-        c:\windows\SysWow64\cis-2.4.dll

2012-05-23 16:49 . 2012-05-23 16:49        81920        ----a-w-        c:\windows\SysWow64\issacapi_bs-2.3.dll

2012-05-23 16:49 . 2012-05-23 16:49        65536        ----a-w-        c:\windows\SysWow64\issacapi_pe-2.3.dll

2012-05-23 16:49 . 2012-05-23 16:49        57344        ----a-w-        c:\windows\SysWow64\MTXSYNCICON.dll

2012-05-23 16:49 . 2012-05-23 16:49        57344        ----a-w-        c:\windows\SysWow64\MK_Lyric.dll

2012-05-23 16:49 . 2012-05-23 16:49        57344        ----a-w-        c:\windows\SysWow64\issacapi_se-2.3.dll

2012-05-23 16:49 . 2012-05-23 16:49        569344        ----a-w-        c:\windows\SysWow64\muzdecode.ax

2012-05-23 16:49 . 2012-05-23 16:49        491520        ----a-w-        c:\windows\SysWow64\muzapp.dll

2012-05-23 16:49 . 2012-05-23 16:49        49152        ----a-w-        c:\windows\SysWow64\MaJGUILib.dll

2012-05-23 16:49 . 2012-05-23 16:49        45320        ----a-w-        c:\windows\SysWow64\MAMACExtract.dll

2012-05-23 16:49 . 2012-05-23 16:49        45056        ----a-w-        c:\windows\SysWow64\MaXMLProto.dll

2012-05-23 16:49 . 2012-05-23 16:49        45056        ----a-w-        c:\windows\SysWow64\MACXMLProto.dll

2012-05-23 16:49 . 2012-05-23 16:49        40960        ----a-w-        c:\windows\SysWow64\MTTELECHIP.dll

2012-05-23 16:49 . 2012-05-23 16:49        352256        ----a-w-        c:\windows\SysWow64\MSLUR71.dll

2012-05-23 16:49 . 2012-05-23 16:49        258048        ----a-w-        c:\windows\SysWow64\muzoggsp.ax

2012-05-23 16:49 . 2012-05-23 16:49        245760        ----a-w-        c:\windows\SysWow64\MSCLib.dll

2012-05-23 16:49 . 2012-05-23 16:49        24576        ----a-w-        c:\windows\SysWow64\MASetupCleaner.exe

2012-05-23 16:49 . 2012-05-23 16:49        200704        ----a-w-        c:\windows\SysWow64\muzwmts.dll

2012-05-23 16:49 . 2012-05-23 16:49        155648        ----a-w-        c:\windows\SysWow64\MSFLib.dll

2012-05-23 16:49 . 2012-05-23 16:49        143360        ----a-w-        c:\windows\SysWow64\3DAudio.ax

2012-05-23 16:49 . 2012-05-23 16:49        135168        ----a-w-        c:\windows\SysWow64\muzaf1.dll

2012-05-23 16:49 . 2012-05-23 16:49        131072        ----a-w-        c:\windows\SysWow64\muzmpgsp.ax

2012-05-23 16:49 . 2012-05-23 16:49        122880        ----a-w-        c:\windows\SysWow64\muzeffect.ax

2012-05-23 16:49 . 2012-05-23 16:49        118784        ----a-w-        c:\windows\SysWow64\MaDRM.dll

2012-05-23 16:49 . 2012-05-23 16:49        110592        ----a-w-        c:\windows\SysWow64\muzmp4sp.ax

2012-05-23 16:49 . 2012-06-12 16:49        821824        ----a-w-        c:\windows\SysWow64\dgderapi.dll

2012-05-21 02:09 . 2012-06-12 17:01        99384        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2012-05-21 02:09 . 2012-06-12 17:01        203320        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"RGSC"="d:\spiele\gta\Rockstar Games Social Club\RGSCLauncher.exe" [2009-11-25 306088]

"Unified Remote v2"="c:\program files (x86)\Unified Remote\RemoteServer.exe" [2011-12-02 226816]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2005-12-08 1560576]

"ACSW14DE"="c:\program files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe" [2011-11-17 1231472]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-06-08 3521464]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Canon LBP2900 Status Window.lnk - c:\windows\System32\spool\drivers\x64\3\CNAB4LAD.EXE [2010-1-13 60384]

Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-10 135664]

R3 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]

R3 cpuz130;cpuz130;c:\users\Malte\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-05-21 99384]

R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [2008-09-17 12744]

R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-11-18 1038088]

R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2005-12-08 458752]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-10 135664]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-18 113120]

R3 netr28ux;RT2870-USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr28ux.sys [2009-06-10 867328]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RivaTuner64;RivaTuner64;c:\program files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-05-21 203320]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]

R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]

R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-17 834544]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [2012-04-10 75104]

S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [2012-04-10 385376]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]

S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-02-06 690208]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-01-20 6963744]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-01-20 1833504]

"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 855608]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://start.icq.com/

uDefault_Search_URL = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = 

uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip

IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202

TCP: Interfaces\{0E01B766-068B-4735-8AC1-E19A2DA4DDA8}: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\m41l9q0f.default\

FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.032"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.abr"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.amr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.amr"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ani"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.apd"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.arw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.bay"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.bmp"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.bw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bwf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.bwf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cel\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.cel"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.cr2"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.crw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.cs1"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.cur"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.dcr"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.dcx"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.dib"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.djv"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.djvu"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.dng"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.emf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.eps"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.erf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.fff"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.flc"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fli\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.fli"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.fpx"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.gif"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.hdr"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.icl"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.icn"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.iff"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ilbm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.int"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.inta"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.iw4"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.j2c"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.j2k"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jbr"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jfif"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jif"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jp2"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jpc"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jpe"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jpeg"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jpg"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jpk"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.jpx"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.kdc"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.lbm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m15\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.m15"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1a\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.m1a"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2a\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.m2a"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m75\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.m75"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.mef"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.mos"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.mpv"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.mrw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.nef"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.nrw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.orf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pbm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pbr"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pcd"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pct"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pcx"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pef"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pgm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pic"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pics\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pics"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pict"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pix"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.png"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ppm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.psd"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.psp"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pspbrush"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.pspimage"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qcp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.qcp"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qtpf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.qtpf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.raf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ras"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.raw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.rgb"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.rgba"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.rle"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.rsb"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.rw2"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.rwl"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sdv\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.sdv"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfil\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.sfil"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.sgi"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.smf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smi\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.smi"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smil\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.smil"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.sml"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.sr2"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.srf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.srw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.swa\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.swa"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.tga"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.thm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.tif"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.tiff"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ttc"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ttf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ulw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.ulw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14o\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.v14o"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14p\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.v14p"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v14pf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.v14pf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vfw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.vfw"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.wbm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.wbmp"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.wmf"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.xbm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.xif"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.xmp"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 14.xpm"

.

[HKEY_USERS\S-1-5-21-2557932159-375623832-2062197235-1001\Software\SecuROM\License information*]

"datasecu"=hex:36,bf,e2,e9,38,ba,88,00,f5,8f,a2,11,a0,0b,4e,ea,8d,0a,2d,a1,70,

   21,75,ab,b4,a2,81,2c,ff,b3,7f,97,aa,27,73,7e,0b,27,d4,54,96,af,19,56,de,8c,\

"rkeysecu"=hex:fc,3f,a4,56,4f,29,7e,42,60,b8,c5,d0,cd,65,20,da

.

[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\avmwlanstick\WlanNetService.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-25  09:07:43 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-25 07:07

.

Vor Suchlauf: 13 Verzeichnis(se), 17.790.070.784 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 17.502.121.984 Bytes frei

.

- - End Of File - - CE5FB0C470439A9456DAB61ED274D182

hm wenn ich das richtig verstehe hab ich wohl den windows defender nicht deaktiviert? wusste ehrlichgesagt nicht dass der auch im hintergrund läuft:confused: