Sorry, ich dachte das muss unbedingt mit zufälligem Namen asugeführt werden.
Hier die Logs: Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.1.6 (07.17.2013:4)
OS: Windows 7 Professional x64
Ran by Tobias on 19.07.2013 at 0:17:14,43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D}
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\secman.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\{4d076ab4-7562-427a-b5d2-bd96e19dee56}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{3c471948-f874-49f5-b338-4f214a2ee0b1}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{66eef543-a9ac-4a9d-aa3c-1ed148ac8eee}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{826d7151-8d99-434b-8540-082b8c2ae556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{66eef543-a9ac-4a9d-aa3c-1ed148ac8eee}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\typelib\{11549fe4-7c5a-4c17-9fc3-56fc5162a994}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduitengine
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitengine
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\toolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\conduit.engine
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\babylon_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\babylon_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\classes\Toolbar.CT3031778
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
~~~ Files
Successfully deleted: [File] C:\eula.1028.txt
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\eula.1033.txt
Successfully deleted: [File] C:\eula.1036.txt
Successfully deleted: [File] C:\eula.1040.txt
Successfully deleted: [File] C:\eula.1041.txt
Successfully deleted: [File] C:\eula.1042.txt
Successfully deleted: [File] C:\eula.2052.txt
Successfully deleted: [File] C:\install.res.1028.dll
Successfully deleted: [File] C:\install.res.1031.dll
Successfully deleted: [File] C:\install.res.1033.dll
Successfully deleted: [File] C:\install.res.1036.dll
Successfully deleted: [File] C:\install.res.1040.dll
Successfully deleted: [File] C:\install.res.1041.dll
Successfully deleted: [File] C:\install.res.1042.dll
Successfully deleted: [File] C:\install.res.2052.dll
Successfully deleted: [File] C:\install.res.3082.dll
Successfully deleted: [File] "C:\Windows\syswow64\conduitengine.tmp"
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Tobias\appdata\local\conduit"
Successfully deleted: [Folder] "C:\Users\Tobias\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\Users\Tobias\appdata\locallow\conduitengine"
Successfully deleted: [Folder] "C:\Program Files (x86)\autocompletepro"
Successfully deleted: [Folder] "C:\Program Files (x86)\babylon"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduitengine"
Successfully deleted: [Folder] "C:\Program Files (x86)\icq6toolbar"
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{02F7BFF5-C83D-4AB9-B635-89FC632C7EB4}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{0602542A-2BF8-4B9D-A2B7-6F4900527BE4}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{0F909FA9-D479-4366-B7B3-153421F89610}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{115490CA-23B1-4345-89D6-02FD699F2F90}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{1259CD14-09D4-4C42-A8D5-C8A5433CF4D8}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{12FED79A-8731-49BC-A329-7567AFD04D0D}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{1873FA13-D84C-4D08-882C-919D50E09976}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{1D9A6F27-953F-4974-B037-58E1E3A7E50C}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{204D8BFB-795A-4C46-8A73-1A802625E736}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{21AC7C84-4C5D-457C-9689-929C12A70868}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{26633055-2E72-406E-BA83-BBC7E98EF206}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{28FA4266-895F-480A-9717-249A0F659C51}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{29F240D1-9CC7-4271-9540-DB6A72120803}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{30962682-7D35-4AB0-8D12-6D2640C54B2B}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{35661D91-56F6-4A88-A095-FDD203A8DFB8}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{39D742B7-448C-4A31-86FB-32A96808D8E6}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{3AAD316F-5EAF-4F7C-8EA8-FB544BD6D13B}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{3AECF09B-09AD-4BDD-BC97-A3E6FBF0D45F}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{3B41E7F3-20C3-4AD4-942B-08205F6799D3}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{3F57A44F-7FFD-4A28-9D62-CFE99CFA9DA9}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{400624ED-2228-4B4A-9D4C-ABF90D7344C1}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{405D2399-5FE0-434A-BA62-F14DF9809EC6}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{408E6910-91D1-46BC-A23C-29C96CD25915}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{41FD06B3-2240-41D2-897B-D28E40452847}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{42D90330-1028-4CB7-9C3F-513849CD488F}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{48E98062-1F39-4A82-BC19-075BD24F5C15}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{4B1C8D04-DD35-48AF-B9F9-FA1159F821EA}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{4BC3B035-D1AF-4462-92CF-123DFCAC29CE}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{549016B4-60B3-4593-B531-80B726ACCBE2}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{551B8800-A792-4FBD-8138-A592E8B124B9}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{55305282-5924-4E74-959D-157DBBDF74DD}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{56A85047-F001-4D9C-99C4-67CFCA2ADAA6}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{5976A7AB-6477-433E-B6E7-C91122374361}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{5AEB9A6C-0430-461B-B695-15765BAA3611}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{5C003D7B-939A-482A-84B3-6CDE1E18D8A5}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{5C0DEB19-A2F8-401F-BFE3-6E0D4DAE0869}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{647CF0E4-207E-455B-9B8D-5432D9991C85}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{64BE8C8A-EFDA-4EA8-91AC-71BD309059A2}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{676553BB-AC2B-4E3B-9014-088CA693D153}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{72F87A77-FB5D-44E3-9098-14EE1328B6FA}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{73DF5EBE-D949-40EE-BE42-7CDB0FC5E4B4}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{767DDB89-65D5-42C8-AC69-1CF8795B1B40}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{76A2D1D7-D515-4B77-BAF4-6173CD5E0349}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{76F47267-9605-4DDD-BBA3-F9475E437AF5}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{78EB6B6B-A74B-4928-875D-E197EAC6504A}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{79278476-C709-45E7-ADC9-A211EC4018CF}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{7E7FE326-DDBA-4CF5-81AD-47D233C483EE}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{7FA5415C-9EAC-4F2E-B3E8-60BD6052146B}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{80F79A36-EA3B-4E2F-A668-7DA061A13F88}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{81AB7F83-FC25-4E01-8E7B-E57A5D940B53}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{84D3AB9B-CAC1-4A36-9E1D-AB7BD3DEBAA5}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{86E7C9FC-C40C-4C34-B9B3-B05245EC0B27}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{88FD6D59-A880-41D6-9DDD-BC5E0F946700}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{8E6D0149-07EC-489E-97D4-442C43EB39D0}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{95D911B1-B140-42DC-A775-738C6B5C2B8C}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{980C0C15-1DA5-41C1-BC5D-7CCC516E20C9}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{981BC9BE-BB93-436E-A2B9-DFCCE60614AF}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{9AAAB27F-4BAD-4138-BF9E-362DE65DBD1E}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{9AAB4A4C-C797-4A02-BA79-07A997EE5371}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{9D328284-402C-4E7B-952A-6823FB9B2AD3}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{A2B80EA9-0010-4D22-8CB8-1FD104C15091}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{A32D919D-7F85-43B5-A3B1-1FE308B177B8}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{A3B7C73B-443A-43DF-B137-498253D623CB}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{AB4DEED0-C7F7-4A45-8A28-E4A874F7CA6D}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{AD937D84-3A49-47B1-8AB1-101E9E5A3CBF}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{AE104CB3-64EE-4AC0-B648-6B4D0BED8638}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{B27C7F72-B640-49EB-85EA-F93DD0FCDA13}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{B35DAC6F-DD95-4588-BDAB-07164F67E17F}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{B8EF8C6D-CD06-4207-8CDD-49B6624D8F73}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{BA2487ED-41A6-4D13-9415-1A800842F257}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{BA8B9322-51B6-470C-A6F8-AAD156A58E53}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{BBB6C2ED-B5AE-4054-A0C1-3A2693BE8F1B}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{BE56C35B-2839-4C7A-BB99-78D4A3F78C9E}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{CCCD344E-EABD-41EF-94B7-C42B34223EB8}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{CD0634FF-F9EE-4C32-88C1-43846915EDE7}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{CE44747D-5112-4EF7-B05B-718FA74939C5}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{CE4A9008-5B36-45E1-BF59-415E65CC1A5F}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{CEC13D43-707B-450B-94AE-8A28C53EBCD4}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{CEEC725D-8F2D-43DB-9FFB-2A63887822CF}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{D12697A4-D851-4A8A-8EA2-B8D777BF1D22}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{D7821216-304C-4ABE-B975-66F6B7612C79}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{D81306D5-7E41-41CD-9EFA-7FC1BFB8F124}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{DE1ADDE4-472E-49AE-9A32-B1AA9002320B}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{DFAA66C0-566C-408A-BF63-8106592553F2}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{E10B7221-62EB-431B-B636-EDDB765E6897}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{E5CC9112-DBD4-4331-A3CF-95058D3209EB}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{E9632DAB-02D2-4631-A18D-1CDD0F6EA73A}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{E9C69E97-E296-4294-946D-D4DA8B5C3FE0}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{ED66322F-8965-46F5-865D-10BAB99523B5}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{EF5F87BC-CA2D-4DFF-968D-EE18CCEA19D3}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{F646412B-CF64-4943-A488-328470BA2BBC}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{F7378C2F-E364-4D55-B47C-4EDCB3C819DC}
Successfully deleted: [Empty Folder] C:\Users\Tobias\appdata\local\{FCB2808D-F010-46B0-937A-5E82DB6BACD5}
~~~ FireFox
Emptied folder: C:\Users\Tobias\AppData\Roaming\mozilla\firefox\profiles\gh1ag6rt.default\minidumps [241 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.07.2013 at 0:23:38,17
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
# AdwCleaner v2.305 - Datei am 19/07/2013 um 00:27:20 erstellt
# Aktualisiert am 11/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Tobias - TOBIAS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Tobias\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2008\Microsoft Visual Studio 2008-Dokumentation.lnk
Ordner Gelöscht : C:\Program Files (x86)\SFT_de3
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Users\Polina\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Polina\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Polina\AppData\LocalLow\SFT_de3
Ordner Gelöscht : C:\Users\Tobias\AppData\LocalLow\SFT_de3
Ordner Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\gh1ag6rt.default\extensions\{ff88a983-649d-4207-9336-9b999280b436}
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SFT_de3
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FF88A983-649D-4207-9336-9B999280B436}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF88A983-649D-4207-9336-9B999280B436}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BE5E5AC1-9926-4F3D-B850-8923E652A79E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d72520cb767454006c3f77a01e6254fa
Schlüssel Gelöscht : HKLM\Software\SFT_de3
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BE5E5AC1-9926-4F3D-B850-8923E652A79E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FF88A983-649D-4207-9336-9B999280B436}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{23743E3F-0BFD-43B2-A011-B30926B0AFCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{472A2D65-2021-4C4E-9993-895A5F45480D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF88A983-649D-4207-9336-9B999280B436}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SFT_de3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{FF88A983-649D-4207-9336-9B999280B436}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{FF88A983-649D-4207-9336-9B999280B436}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{FF88A983-649D-4207-9336-9B999280B436}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16611
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?ch_id=skins7&q={searchTerms} --> hxxp://www.google.com
-\\ Mozilla Firefox v21.0 (de)
Datei : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\gh1ag6rt.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Polina\AppData\Roaming\Mozilla\Firefox\Profiles\om8cmijr.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [5830 octets] - [19/07/2013 00:27:20]
########## EOF - C:\AdwCleaner[S1].txt - [5890 octets] ##########
Code:
OTL Extras logfile created on: 19.07.2013 00:57:41 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tobias\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 59,99% Memory free
7,99 Gb Paging File | 6,45 Gb Available in Paging File | 80,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 106,93 Gb Total Space | 12,25 Gb Free Space | 11,46% Space Free | Partition Type: NTFS
Drive D: | 1,86 Gb Total Space | 1,86 Gb Free Space | 99,90% Space Free | Partition Type: FAT
Drive K: | 97,66 Gb Total Space | 26,29 Gb Free Space | 26,92% Space Free | Partition Type: NTFS
Computer Name: TOBIAS-PC | User Name: Tobias | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
[HKEY_USERS\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{087C46C6-4573-4623-AF66-2B17B71CC6BA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{22D29FF6-0235-45E8-9881-DBFFA9ABBB53}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{2414118F-3727-42B3-ABE4-CDAC3C8EE8B2}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2ED9B469-E981-4C67-9835-156718522129}" = lport=2869 | protocol=6 | dir=in | app=system |
"{30EC286A-9EB3-44C5-A154-AA83FC6A5BD0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{38C23B5B-6483-40FA-AE08-58E606D5113E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3DF99CEC-2F74-4BFE-8DD6-5CC08D5C3B1D}" = lport=137 | protocol=17 | dir=in | app=system |
"{4345F315-5B3C-424C-8D32-4AB6AE8CE01F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{44BE97DE-EEB0-4539-B85A-35BEB09541B9}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{44F05661-22E7-4BFA-B21C-321A7078F159}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4A98AE56-72F5-405E-ABA9-A4823A2CA512}" = lport=10243 | protocol=6 | dir=in | app=system |
"{4EC84A86-EB24-4C9A-ABBD-D06729CAFE2C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{55E8D9CB-8AA3-4E5A-9613-C86FF8F81057}" = lport=138 | protocol=17 | dir=in | app=system |
"{682023DB-56DB-4A22-B20D-37AAAFF312F1}" = rport=445 | protocol=6 | dir=out | app=system |
"{7C136CD1-3F50-48D0-902E-0AA27A736D64}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7CF9EE7B-96EA-4613-A6E1-6A545E9B1758}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{90744415-2495-4268-8353-1655C945E1BF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{92D4AEB3-9EE4-4DA1-92AE-EE8908B92643}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9B923F24-0EA3-4833-8D74-A44693DBC969}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9E3651EA-1EE0-47F3-9EDB-5068199DBEB5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A05B11BD-84F4-4B57-9B28-0720BC704532}" = lport=139 | protocol=6 | dir=in | app=system |
"{B2435079-99CE-4805-A075-0674F2896D54}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B82D40CD-63E6-4091-91E1-02EF5903198F}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BB633A66-D4AD-44FE-AECE-B15ECA66B7CA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C16A5786-D10A-4670-972C-C3C20D8158E6}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C26F4E3F-CC4A-425B-9DA1-146F6B550CBA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C63AD6F4-14B8-4A2B-B10A-70A68E52FF23}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C6DA879B-60F0-4FA6-9677-D4F40C60E048}" = rport=138 | protocol=17 | dir=out | app=system |
"{C9656396-5634-4204-B2FC-7CF9496B1ABC}" = rport=137 | protocol=17 | dir=out | app=system |
"{CA5424E4-B60B-471A-BD96-6163840DE050}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CD695796-BB08-49B1-9A0A-75AF56471313}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D84A6D85-AB9D-4E96-9AD9-D7B31AE2CAD6}" = rport=139 | protocol=6 | dir=out | app=system |
"{D9D32345-6481-4364-87FC-25EDC56E7D10}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E147CD36-14CB-44FF-8D83-96951EE61520}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E9F27598-4643-46CC-A67C-7E577B2BB920}" = lport=445 | protocol=6 | dir=in | app=system |
"{F7893D5C-067F-4E7D-AE04-211582486720}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CBF2F45-B053-4609-8621-79FCF4DA8481}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1F0B37FB-ECFB-4F4E-93A2-4CE24060CB0E}" = protocol=6 | dir=in | app=c:\users\tobias\appdata\local\microsoft\skydrive\skydrive.exe |
"{2750D22D-54CF-4A8F-BB42-70868DAEB548}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2AFFCCC6-39DF-4B0A-A0F7-E1C881F9CBAD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{2B41077B-9849-4C6D-8AFC-0A5266B4C380}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2D656EDD-EC6B-492F-9B6E-EC4060BE224F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{345CA2A9-EC8F-4610-AB8E-2BBB961D27E6}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{35644946-A07B-474F-B2B2-C2C7826CC249}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{420B4B7E-9D60-4AC4-A71E-6348FD64BE5F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{428B60B6-6E6E-4963-B714-0A1FE8DB5455}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E9FF935-F995-4983-9755-22A49A1C8A4F}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5198F223-F32C-4A94-951F-10FB537A0EB7}" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe |
"{5876F567-7230-406C-96A4-17DB3E632179}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6131BF6E-7D3A-486C-A7D9-CC909BBA5854}" = protocol=6 | dir=in | app=c:\users\tobias\appdata\roaming\dropbox\bin\dropbox.exe |
"{669273A4-15D0-4F15-A56B-737D39E07CB8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6810530A-1F25-4532-AF64-FEDF15C7B486}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6D5DF154-CDC4-46CA-8F6A-05E823ED440D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{6DB5A1C4-40F9-4D0D-8F6A-A3AA8D18DB88}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6EE19539-B1CE-44A8-BBAC-18718D861282}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{72B27237-993F-489D-8286-B32574DCD267}" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe |
"{77C975C9-5B9A-4EC8-A9CB-400417C1C9CE}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{92813C11-A928-41AD-A132-AD34C25E5143}" = protocol=17 | dir=in | app=c:\users\tobias\appdata\roaming\dropbox\bin\dropbox.exe |
"{ACE5FED9-EE70-4907-8565-F0BE5E3A5162}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{AFED3DDB-ACE9-4D7B-8FD5-1E17B15FE30C}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\live tv\qp.exe |
"{B4E01CA1-2AAC-41AE-B566-6A39B8AD7753}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BD8C0216-99CD-489B-A8D7-C4456D97D920}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{BE64A10A-36E1-486B-8E2F-8D75CD9ED14C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CB6CDBE3-9EBD-4687-A8D8-CFB47600D474}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{CD6E92A9-1941-4C06-9F7C-32DAB55A214D}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{D16B65C1-8EC8-46EF-97EC-FD4700853DC9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D1E06E8A-79E8-40BC-BB93-7CD041D8ED2D}" = protocol=6 | dir=out | app=system |
"{D5058D7E-D8D4-46AF-B2C5-624D550FF90A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D8A312BA-4594-4906-BE4C-F4D504FF8E2B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DC6597DA-C2E7-419D-9668-E24DDC1CB63A}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\live tv\qpservice.exe |
"{DD46C122-1992-4BE2-8EE7-0DA9D048FDB9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{EB127787-2F5F-4E22-8A00-C71C9AC1D598}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FC2D18E2-3D9D-4F21-B2AC-EA23886A7C31}" = protocol=17 | dir=in | app=c:\users\tobias\appdata\local\microsoft\skydrive\skydrive.exe |
"{FDD15E3C-804C-4EDE-A87D-B8F8DBC9B314}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{47F77C66-E2E3-405F-A1F8-63AEE4A2A69E}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{68F8B515-3511-4759-AAAB-1374AA40B898}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe |
"TCP Query User{6D676AB1-47AD-41FA-9672-6408453494BF}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{BA80DFC2-E249-4023-A55E-E7EDB0BAB682}C:\program files (x86)\concept design\onlinetv 6\onlinetv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\concept design\onlinetv 6\onlinetv.exe |
"TCP Query User{DD3DD86B-E99A-4EB6-88AA-BDC8AAF8DB5F}C:\users\public\counter-strike1.6\hl.exe" = protocol=6 | dir=in | app=c:\users\public\counter-strike1.6\hl.exe |
"TCP Query User{F548E295-E639-46A0-9C63-C85DAD795FE4}C:\program files (x86)\hp\common\hpdevicedetection3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hp\common\hpdevicedetection3.exe |
"UDP Query User{22B90151-65DC-45ED-8D25-DD4E2AB7089C}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe |
"UDP Query User{3C55BB04-139C-46FF-96C2-9399C6012213}C:\program files (x86)\concept design\onlinetv 6\onlinetv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\concept design\onlinetv 6\onlinetv.exe |
"UDP Query User{7C570386-A6EE-4A67-8ABE-3ADCD4A072E5}C:\program files (x86)\hp\common\hpdevicedetection3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hp\common\hpdevicedetection3.exe |
"UDP Query User{87F09D70-22F6-4C55-8E68-4962DC719FC7}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{EC452939-23B4-46D9-8A37-A7804AA3A705}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{FFAC0187-2FC1-4E4E-B5B3-F886904CB6CF}C:\users\public\counter-strike1.6\hl.exe" = protocol=17 | dir=in | app=c:\users\public\counter-strike1.6\hl.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01D57CF6-B5BC-4D03-AFF5-7960CFBD05A9}" = Native Instruments Guitar Rig 5
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{043EEF79-513F-4666-B340-B8556AB0EADC}" = Native Instruments Studio Drummer
"{079419C3-9DFC-4571-BAFC-CD79854C684E}" = Native Instruments West Africa
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1111706F-666A-4037-7777-202648764D10}" = JavaFX 2.0.2 (64-bit)
"{1244CC88-97DF-4694-A720-6F073845DEE2}" = Native Instruments Kontakt Factory Library
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{14C1DD2C-D54E-464A-9588-C109E3E39EEF}" = Native Instruments Vintage Organs
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D5F34D0-6329-4D92-B81A-E24E9028910C}" = Crystal Reports Basic Runtime German Language Pack for Visual Studio 2008 (x64)
"{1FBEA8BA-D40B-48BC-85BC-EE2D5575F27C}" = Microsoft SQL Server VSS Writer
"{2222706F-666A-4037-7777-202648764D10}" = JavaFX 2.0.2 SDK (64-bit)
"{23170F69-40C1-2702-0910-000001000000}" = 7-Zip 9.10 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417002FF}" = Java(TM) 7 Update 2 (64-bit)
"{2BFA9B05-7418-4EDE-A6FC-620427BAAAA3}" = Crystal Reports Basic Runtime for Visual Studio 2008 (x64)
"{2CA9F96F-AFFC-4D41-B781-47EBD2378DB8}" = M-Audio Legacy Keyboard Driver 5.0.0 (x64)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{35DE6B98-31C9-4A01-AB64-20A3C71BE1D0}" = Native Instruments Reflektor
"{36ccb7d4-42c7-473e-b293-72e41a8ec766}" = Native Instruments Berlin Concert Grand
"{491DF203-7B61-4F0E-BDCB-A1218C4DAFE9}" = Native Instruments Massive
"{4b98677f-ef75-4f71-8ef3-5603e3b0cbf7}" = Native Instruments Scarbee Vintage Keys
"{5552453B-BB76-45E3-973D-F95E458ED780}" = Native Instruments Kontakt 5
"{5B841301-3649-4891-BC10-7A66820397C9}" = Native Instruments Reaktor Prism
"{5D03CB59-6F91-4097-922C-9DCA057D2A76}" = Native Instruments The Finger R2
"{5D1224E0-6777-4536-9D72-B0E151ED8C99}" = Native Instruments Battery Library Importer for Maschine
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{60BB45B2-E8E4-41C5-B69F-C6DC5D991DF5}" = Native Instruments Abbey Road 60s Drums
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{64A3A4F4-B792-11D6-A78A-00B0D0170020}" = Java(TM) SE Development Kit 7 Update 2 (64-bit)
"{6BED4DFE-C527-463E-B93A-6F6848B74DD0}" = Native Instruments Battery 3
"{7C39E0D1-E138-42B1-B083-213EC2CF7692}" = Microsoft SQL Server Native Client
"{7ECA1AEA-2B61-3DE6-8276-6A9A2693F111}" = Microsoft Device Emulator (64 Bit) Version 3.0 - DEU
"{81387FD1-8CDD-4C1B-A2CB-BF06772092FE}" = Native Instruments Komplete 8
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{835e9421-5f20-4491-9a75-baa7af1ea14d}" = Native Instruments Vienna Concert Grand
"{88E45461-E8D2-4BCA-BDEC-0405E6FB4817}" = Native Instruments Transient Master
"{89026002-A893-42D9-9E20-6829B844735E}" = Application Verifier (x64)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C04CE01-F7B8-4961-884B-6CE7EFFADCD4}" = Native Instruments Reaktor Spark R2
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9be187da-7d1c-4e8b-8b66-6132ca7697d8}" = Native Instruments New York Concert Grand
"{a63e8179-0381-4b59-8876-0755be48eb6a}" = Native Instruments Scarbee MM-Bass
"{A992BBAA-723D-4574-A07F-983BF8FAA3E1}" = Microsoft Windows SDK for Visual Studio 2008 Win32 Tools
"{ACD875CC-A146-3125-8F99-D3766F46FD86}" = Visual Studio .NET Prerequisites - English
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2552FA6-86E3-410D-84AD-265C2242D410}" = Native Instruments FM8
"{B2EA2CCC-7920-468F-AD46-F409F97644E0}" = Microsoft SQL Server Management Objects Collection
"{C31A4909-9C18-3121-AAD4-EAD92013B6E5}" = Microsoft Visual Studio 2008 Remote Debugger - DEU
"{C9BCE8B9-2510-48D4-B93A-EA7BEA81D6E7}" = Native Instruments Traktors 12
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D597935A-5F0E-44F8-A028-A0EF9C647D95}" = Native Instruments Rammfire
"{d8650fdb-9422-4a07-9f57-585c06d9d760}" = Native Instruments Upright Piano
"{D954C6C2-544B-4091-A47F-11E77162883E}" = Microsoft Security Client
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBFC6AAE-DCCB-4C23-B01C-3EDDDC03298B}" = Debugging Tools for Windows (x64)
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{E7F9E526-2324-437B-A609-E8C5309465CB}" = Microsoft Windows Performance Toolkit
"{E9EA5F38-6299-45A1-9D23-F21729A19357}" = Native Instruments Reaktor 5
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"GPL Ghostscript 9.06" = GPL Ghostscript
"GSview 5.0" = GSview 5.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Studio 2008 Remote Debugger - DEU" = Microsoft Visual Studio 2008 Remote Debugger - DEU
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{159098AF-4EB8-4C10-B0C6-24CDA32B45F9}" = Microsoft SQL Server Compact 3.5 DEU
"{18E1FD72-60FA-3E10-A66B-640970B5559F}" = Visual Studio Tools for the Office system 3.0 Runtime Language Pack - DEU
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1C3ADB5F-750E-4453-AC98-B75C5323845C}" = Microsoft SQL Server Compact 3.5 for Devices DEU
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216018F0}" = Java(TM) 6 Update 18
"{26A24AE4-039D-4CA4-87B4-2F83216035FF}" = Java(TM) 6 Update 35
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (COCHLEAR)
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3BEDA87B-AEA1-4723-811F-3CA47756834F}_is1" = MP3 Generator 1.1
"{445174EA-3D3A-308E-84AD-446127E71441}" = Microsoft Visual Studio 2008 Professional Edition - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4ACDC413-AF13-3934-8D8A-1F8CEF70D1A5}" = Microsoft Document Explorer 2008 Language Pack - DEU
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5DB161C0-7C9C-41D7-8DA1-CB112F60946B}" = Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BD0D8F8-A13C-48D2-B201-4AD29A48AF34}" = Google SketchUp 7
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{870815CA-6B60-47B6-88DD-A67F42D2F03E}" = GPL MPEG-1/2 DirectShow Decoder Filter
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0407-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (German) 2007
"{90120000-0021-0407-0000-0000000FF1CE}_VisualWebDeveloper_{2733AA87-26FC-41B0-9D2F-3092345BC370}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_VisualWebDeveloper_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.2
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{AF5D2519-C6B4-4AFD-9A8D-FBF74DD4F0A0}" = HP Product Detection
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BBAAAD82-6242-420F-86D4-BD72BB5E6C86}" = Tools für Microsoft SQL Server 2005 Express Edition
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E32260E7-0B10-43C7-9B77-AB9F4184676D}" = Microsoft SQL Server Compact 3.5 Design Tools DEU
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E948B551-08DB-4163-8995-8C43B03D1B19}" = maxdome Download Manager 4.1.300.78
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ASIO4ALL" = ASIO4ALL
"Aspell" = Aspell Data
"Aspell6-Dictionary-de" = Aspell 0.6 Dictionary (Language: de)
"Audacity_is1" = Audacity 1.2.6
"CodeSite 4.1 Tools" = CodeSite 4.1 Tools
"Deutsch für Russischsprachige_is1" = Deutsch für Russischsprachige 3.1
"DivX Setup.divx.com" = DivX-Setup
"EAGLE 6.4.0" = EAGLE 6.4.0
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.20.1
"Live 4.0.3" = Live 4.0.3
"MatlabR2007a" = MATLAB Student R2007a
"Mendeley Desktop" = Mendeley Desktop 1.8
"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
"Microsoft Document Explorer 2008 Language Pack - DEU" = Microsoft Document Explorer 2008 Language Pack - DEU
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack" = Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack
"Microsoft Visual Studio 2008 Professional Edition - DEU" = Microsoft Visual Studio 2008 Professional Edition - DEU
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Native Instruments Abbey Road 60s Drums" = Native Instruments Abbey Road 60s Drums
"Native Instruments Absynth 5" = Native Instruments Absynth 5
"Native Instruments Battery 3" = Native Instruments Battery 3
"Native Instruments Battery Library Importer for Maschine" = Native Instruments Battery Library Importer for Maschine
"Native Instruments Berlin Concert Grand" = Native Instruments Berlin Concert Grand
"Native Instruments FM8" = Native Instruments FM8
"Native Instruments Guitar Rig 5" = Native Instruments Guitar Rig 5
"Native Instruments Komplete 8" = Native Instruments Komplete 8
"Native Instruments Kontakt 5" = Native Instruments Kontakt 5
"Native Instruments Kontakt Factory Library" = Native Instruments Kontakt Factory Library
"Native Instruments Massive" = Native Instruments Massive
"Native Instruments New York Concert Grand" = Native Instruments New York Concert Grand
"Native Instruments Rammfire" = Native Instruments Rammfire
"Native Instruments Reaktor 5" = Native Instruments Reaktor 5
"Native Instruments Reaktor Prism" = Native Instruments Reaktor Prism
"Native Instruments Reaktor Spark R2" = Native Instruments Reaktor Spark R2
"Native Instruments Reflektor" = Native Instruments Reflektor
"Native Instruments Scarbee MM-Bass" = Native Instruments Scarbee MM-Bass
"Native Instruments Scarbee Vintage Keys" = Native Instruments Scarbee Vintage Keys
"Native Instruments Service Center" = Native Instruments Service Center
"Native Instruments Studio Drummer" = Native Instruments Studio Drummer
"Native Instruments The Finger R2" = Native Instruments The Finger R2
"Native Instruments Traktors 12" = Native Instruments Traktors 12
"Native Instruments Transient Master" = Native Instruments Transient Master
"Native Instruments Upright Piano" = Native Instruments Upright Piano
"Native Instruments Vienna Concert Grand" = Native Instruments Vienna Concert Grand
"Native Instruments Vintage Organs" = Native Instruments Vintage Organs
"Native Instruments West Africa" = Native Instruments West Africa
"No23 Recorder" = No23 Recorder
"Office14.SingleImage" = Microsoft Office Professional 2010
"SumatraPDF" = SumatraPDF
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"TxcSysUpd_is1" = TeXnicCenter System Update 1.0
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"Visual Studio Tools for the Office system 3.0 Runtime Language Pack - DEU" = Visual Studio-Tools für Office System 3.0 Runtime Language Pack - DEU
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"MyFreeCodec" = MyFreeCodec
"SkyDriveSetup.exe" = Microsoft SkyDrive
========== Last 20 Event Log Errors ==========
[ System Events ]
Error - 18.07.2013 18:39:43 | Computer Name = Tobias-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 18.07.2013 18:39:43 | Computer Name = Tobias-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 18.07.2013 18:39:57 | Computer Name = Tobias-PC | Source = BugCheck | ID = 1001
Description =
Error - 18.07.2013 18:40:34 | Computer Name = Tobias-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
SQL Server (COCHLEAR) erreicht.
Error - 18.07.2013 18:40:34 | Computer Name = Tobias-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SQL Server (COCHLEAR)" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
< End of report >
OTL: Code:
OTL logfile created on: 19.07.2013 00:57:41 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tobias\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 59,99% Memory free
7,99 Gb Paging File | 6,45 Gb Available in Paging File | 80,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 106,93 Gb Total Space | 12,25 Gb Free Space | 11,46% Space Free | Partition Type: NTFS
Drive D: | 1,86 Gb Total Space | 1,86 Gb Free Space | 99,90% Space Free | Partition Type: FAT
Drive K: | 97,66 Gb Total Space | 26,29 Gb Free Space | 26,92% Space Free | Partition Type: NTFS
Computer Name: TOBIAS-PC | User Name: Tobias | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Tobias\Desktop\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\PROGRAM FILES (X86)\MICROTOUCH\MT 7\TwService.exe (3M Touch Systems, Inc.)
PRC - C:\PROGRAM FILES (X86)\MICROTOUCH\MT 7\TwRegSvc.exe (3M Touch Systems, Inc.)
PRC - C:\Program Files (x86)\maxdome\DCBin\DCService.exe (Entriq, Inc.)
========== Modules (No Company Name) ==========
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7d8f6866864f78cf83d3701641c46178\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\40c7a89fe2cbf3c12a2c39e034da54cf\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\1f0bb5336d1706c9b8ad2330f3642760\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\fc476bbac36944e352c2f547352ffa64\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\9b2940478ec555990b37af5448b8f509\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ddc3e8c2774eaec614d6775983652980\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\93a17ba6cb6753328f25466bc0bf1cb1\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a1949f57d2ec260e09768e98fecb0559\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\f93dca0e4baa1dcb37cf75392b7c89da\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6a1ccc1e1a79ce267d3d1808af382cd6\mscorlib.ni.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
========== Services (SafeList) ==========
SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (msvsmon90) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (SQLWriter) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (TwDrvService) -- C:\PROGRAM FILES (X86)\MICROTOUCH\MT 7\TwService.exe (3M Touch Systems, Inc.)
SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\STacSV64.exe (IDT, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (TwRegSvc) -- C:\PROGRAM FILES (X86)\MICROTOUCH\MT 7\TwRegSvc.exe (3M Touch Systems, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Prosieben) -- C:\Program Files (x86)\maxdome\DCBin\DCService.exe (Entriq, Inc.)
SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe (Andrea Electronics Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (TwTouch) -- C:\Windows\SysNative\drivers\TwTouch.sys (3M)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (FTSER2K) -- C:\Windows\SysNative\drivers\ftser2k.sys (FTDI Ltd.)
DRV:64bit: - (FTDIBUS) -- C:\Windows\SysNative\drivers\ftdibus.sys (FTDI Ltd.)
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (TwBus) -- C:\Windows\SysNative\drivers\TwBus.sys (3M)
DRV:64bit: - (MADFULEGACYKEYBOARD) -- C:\Windows\SysNative\drivers\MAudioLegacyKeyboard_DFU.sys (M-Audio)
DRV:64bit: - (MAUSBLEGACYKEYBOARD) -- C:\Windows\SysNative\drivers\MAudioLegacyKeyboard.sys (M-Audio)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (KMWDFILTER) -- C:\Windows\SysNative\drivers\KMWDFILTER.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV:64bit: - (enecir) -- C:\Windows\SysNative\drivers\enecir.sys (ENE TECHNOLOGY INC.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6F 48 7F 05 7F E6 CA 01 [binary data]
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\..\SearchScopes\{643B9224-F29B-4E9A-A9FA-F3C35CEA6F43}: "URL" = hxxp://dict.leo.org/ende?lp=ende&lang=de&searchLoc=0&cmpType=relaxed§Hdr=on&spellToler=on&chinese=both&pinyin=diacritic&search={searchTerms}&relink=on
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
IE - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..extensions.enabledAddons: zotero%40chnm.gmu.edu:4.0.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.1.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: support@predictad.com:1.11
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.2.1: C:\Windows\system32\npDeployJava1.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.2.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.07.03 21:13:46 | 000,000,000 | ---D | M]
[2011.03.17 22:25:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tobias\AppData\Roaming\mozilla\Extensions
[2013.07.19 00:27:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tobias\AppData\Roaming\mozilla\Firefox\Profiles\gh1ag6rt.default\extensions
[2012.05.21 13:30:39 | 000,000,000 | ---D | M] (Default Manager) -- C:\Users\Tobias\AppData\Roaming\mozilla\Firefox\Profiles\gh1ag6rt.default\extensions\DefaultManager@Microsoft
[2013.05.04 10:41:55 | 004,691,600 | ---- | M] () (No name found) -- C:\Users\Tobias\AppData\Roaming\mozilla\firefox\profiles\gh1ag6rt.default\extensions\zotero@chnm.gmu.edu.xpi
[2013.07.03 21:13:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.07.03 21:13:46 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.07.03 21:13:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.07.03 21:14:36 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011.06.10 15:14:47 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe (Dominik Reichl)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
O4 - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-3408962903-4176615068-4096822321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.1)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect125.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{75D31A8D-1494-4ADD-B9A7-125971C1C0CB}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F71522E6-8032-45FF-802B-63F5B572F34C}: DhcpNameServer = 134.106.40.3 134.106.49.2 134.106.1.7
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F8AC2827-BC87-4158-8B64-47957CA50B96}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{00a339dd-cbcc-11df-b869-00269e9d20bb}\Shell - "" = AutoRun
O33 - MountPoints2\{00a339dd-cbcc-11df-b869-00269e9d20bb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{00a339e0-cbcc-11df-b869-00269e9d20bb}\Shell - "" = AutoRun
O33 - MountPoints2\{00a339e0-cbcc-11df-b869-00269e9d20bb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{00a339f6-cbcc-11df-b869-00269e9d20bb}\Shell - "" = AutoRun
O33 - MountPoints2\{00a339f6-cbcc-11df-b869-00269e9d20bb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{29cc745d-9339-11df-ad55-00269e9d20bb}\Shell - "" = AutoRun
O33 - MountPoints2\{29cc745d-9339-11df-ad55-00269e9d20bb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{29cc746b-9339-11df-ad55-00269e9d20bb}\Shell - "" = AutoRun
O33 - MountPoints2\{29cc746b-9339-11df-ad55-00269e9d20bb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.07.19 00:43:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Tobias\Desktop\OTL(1).exe
[2013.07.19 00:17:11 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.07.19 00:14:12 | 000,559,341 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Tobias\Desktop\JRT.exe
[2013.07.18 23:52:44 | 000,000,000 | ---D | C] -- C:\Users\Tobias\Desktop\mbar-1.06.0.1004
[2013.07.18 23:52:05 | 000,000,000 | ---D | C] -- C:\Users\Tobias\Desktop\mbar
[2013.07.18 22:50:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013.07.18 22:44:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.07.16 21:44:01 | 000,000,000 | ---D | C] -- C:\FRST
[2013.07.04 18:43:42 | 000,000,000 | ---D | C] -- C:\.Trash-1000
[2013.07.03 21:13:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.06.25 20:03:00 | 000,000,000 | ---D | C] -- C:\Users\Tobias\AppData\Local\Programs
[2013.06.25 19:56:28 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2013.06.25 19:52:31 | 000,000,000 | ---D | C] -- C:\ProgramData\AVS4YOU
[2013.06.25 19:52:23 | 000,000,000 | ---D | C] -- C:\Users\Tobias\AppData\Roaming\AVS4YOU
[2013.06.25 19:51:12 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\GdiPlus.dll
[2013.06.25 19:51:12 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3a.dll
[2013.06.25 19:50:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVS4YOU
[2013.06.25 19:50:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVSMedia
[2013.06.25 19:36:21 | 000,000,000 | ---D | C] -- C:\Users\Tobias\Documents\SelfMV
[2013.06.23 22:15:56 | 000,000,000 | ---D | C] -- C:\Users\Tobias\Desktop\DSH
[2013.06.22 01:53:28 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log
[2013.06.22 01:53:25 | 000,000,000 | ---D | C] -- C:\Users\Tobias\AppData\Roaming\Samsung
[2013.06.22 01:53:25 | 000,000,000 | ---D | C] -- C:\Users\Tobias\AppData\Local\Samsung
[2013.06.22 01:53:22 | 000,000,000 | ---D | C] -- C:\Users\Tobias\Documents\samsung
[2013.06.22 01:51:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec
[2013.06.22 01:51:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyFree Codec
[2013.06.22 01:48:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2013.06.22 01:48:35 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2013.06.22 01:48:22 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2013.06.22 01:47:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2013.06.22 01:47:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2013.06.22 01:37:19 | 000,000,000 | ---D | C] -- C:\Users\Tobias\AppData\Local\Downloaded Installations
[2013.06.22 01:23:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon
[2013.06.22 01:23:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No23 Recorder
[2013.06.22 01:23:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\No23 Recorder
========== Files - Modified Within 30 Days ==========
[2013.07.19 00:48:17 | 000,014,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.19 00:48:17 | 000,014,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.19 00:43:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tobias\Desktop\OTL(1).exe
[2013.07.19 00:39:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.19 00:39:35 | 3218,235,392 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.19 00:25:38 | 000,662,345 | ---- | M] () -- C:\Users\Tobias\Desktop\adwcleaner.exe
[2013.07.19 00:14:22 | 000,559,341 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Tobias\Desktop\JRT.exe
[2013.07.19 00:05:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.07.18 23:38:08 | 000,377,856 | ---- | M] () -- C:\Users\Tobias\Desktop\pimnfs1e.exe
[2013.07.18 22:11:28 | 013,399,154 | ---- | M] () -- C:\Users\Tobias\Desktop\mbar-1.06.0.1004.zip
[2013.07.16 21:47:58 | 000,761,260 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.07.16 21:47:58 | 000,711,504 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.07.16 21:47:58 | 000,173,350 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.07.16 21:47:58 | 000,143,632 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.07.16 21:47:57 | 001,808,512 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.30 00:19:20 | 021,561,344 | ---- | M] () -- C:\Users\Tobias\Desktop\BigBeat.wav
[2013.06.27 09:57:38 | 000,000,284 | ---- | M] () -- C:\Windows\matlab.ini
[2013.06.26 19:09:45 | 000,460,504 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.06.23 00:34:02 | 000,472,572 | ---- | M] () -- C:\Users\Tobias\Desktop\AB_diagramme-auswerten.pdf
[2013.06.22 01:53:21 | 000,002,006 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
[2013.06.22 01:53:21 | 000,001,996 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2013.06.22 01:23:43 | 000,001,061 | ---- | M] () -- C:\Users\Public\Desktop\No23 Recorder.lnk
========== Files Created - No Company Name ==========
[2013.07.19 00:25:20 | 000,662,345 | ---- | C] () -- C:\Users\Tobias\Desktop\adwcleaner.exe
[2013.07.18 23:38:07 | 000,377,856 | ---- | C] () -- C:\Users\Tobias\Desktop\pimnfs1e.exe
[2013.07.18 22:11:38 | 013,399,154 | ---- | C] () -- C:\Users\Tobias\Desktop\mbar-1.06.0.1004.zip
[2013.06.30 00:19:20 | 021,561,344 | ---- | C] () -- C:\Users\Tobias\Desktop\BigBeat.wav
[2013.06.23 00:34:02 | 000,472,572 | ---- | C] () -- C:\Users\Tobias\Desktop\AB_diagramme-auswerten.pdf
[2013.06.22 01:53:21 | 000,002,006 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
[2013.06.22 01:53:21 | 000,001,996 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2013.06.22 01:23:43 | 000,001,061 | ---- | C] () -- C:\Users\Public\Desktop\No23 Recorder.lnk
[2013.05.22 20:43:52 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2013.05.22 20:43:48 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2013.05.22 20:43:48 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2013.05.22 20:43:48 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2013.05.22 20:43:48 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2013.05.09 00:17:14 | 000,000,848 | ---- | C] () -- C:\Users\Tobias\.recently-used.xbel
[2013.01.20 22:57:08 | 000,011,163 | ---- | C] () -- C:\Users\Tobias\gsview64.ini
[2012.04.27 19:02:35 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2012.03.16 19:37:45 | 000,000,337 | ---- | C] () -- C:\Users\Tobias\AppData\Local\Perfmon.PerfmonCfg
[2011.10.18 21:13:35 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2011.10.18 21:13:35 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2011.10.18 19:06:58 | 000,000,034 | ---- | C] () -- C:\Users\Tobias\dlmgr_.pro
[2011.09.07 16:17:23 | 000,000,076 | ---- | C] () -- C:\Users\Tobias\.gtk-bookmarks
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.10.13 14:15:24 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Ableton
[2013.03.03 22:12:10 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\CadSoft
[2011.03.04 16:51:11 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Cochlear
[2011.06.13 15:09:36 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\concept design
[2013.07.04 16:40:24 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Dropbox
[2010.04.29 17:46:14 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\g200kg
[2013.03.04 18:14:54 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\gtk-2.0
[2013.01.20 17:48:30 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\JOSM
[2012.11.04 20:43:54 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\KeePass
[2011.04.21 14:51:49 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\MED-EL
[2010.05.03 01:30:54 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\OpenOffice.org
[2013.06.22 01:53:25 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Samsung
[2010.04.28 23:10:32 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Subversion
[2013.02.27 17:03:40 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\SumatraPDF
[2010.04.28 17:10:19 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\TuneUp Software
[2012.07.31 19:42:46 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Windows Live Writer
[2010.06.11 02:38:30 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\xm1
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2013.03.29 12:22:47 | 000,000,000 | ---D | M](C:\Users\Tobias\Desktop\?????? ?????????? 2013) -- C:\Users\Tobias\Desktop\Полина Слепцоваҕа 2013
[2013.03.29 12:22:47 | 000,000,000 | ---D | C](C:\Users\Tobias\Desktop\?????? ?????????? 2013) -- C:\Users\Tobias\Desktop\Полина Слепцоваҕа 2013
[2013.03.29 12:22:36 | 000,101,788 | ---- | C] ()(C:\Users\Tobias\Desktop\?????? ?????????? 2013.rar) -- C:\Users\Tobias\Desktop\Полина Слепцоваҕа 2013.rar
[2013.03.29 12:22:08 | 000,101,788 | ---- | M] ()(C:\Users\Tobias\Desktop\?????? ?????????? 2013.rar) -- C:\Users\Tobias\Desktop\Полина Слепцоваҕа 2013.rar
< End of report >
|
+ R Taste und schreibe notepad in das Ausführen Fenster.
FRST 32-Bit | FRST 64-Bit
GMER herunter: (Dateiname zufällig) 
Tauchen Probleme auf? 
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
AdwCleaner auf deinen Desktop.
