Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Betriebssystem infiziert (https://www.trojaner-board.de/109346-betriebssystem-infiziert.html)

Snow_White 07.02.2012 22:11
Betriebssystem infiziert
 
schwarzer Bildschirm und darauf: Aus Sicherheitsgründen wurde ihr Windows System blockiert :dummguck: Ich kann nur noch im abgesicherten Modus meine Sachen erlediegen. Kann mir hier schnellstmöglich jemand helfen ?????

markusg 08.02.2012 12:52
hi, im abgesicherten modus mit netzwerk folgendes:
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Snow_White 08.02.2012 13:27
OTL Logfile:
Code:
OTL logfile created on: 08.02.2012 13:11:05 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Erica\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 75,42% Memory free
6,20 Gb Paging File | 5,63 Gb Available in Paging File | 90,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286,09 Gb Total Space | 206,87 Gb Free Space | 72,31% Space Free | Partition Type: NTFS
 
Computer Name: ERICA-PC | User Name: Erica | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.08 13:09:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Erica\Desktop\OTL.exe
PRC - [2012.01.20 06:35:36 | 001,047,024 | ---- | M] (Google Inc.) -- C:\Programme\Google\Chrome\Application\chrome.exe
PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.20 06:35:35 | 000,411,120 | ---- | M] () -- C:\Programme\Google\Chrome\Application\16.0.912.77\ppgooglenaclpluginchrome.dll
MOD - [2012.01.20 06:35:34 | 003,767,792 | ---- | M] () -- C:\Programme\Google\Chrome\Application\16.0.912.77\pdf.dll
MOD - [2012.01.20 06:34:10 | 000,122,880 | ---- | M] () -- C:\Programme\Google\Chrome\Application\16.0.912.77\avutil-51.dll
MOD - [2012.01.20 06:34:09 | 000,222,208 | ---- | M] () -- C:\Programme\Google\Chrome\Application\16.0.912.77\avformat-53.dll
MOD - [2012.01.20 06:34:07 | 001,746,432 | ---- | M] () -- C:\Programme\Google\Chrome\Application\16.0.912.77\avcodec-53.dll
MOD - [2012.01.20 03:14:40 | 008,593,056 | ---- | M] () -- C:\Programme\Google\Chrome\Application\16.0.912.77\gcswf32.dll
MOD - [2007.05.10 23:50:00 | 000,017,024 | ---- | M] () -- C:\Programme\Adobe\Reader 8.0\Reader\ViewerPS.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (x10nets)
SRV - [2011.10.25 13:44:42 | 000,793,048 | ---- | M] (PC Tools) [Auto | Stopped] -- C:\Programme\Common Files\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc)
SRV - [2011.07.28 22:35:24 | 000,176,128 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.02.03 13:53:00 | 001,155,072 | ---- | M] (MAGIX AG) [Unknown | Stopped] -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2008.02.09 18:06:00 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008.02.09 18:06:00 | 000,238,968 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.02.04 15:36:47 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011.07.28 23:22:04 | 008,396,800 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011.07.28 21:53:46 | 000,247,296 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2010.06.23 08:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.06.25 23:25:58 | 000,337,920 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2008.05.10 02:33:10 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm)
DRV - [2008.05.07 11:47:36 | 000,085,136 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2008.04.28 14:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2008.04.02 05:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008.03.19 17:28:52 | 000,022,072 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2007.10.02 16:03:56 | 000,052,736 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2006.11.17 09:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Programme\BrotherSoft_Extreme\prxtbBro0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Conduit Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
IE - HKCU\..\URLSearchHook: {26647ca4-a2a7-4eac-8a72-761aa9141de7} - No CLSID value found
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Programme\BrotherSoft_Extreme\prxtbBro0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - No CLSID value found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Search-Results"
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.bearshare.com/"
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Erica\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@www.flatcast.com/FlatViewer 5.2: C:\PROGRA~1\MOZILL~1\plugins\NpFv522.dll (1 mal 1 Software GmbH)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files\Object\facetheme [2011.08.24 00:28:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.05 18:35:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.19 12:11:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.03 00:20:49 | 000,000,000 | ---D | M]
 
[2011.08.19 18:16:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Erica\AppData\Roaming\mozilla\Extensions
[2012.02.05 18:28:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions
[2012.01.18 17:06:02 | 000,000,000 | ---D | M] (Freeware Download - Free Software Downloads - kostenlose Programme gratis Community Toolbar) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\{26647ca4-a2a7-4eac-8a72-761aa9141de7}
[2011.12.12 17:54:16 | 000,000,000 | ---D | M] (BrotherSoft Extreme Community Toolbar) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}
[2012.01.18 17:06:08 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.01.18 17:06:10 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.08.19 17:48:23 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.08.19 18:16:14 | 000,000,000 | ---D | M] (MediaBar) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
[2011.12.13 20:05:20 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\toolbar@ask.com
[2012.02.05 18:28:14 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\Erica\AppData\Roaming\mozilla\Firefox\Profiles\dtktmn3m.default\extensions\welcome@toolmin.com
[2011.06.20 13:50:38 | 000,000,953 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\conduit.xml
[2012.02.01 13:30:01 | 000,000,950 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin-1.xml
[2011.08.26 22:03:44 | 000,000,950 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin-2.xml
[2011.10.03 09:57:49 | 000,000,950 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin-3.xml
[2011.10.22 15:08:56 | 000,000,950 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin-4.xml
[2011.12.12 17:55:58 | 000,000,950 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin-5.xml
[2012.01.19 12:12:10 | 000,000,950 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin-6.xml
[2012.01.04 14:54:58 | 000,000,168 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin.gif
[2012.01.04 14:54:58 | 000,000,618 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin.src
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\icqplugin.xml
[2011.08.25 15:21:20 | 000,003,295 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\search-results.xml
[2011.08.19 18:16:07 | 000,002,503 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\dtktmn3m.default\searchplugins\SearchResults.xml
[2011.08.19 18:16:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.02.05 18:35:15 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011.08.24 00:28:43 | 000,000,000 | ---D | M] (FaceTheme - Change your Facebook layout!) -- C:\PROGRAM FILES\OBJECT\FACETHEME
[2011.08.16 02:03:22 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.01.19 12:11:57 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009.09.21 10:00:44 | 001,447,328 | ---- | M] (1 mal 1 Software GmbH) -- C:\Program Files\mozilla firefox\plugins\NpFv522.dll
[2012.01.19 12:11:54 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.19 12:11:54 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.19 12:11:54 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.19 12:11:54 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.05 18:28:14 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src
[2011.08.19 18:16:07 | 000,002,503 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
[2012.01.19 12:11:54 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.19 12:11:54 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = hxxp://search.conduit.com/Results.aspx?q={searchTerms}&hl=en&SelfSearch=1&SearchSource=49&ctid=ct2776682
CHR - default_search_provider: suggest_url = Conduit Search
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.77\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.77\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Flatcast Viewer Plugin 5.2.2.454 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NpFv522.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Erica\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: BrotherSoft Extreme = C:\Users\Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\naipdapbimiiikbbgjcpbgmfhnlbagpj\2.2.0.5_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (BrotherSoft Extreme  Toolbar) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Programme\BrotherSoft_Extreme\prxtbBro0.dll (Conduit Ltd.)
O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Programme\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Programme\BearShare Applications\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll ()
O2 - BHO: (Facetheme) - {cbc5b60a-aa4d-45f6-84c2-d086f320299a} - C:\Programme\Object\bho_project.dll (InternetEngine)
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BrotherSoft Extreme  Toolbar) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Programme\BrotherSoft_Extreme\prxtbBro0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Programme\BearShare Applications\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll ()
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Erica\AppData\Roaming\toolplugin\toolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {26647CA4-A2A7-4EAC-8A72-761AA9141DE7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (BrotherSoft Extreme  Toolbar) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - C:\Programme\BrotherSoft_Extreme\prxtbBro0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SSDMonitor] C:\Programme\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [YouCam Mirage] "C:\Program Files\CyberLink\YouCam\YCMMirage.exe" File not found
O4 - HKLM..\Run: [YouCam Tray] "C:\Program Files\CyberLink\YouCam\YouCamTray.exe" /s File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Erica\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [ffdwnd] C:\Users\Erica\AppData\Local\Mozilla\Firefox\firefox.exe ()
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [ManyCam] C:\Program Files\ManyCam\Bin\ManyCam.exe (ManyCam LLC)
O4 - HKCU..\Run: [Miranda Fusion] C:\Programme\MirandaFusion\fusiontools\mfstart.exe (Miranda Fusion Team)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Erica\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - %SystemRoot%\System32\winrnr.dll File not found
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7CB2279B-C3FC-40C3-889F-922549030636}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B980C69E-A036-4E07-9D31-BB5E6A0DE2A3}: DhcpNameServer = 192.168.2.1
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll) -C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC)
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) -C:\Programme\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Erica\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Erica\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.08 13:09:05 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Erica\Desktop\OTL.exe
[2012.02.05 21:30:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Registry Mechanic
[2012.02.05 21:30:32 | 001,101,824 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBox210.ocx
[2012.02.05 21:30:32 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBox10.ocx
[2012.02.05 21:30:32 | 000,212,992 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBoxVB12.ocx
[2012.02.05 21:30:30 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools Registry Mechanic
[2012.02.05 21:30:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2012.01.10 20:05:35 | 000,000,000 | ---D | C] -- C:\Users\Erica\AppData\Local\Microsoft Games
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.08 13:09:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Erica\Desktop\OTL.exe
[2012.02.08 10:52:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.08 10:50:50 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.08 10:50:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.08 10:50:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.07 20:30:00 | 000,000,356 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie-Administrator.job
[2012.02.07 20:29:59 | 000,000,356 | ---- | M] () -- C:\Windows\tasks\Recovery DVD Creator-Administrator.job
[2012.02.07 20:01:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.07 18:46:24 | 000,000,436 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Erica.job
[2012.02.07 18:13:02 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2431705746-1926636193-4182670529-1000UA.job
[2012.02.07 00:12:00 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2431705746-1926636193-4182670529-1000Core.job
[2012.02.06 21:57:46 | 000,016,384 | ---- | M] () -- C:\Users\Erica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.05 21:30:33 | 000,000,994 | ---- | M] () -- C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
[2012.02.05 18:35:18 | 000,001,436 | ---- | M] () -- C:\Users\Erica\Desktop\DivX Movies.lnk
[2012.02.05 18:34:47 | 000,000,920 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012.02.05 12:05:10 | 001,761,570 | ---- | M] () -- C:\Users\Erica\Desktop\CIMG5836.JPG
[2012.02.04 15:11:10 | 000,239,448 | ---- | M] () -- C:\Users\Erica\Desktop\CIMG5831.JPG
[2012.02.04 14:56:54 | 001,463,069 | ---- | M] () -- C:\Users\Erica\Desktop\CIMG5827.JPG
[2012.02.03 15:08:35 | 003,075,531 | ---- | M] () -- C:\Users\Erica\Desktop\getImage (1).jpg
[2012.01.31 21:53:06 | 000,337,988 | ---- | M] () -- C:\Users\Erica\Desktop\CIMG5776.JPG
[2012.01.31 21:35:06 | 001,365,292 | ---- | M] () -- C:\Users\Erica\Desktop\CIMG5770.JPG
[2012.01.26 03:57:43 | 000,001,974 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.01.20 00:56:27 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.01.13 18:27:51 | 000,000,184 | ---- | M] () -- C:\Users\Erica\Documents\Dokument.rtf
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.06 20:54:12 | 001,761,570 | ---- | C] () -- C:\Users\Erica\Desktop\CIMG5836.JPG
[2012.02.05 21:30:33 | 000,000,994 | ---- | C] () -- C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
[2012.02.05 21:30:32 | 000,037,336 | ---- | C] () -- C:\Windows\System32\CleanMFT32.exe
[2012.02.05 18:35:18 | 000,001,436 | ---- | C] () -- C:\Users\Erica\Desktop\DivX Movies.lnk
[2012.02.05 18:34:47 | 000,000,920 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012.02.04 15:00:58 | 001,463,069 | ---- | C] () -- C:\Users\Erica\Desktop\CIMG5827.JPG
[2012.02.04 15:00:29 | 000,239,448 | ---- | C] () -- C:\Users\Erica\Desktop\CIMG5831.JPG
[2012.02.03 15:00:05 | 003,075,531 | ---- | C] () -- C:\Users\Erica\Desktop\getImage (1).jpg
[2012.01.31 21:36:17 | 001,365,292 | ---- | C] () -- C:\Users\Erica\Desktop\CIMG5770.JPG
[2012.01.31 21:36:04 | 000,337,988 | ---- | C] () -- C:\Users\Erica\Desktop\CIMG5776.JPG
[2011.08.03 00:20:48 | 000,695,578 | ---- | C] () -- C:\Windows\unins000.exe
[2011.08.03 00:20:48 | 000,000,853 | ---- | C] () -- C:\Windows\unins000.dat
[2011.07.28 21:52:38 | 000,037,376 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll
[2011.07.28 16:49:12 | 000,053,760 | ---- | C] () -- C:\Windows\System32\OVDecode.dll
[2011.07.13 16:16:24 | 000,000,552 | ---- | C] () -- C:\Users\Erica\AppData\Local\d3d8caps.dat
[2011.07.02 16:12:34 | 000,000,680 | ---- | C] () -- C:\Users\Erica\AppData\Local\d3d9caps.dat
[2011.06.27 19:53:02 | 000,234,855 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.06.16 08:30:04 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.06.16 08:30:04 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.06.14 13:01:17 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2011.06.14 13:00:44 | 000,007,261 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.06.13 15:44:26 | 000,016,384 | ---- | C] () -- C:\Users\Erica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.17 18:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2010.10.21 13:03:31 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2009.12.03 08:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.09.22 18:24:12 | 000,627,994 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.09.22 18:24:12 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.09.22 18:24:12 | 000,126,076 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.09.22 18:24:12 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.09.22 18:17:09 | 000,085,136 | ---- | C] () -- C:\Windows\System32\drivers\jmcr.sys
[2009.09.22 09:13:37 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe
[2009.09.22 09:10:51 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.09.22 09:03:56 | 000,000,144 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2008.04.01 23:46:46 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.10.02 12:58:12 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,322,552 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,595,584 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,103,658 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2001.11.14 12:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2011.07.19 13:52:42 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Anthropics
[2011.08.19 17:49:33 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\DVDVideoSoft
[2011.08.19 17:48:22 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.08.03 00:20:48 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Flatcast
[2011.09.04 20:09:35 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\GetRightToGo
[2012.01.20 11:14:36 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\ICQ
[2011.07.03 14:13:45 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\MAGIX
[2011.07.04 14:36:55 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\ManyCam
[2011.09.04 20:23:46 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Miranda
[2011.09.04 20:59:27 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Miranda Fusion
[2011.08.19 18:16:03 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\MusicNet
[2011.06.14 13:42:53 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\PhotoScape
[2011.10.22 14:43:20 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\toolplugin
[2012.02.07 20:30:00 | 000,000,356 | ---- | M] () -- C:\Windows\Tasks\Erweiterte Garantie-Administrator.job
[2012.02.07 00:12:00 | 000,000,906 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2431705746-1926636193-4182670529-1000Core.job
[2012.02.07 18:13:02 | 000,000,928 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2431705746-1926636193-4182670529-1000UA.job
[2012.02.07 20:29:59 | 000,000,356 | ---- | M] () -- C:\Windows\Tasks\Recovery DVD Creator-Administrator.job
[2012.01.20 00:56:27 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.06.09 12:10:55 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.08.28 19:25:38 | 000,000,000 | ---D | M] -- C:\AMD
[2011.08.28 19:32:13 | 000,000,000 | ---D | M] -- C:\ATI
[2009.09.22 18:17:17 | 000,000,000 | -HSD | M] -- C:\boot
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.06.09 12:05:47 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.09.22 18:09:36 | 000,000,000 | ---D | M] -- C:\drivers
[2012.01.18 20:14:02 | 000,000,000 | ---D | M] -- C:\output
[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.02.05 21:30:30 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.10.06 22:41:41 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.06.09 12:05:47 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.02.07 14:14:02 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.06.09 12:10:28 | 000,000,000 | R--D | M] -- C:\Users
[2011.11.04 13:05:15 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2008.04.02 05:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) MD5=844A6734E8BB3530FB1444ED698087BD -- C:\drivers\RAID\x86\ahcix86s.sys
[2008.04.02 05:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) MD5=844A6734E8BB3530FB1444ED698087BD -- C:\Windows\System32\drivers\ahcix86s.sys
[2008.04.02 05:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) MD5=844A6734E8BB3530FB1444ED698087BD -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_4886f1e9\ahcix86s.sys
[2008.01.17 01:27:56 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=8DC09F3B54DDCAEB52E0DCFA1D55B26A -- C:\drivers\ESATA\ahcix86s.sys
[2008.01.17 01:27:56 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=8DC09F3B54DDCAEB52E0DCFA1D55B26A -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_957aef9d\ahcix86s.sys
[2008.05.28 19:47:08 | 000,171,016 | R--- | M] (AMD Technologies Inc.) MD5=9879FF9F6A04D660BC245788E1881B00 -- C:\drivers\VGA\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\System32\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2012.02.08 13:10:23 | 001,572,864 | -HS- | M] () -- C:\Users\Erica\ntuser.dat
[2012.02.08 13:10:23 | 000,262,144 | -H-- | M] () -- C:\Users\Erica\ntuser.dat.LOG1
[2011.07.29 00:45:15 | 000,262,144 | -H-- | M] () -- C:\Users\Erica\ntuser.dat.LOG2
[2011.08.08 03:31:39 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{0c22688f-c151-11e0-a01c-001e68bb39ab}.TM.blf
[2011.08.08 03:31:39 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{0c22688f-c151-11e0-a01c-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.08 03:31:39 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{0c22688f-c151-11e0-a01c-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.15 00:03:28 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2965df33-ad25-11e0-80ce-001e68bb39ab}.TM.blf
[2011.07.15 00:03:28 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2965df33-ad25-11e0-80ce-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.14 00:50:49 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2965df33-ad25-11e0-80ce-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.07 03:32:45 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2aa1c924-bfbe-11e0-b79d-001e68bb39ab}.TM.blf
[2011.08.07 03:32:45 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2aa1c924-bfbe-11e0-b79d-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.06 02:40:21 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2aa1c924-bfbe-11e0-b79d-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.05 22:49:22 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2b5cdd4d-bf6f-11e0-bcc3-001e68bb39ab}.TM.blf
[2011.08.05 22:49:22 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2b5cdd4d-bf6f-11e0-bcc3-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.05 16:09:46 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{2b5cdd4d-bf6f-11e0-bcc3-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.06.24 01:09:00 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{302b84f9-951c-11e0-b987-001e68bb39ab}.TM.blf
[2011.06.24 01:09:00 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{302b84f9-951c-11e0-b987-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.06.12 23:28:26 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{302b84f9-951c-11e0-b987-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.02 15:24:42 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{31047f0f-bcfe-11e0-9e85-001e68bb39ab}.TM.blf
[2011.08.02 15:24:42 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{31047f0f-bcfe-11e0-9e85-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.02 15:24:42 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{31047f0f-bcfe-11e0-9e85-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.20 00:46:41 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{31f87125-b261-11e0-a6f2-001e68bb39ab}.TM.blf
[2011.07.20 00:46:41 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{31f87125-b261-11e0-a6f2-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.20 00:46:41 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{31f87125-b261-11e0-a6f2-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.19 00:28:12 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{35e1a1ac-b142-11e0-b3ba-001e68bb39ab}.TM.blf
[2011.07.19 00:28:12 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{35e1a1ac-b142-11e0-b3ba-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.19 00:28:12 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{35e1a1ac-b142-11e0-b3ba-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.30 05:46:33 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{36ce3c0d-ba42-11e0-a12a-001e68bb39ab}.TM.blf
[2011.07.30 05:46:33 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{36ce3c0d-ba42-11e0-a12a-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.30 03:27:32 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{36ce3c0d-ba42-11e0-a12a-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.23 20:48:28 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{373960ad-c2e1-11e0-9090-001e68bb39ab}.TM.blf
[2011.08.23 20:48:28 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{373960ad-c2e1-11e0-9090-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.10 00:43:34 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{373960ad-c2e1-11e0-9090-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.12.11 00:43:01 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{38f4413b-06dd-11e1-beb9-001e68bb39ab}.TM.blf
[2011.12.11 00:43:01 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{38f4413b-06dd-11e1-beb9-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.11.04 13:05:33 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{38f4413b-06dd-11e1-beb9-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.06.12 18:57:19 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2011.06.12 18:57:19 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2011.06.09 15:30:28 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2011.07.13 00:17:34 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{57fb82bd-ab8a-11e0-bd82-001e68bb39ab}.TM.blf
[2011.07.13 00:17:34 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{57fb82bd-ab8a-11e0-bd82-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.11 08:14:44 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{57fb82bd-ab8a-11e0-bd82-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.29 01:05:20 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{64ebc7ae-b854-11e0-b108-001e68bb39ab}.TM.blf
[2011.07.29 01:05:20 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{64ebc7ae-b854-11e0-b108-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.28 01:00:18 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{64ebc7ae-b854-11e0-b108-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.05 03:09:23 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{655cf4a4-bd65-11e0-ba20-001e68bb39ab}.TM.blf
[2011.08.05 03:09:23 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{655cf4a4-bd65-11e0-ba20-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.03 03:00:41 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{655cf4a4-bd65-11e0-ba20-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.09 02:45:28 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{6a192130-c21b-11e0-b723-001e68bb39ab}.TM.blf
[2011.08.09 02:45:28 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{6a192130-c21b-11e0-b723-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.09 02:45:28 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{6a192130-c21b-11e0-b723-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.22 13:59:09 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{8226022e-b266-11e0-a4fb-001e68bb39ab}.TM.blf
[2011.07.22 13:59:09 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{8226022e-b266-11e0-a4fb-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.20 02:19:00 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{8226022e-b266-11e0-a4fb-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.10 14:32:24 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{82f44ca4-a647-11e0-830d-001e68bb39ab}.TM.blf
[2011.07.10 14:32:24 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{82f44ca4-a647-11e0-830d-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.04 15:12:12 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{82f44ca4-a647-11e0-830d-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.04 12:01:37 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{845334c5-9e4b-11e0-9885-001e68bb39ab}.TM.blf
[2011.07.04 12:01:37 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{845334c5-9e4b-11e0-9885-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.06.24 11:21:14 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{845334c5-9e4b-11e0-9885-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2012.02.07 22:25:26 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{866b78c1-2416-11e1-bf47-001e68bb39ab}.TM.blf
[2012.02.07 22:25:26 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{866b78c1-2416-11e1-bf47-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.12.11 23:37:39 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{866b78c1-2416-11e1-bf47-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.08.02 03:10:58 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{b96e3945-bb13-11e0-8ad6-001e68bb39ab}.TM.blf
[2011.08.02 03:10:58 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{b96e3945-bb13-11e0-8ad6-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.31 02:34:25 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{b96e3945-bb13-11e0-8ad6-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.11 01:08:19 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{bce6b6b5-ab51-11e0-acae-001e68bb39ab}.TM.blf
[2011.07.11 01:08:19 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{bce6b6b5-ab51-11e0-acae-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.11 01:08:19 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{bce6b6b5-ab51-11e0-acae-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.11.03 22:29:24 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{d5a9f22d-ce9b-11e0-b05d-001e68bb39ab}.TM.blf
[2011.11.03 22:29:24 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{d5a9f22d-ce9b-11e0-b05d-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.08.25 02:10:48 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{d5a9f22d-ce9b-11e0-b05d-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.15 13:50:51 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{e9df2f6c-aee0-11e0-860a-001e68bb39ab}.TM.blf
[2011.07.15 13:50:51 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{e9df2f6c-aee0-11e0-860a-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.15 13:50:51 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{e9df2f6c-aee0-11e0-860a-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.25 02:15:49 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{eb805db5-b47e-11e0-ace4-001e68bb39ab}.TM.blf
[2011.07.25 02:15:49 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{eb805db5-b47e-11e0-ace4-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.22 22:12:44 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{eb805db5-b47e-11e0-ace4-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.27 03:11:51 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{f0cb4e0f-b6b8-11e0-9b66-001e68bb39ab}.TM.blf
[2011.07.27 03:11:51 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{f0cb4e0f-b6b8-11e0-9b66-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.25 13:24:49 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{f0cb4e0f-b6b8-11e0-9b66-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.07.18 00:33:29 | 000,065,536 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{f1e015d5-af5e-11e0-91b3-001e68bb39ab}.TM.blf
[2011.07.18 00:33:29 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{f1e015d5-af5e-11e0-91b3-001e68bb39ab}.TMContainer00000000000000000001.regtrans-ms
[2011.07.16 06:26:37 | 000,524,288 | -HS- | M] () -- C:\Users\Erica\ntuser.dat{f1e015d5-af5e-11e0-91b3-001e68bb39ab}.TMContainer00000000000000000002.regtrans-ms
[2011.06.09 12:10:29 | 000,000,020 | -HS- | M] () -- C:\Users\Erica\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 99 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >
--- --- ---

Snow_White 08.02.2012 13:32
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 08.02.2012 13:11:05 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Erica\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 75,42% Memory free
6,20 Gb Paging File | 5,63 Gb Available in Paging File | 90,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286,09 Gb Total Space | 206,87 Gb Free Space | 72,31% Space Free | Partition Type: NTFS
 
Computer Name: ERICA-PC | User Name: Erica | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{18B8259C-77BD-416C-8EE9-908DFCBD3183}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{27744ACC-902B-4546-98EB-0B724FD382FB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2BFA4D89-DC2C-41F6-B7A3-6825E93C5E93}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{31319024-BB68-4671-84DE-2C26D23BCD1F}" = rport=445 | protocol=6 | dir=out | app=system |
"{32EEDD84-D185-4ED2-A353-1D5B4936741D}" = lport=139 | protocol=6 | dir=in | app=system |
"{513FF42D-61E1-43C5-9DBC-69AB23E585CF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{560DE8B1-5A2C-4AE9-8BE1-6E378628A943}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5B73A072-F646-4168-8E62-021B2A3374F8}" = lport=138 | protocol=17 | dir=in | app=system |
"{799BB34E-C892-4DD4-880D-77D8C5E6E197}" = lport=445 | protocol=6 | dir=in | app=system |
"{91C15F5C-826A-4067-B1BD-4BCF90D55DDB}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{9B438636-1B6D-4F98-BAC0-5E971F6E80FC}" = rport=138 | protocol=17 | dir=out | app=system |
"{A4F182F0-2BBE-44B9-BBA6-E3AC57142520}" = lport=137 | protocol=17 | dir=in | app=system |
"{AD19DB30-1762-484C-A1F3-31A2D618117B}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B0F67702-067D-43E9-B1DC-524C0A865D43}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B1E35EE2-540A-4EB4-A23F-E6E7D20E7D16}" = rport=139 | protocol=6 | dir=out | app=system |
"{B2ACC4FA-8564-4ECD-8A56-E7193900897C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{C506264F-DECD-4E5A-83A8-BEED7F70CA9D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F41F80A2-64B7-477A-BE83-5E0D0C486FA9}" = rport=137 | protocol=17 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07A7B60B-F2E6-4010-BE27-6873D47043E5}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{15ACD876-6546-456D-8319-6824EF73B89F}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{193CED54-4846-4519-8956-606BE804BB6D}" = protocol=6 | dir=in | app=c:\program files\mirandafusion\miranda32.exe |
"{26A48E20-7E19-43B9-9E08-93AB781FFC73}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{350A532A-8563-4F9C-9D5C-35E746271904}" = protocol=6 | dir=in | app=c:\program files\mirandafusion\fusiontools\updater.exe |
"{9B98B10F-19EC-4567-9030-5255B85212E4}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9F278515-DFAD-4CD4-9560-1C4763704E38}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\mediabar\datamngr\toolbar\dtuser.exe |
"{AB2ED401-76C0-4FE8-B1B0-ECCD7CB0AAAB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{AC82EA92-1E48-4B07-B8CA-4835ADF24A89}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{AC8BC18B-8708-4323-A2A3-440E71F8592D}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\mediabar\datamngr\toolbar\dtuser.exe |
"{AEB151A5-D9F5-4491-A628-B497059E81DA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B6590299-3029-42E7-989F-E73D3717560E}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{C67F326E-7A5B-4CEA-98AC-897FE8A93014}" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{CB029A46-6EC1-4519-972B-CD848B9F8A79}" = dir=in | app=c:\users\erica\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{DFCA5CC8-1B38-49A3-BEC6-383939C0A74D}" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"{E8637FF8-2E70-4B59-8557-B1C4790B1FBC}" = protocol=17 | dir=in | app=c:\program files\mirandafusion\fusiontools\updater.exe |
"{F2597033-0D36-4139-9A06-35798C08E7E2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{FC257E51-FF83-4A5F-90FF-7A3D9F482DBA}" = protocol=17 | dir=in | app=c:\program files\mirandafusion\miranda32.exe |
"TCP Query User{00F7E71A-BFED-466D-9DAA-BC12D4C81E50}C:\program files\photoscape\photoscape.exe" = protocol=6 | dir=in | app=c:\program files\photoscape\photoscape.exe |
"TCP Query User{01B46D6F-324B-41EC-9807-FF7F661115CE}C:\program files\common files\symantec shared\ccsvchst.exe" = protocol=6 | dir=in | app=c:\program files\common files\symantec shared\ccsvchst.exe |
"TCP Query User{02C1C44A-49CD-49F2-B110-419AAAD2BA60}C:\windows\system32\wermgr.exe" = protocol=6 | dir=in | app=c:\windows\system32\wermgr.exe |
"TCP Query User{0874C23E-2E05-4BFC-ACE4-94E98844E006}C:\program files\ask.com\updater\updater.exe" = protocol=6 | dir=in | app=c:\program files\ask.com\updater\updater.exe |
"TCP Query User{0A8ABC7C-ACA5-4B62-BB23-9AE60F750C50}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{0AE17CF5-0433-4D6E-B980-A94BB3E8D465}C:\program files\ask.com\updatetask.exe" = protocol=6 | dir=in | app=c:\program files\ask.com\updatetask.exe |
"TCP Query User{0B53D804-81B8-48FB-A907-B521A9DD7F93}C:\program files\ask.com\updatetask.exe" = protocol=6 | dir=in | app=c:\program files\ask.com\updatetask.exe |
"TCP Query User{0E05BC43-F163-4F44-8235-1DE22D7F2071}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{136A5EF8-9473-4F5A-8134-8829295997F7}C:\program files\divx\divx plus web player\ddmservice.exe" = protocol=6 | dir=in | app=c:\program files\divx\divx plus web player\ddmservice.exe |
"TCP Query User{15AB03D4-8AB1-4790-A255-C2366C5E5ADB}C:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe" = protocol=6 | dir=in | app=c:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe |
"TCP Query User{16AC2DB2-349C-4B13-83B8-C091B1C2E31B}C:\program files\mirandafusion\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\mirandafusion\miranda32.exe |
"TCP Query User{1B3CA5E0-9C9D-4733-95B7-D669929341A1}C:\windows\system32\wercon.exe" = protocol=6 | dir=in | app=c:\windows\system32\wercon.exe |
"TCP Query User{1B9EF033-47EC-48F5-850B-EBAD53B8D306}C:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe" = protocol=6 | dir=in | app=c:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe |
"TCP Query User{1E773FCD-3EEF-450E-A3C1-4E2A95D1E16A}C:\program files\common files\dvdvideosoft\tb\conduitinstaller.exe" = protocol=6 | dir=in | app=c:\program files\common files\dvdvideosoft\tb\conduitinstaller.exe |
"TCP Query User{1F920530-2BA5-4392-A53D-5FBE45A2F9B5}C:\windows\system32\werfault.exe" = protocol=6 | dir=in | app=c:\windows\system32\werfault.exe |
"TCP Query User{1F9A2B69-A33B-473A-A4AD-9EB0B8129F90}C:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe" = protocol=6 | dir=in | app=c:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe |
"TCP Query User{24D33D1B-051E-40AF-99C9-803DE811AF54}C:\program files\divx\divx plus player\divx plus player.exe" = protocol=6 | dir=in | app=c:\program files\divx\divx plus player\divx plus player.exe |
"TCP Query User{275F76AB-2F70-4983-9A35-21D53FB6EDE2}C:\windows\system32\adobe\shockwave 11\gt.exe" = protocol=6 | dir=in | app=c:\windows\system32\adobe\shockwave 11\gt.exe |
"TCP Query User{292A5EB2-DC3B-48D8-8301-8F2269B60C15}C:\users\erica\downloads\brothersoftdownloader_for_windows_live_messenger.exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\brothersoftdownloader_for_windows_live_messenger.exe |
"TCP Query User{2C0A0512-95FD-4BEE-865F-2959565D0AF9}C:\program files\manycam\bin\manycam.exe" = protocol=6 | dir=in | app=c:\program files\manycam\bin\manycam.exe |
"TCP Query User{2DA9969A-8179-45DC-B359-18FA6E6ED19A}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe |
"TCP Query User{33E84036-F8F2-4BE2-A1E9-31AF46103868}C:\program files\norton security scan\engine\2.7.6.3\defload.exe" = protocol=6 | dir=in | app=c:\program files\norton security scan\engine\2.7.6.3\defload.exe |
"TCP Query User{36324ADE-8246-4079-A683-3497797AA94B}C:\users\erica\appdata\local\facebook\update\facebookupdate.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\facebook\update\facebookupdate.exe |
"TCP Query User{3A2FEFF2-18EF-4BE0-91D3-4E10E4F365D7}C:\windows\system32\wercon.exe" = protocol=6 | dir=in | app=c:\windows\system32\wercon.exe |
"TCP Query User{3BE9BF50-494D-4E50-9D46-9118FF6FE7E2}C:\windows\helppane.exe" = protocol=6 | dir=in | app=c:\windows\helppane.exe |
"TCP Query User{3C3D82DB-F23F-413F-8304-ACCC7AF8722E}C:\program files\norton security scan\engine\2.7.6.3\nss.exe" = protocol=6 | dir=in | app=c:\program files\norton security scan\engine\2.7.6.3\nss.exe |
"TCP Query User{3D1B9538-C939-401D-A988-58137D0EA6F8}C:\users\erica\appdata\local\temp\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe |
"TCP Query User{3DF1EF7A-96EC-4EF7-BB97-9091FE7E3F57}C:\windows\system32\msiexec.exe" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"TCP Query User{3DF491D1-4E3A-49AD-854E-E2F0CB6D7BB1}C:\program files\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"TCP Query User{3E6785DE-532B-4CAF-9E7A-0DFFF89E5CBF}C:\users\erica\appdata\local\temp\wzse0.tmp\s_install.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\wzse0.tmp\s_install.exe |
"TCP Query User{3FA599F0-0BEE-43BF-8BD4-58B536CBB2BA}C:\windows\system32\adobe\shockwave 11\swhelper_1163633.exe" = protocol=6 | dir=in | app=c:\windows\system32\adobe\shockwave 11\swhelper_1163633.exe |
"TCP Query User{3FD47E9C-CEFA-44EB-B940-5D6D7562936F}C:\users\erica\downloads\get_magix_foto___grafik_designer_6.exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\get_magix_foto___grafik_designer_6.exe |
"TCP Query User{417411C9-546C-4A3D-971B-2862FE88B903}C:\users\erica\downloads\wlsetup-web.exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\wlsetup-web.exe |
"TCP Query User{468A6A90-421C-470D-80C1-2955725FBA14}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{468CA9B2-CAB6-467D-9516-A0E36753D2B8}C:\programdata\divx\symantec\syminstallstub.exe" = protocol=6 | dir=in | app=c:\programdata\divx\symantec\syminstallstub.exe |
"TCP Query User{478778EE-3D9A-414C-9533-68C915945D4C}C:\users\erica\appdata\local\temp\nsn9916.tmp\apnstub.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\nsn9916.tmp\apnstub.exe |
"TCP Query User{4B736FA4-5FD9-4229-8F1C-4C77C0AE2B02}C:\users\erica\appdata\local\mozilla\firefox\firefox.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\mozilla\firefox\firefox.exe |
"TCP Query User{4DA8842C-AC5C-4E1D-A9CD-F5712AAB2C67}C:\program files\windows media player\setup_wm.exe" = protocol=6 | dir=in | app=c:\program files\windows media player\setup_wm.exe |
"TCP Query User{4E04C5BF-76B8-460A-AE9A-4D57FE3A39FA}C:\program files\mirandafusion\fusiontools\updater.exe" = protocol=6 | dir=in | app=c:\program files\mirandafusion\fusiontools\updater.exe |
"TCP Query User{52814D89-7C9D-45E5-9077-51D1E136CA83}C:\users\erica\appdata\local\temp\wzse0.tmp\setup.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\wzse0.tmp\setup.exe |
"TCP Query User{538DFAA3-00D9-42EF-A302-190CC9C7C1A9}C:\users\erica\appdata\local\temp\is-aana8.tmp\setup.tmp" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\is-aana8.tmp\setup.tmp |
"TCP Query User{54146D33-2CF5-4C62-87AC-D2E7023BC750}C:\users\erica\appdata\local\temp\pageragesetup-14c0.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\pageragesetup-14c0.exe |
"TCP Query User{5ACBA2C8-CD6D-4561-957B-8CF88F009B0C}C:\program files\common files\adobe\updater5\adobeupdater.exe" = protocol=6 | dir=in | app=c:\program files\common files\adobe\updater5\adobeupdater.exe |
"TCP Query User{5BF7D9B0-585D-43F9-8E9F-9CB802CAEF17}C:\users\erica\appdata\local\temp\divxsetup.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\divxsetup.exe |
"TCP Query User{5C13197E-4708-4470-B0D4-B807A9F22490}C:\program files\common files\adobe\updater5\adobeupdater.exe" = protocol=6 | dir=in | app=c:\program files\common files\adobe\updater5\adobeupdater.exe |
"TCP Query User{5C211C0E-75FB-4A3B-A8E4-C47DEC5CDBE7}C:\program files\adobe\reader 8.0\reader\acrord32.exe" = protocol=6 | dir=in | app=c:\program files\adobe\reader 8.0\reader\acrord32.exe |
"TCP Query User{5D311E46-68C4-4042-B3DE-6FA95B68F2C9}C:\users\erica\appdata\local\facebook\update\facebookupdate.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\facebook\update\facebookupdate.exe |
"TCP Query User{5DEBC979-6866-48F5-8165-76FFDBE4F7C5}C:\users\erica\downloads\easydriverpro (1).exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\easydriverpro (1).exe |
"TCP Query User{5E24620A-A513-4331-982E-950393CDC986}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{5F60369D-CBED-4D82-A2F7-4FA0789DB3D9}C:\windows\microsoft.net\framework\v2.0.50727\dw20.exe" = protocol=6 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe |
"TCP Query User{600C93F7-5A61-464E-AC73-C4BA81609936}C:\users\erica\appdata\local\temp\pageragetoolbar.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\pageragetoolbar.exe |
"TCP Query User{620384F7-7EF6-4A0E-A5E1-C843D4757311}C:\program files\divx\divx plus web player\ddmservice.exe" = protocol=6 | dir=in | app=c:\program files\divx\divx plus web player\ddmservice.exe |
"TCP Query User{6424A9B4-8AE3-4A01-A24E-0F377815C614}C:\users\erica\appdata\local\temp\nsn9916.tmp\manycam_stat_params.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\nsn9916.tmp\manycam_stat_params.exe |
"TCP Query User{6C2B8CD3-1A85-4742-91A9-DB3721123B17}C:\program files\avira\antivir desktop\apnstub.exe" = protocol=6 | dir=in | app=c:\program files\avira\antivir desktop\apnstub.exe |
"TCP Query User{70567519-4168-4724-80C7-F5391DC25BC4}C:\windows\system32\werfault.exe" = protocol=6 | dir=in | app=c:\windows\system32\werfault.exe |
"TCP Query User{706177F4-8C14-401A-9ADA-2914EF6E0D2A}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{7171921C-DCD8-4F89-A004-E404CE1FE059}C:\program files\magix\xtreme foto grafik designer 5 download-version\yahoo\ytb.exe" = protocol=6 | dir=in | app=c:\program files\magix\xtreme foto grafik designer 5 download-version\yahoo\ytb.exe |
"TCP Query User{77275366-A4FC-45E6-9B44-CD94DB753C4F}C:\program files\norton security scan\engine\3.5.1.8\nss.exe" = protocol=6 | dir=in | app=c:\program files\norton security scan\engine\3.5.1.8\nss.exe |
"TCP Query User{78802C43-24D4-429C-942E-E71EF9AAFE02}C:\windows\system32\rundll32.exe" = protocol=6 | dir=in | app=c:\windows\system32\rundll32.exe |
"TCP Query User{78C991BA-8156-42D6-8930-B71E475C2783}C:\program files\windows sidebar\sidebar.exe" = protocol=6 | dir=in | app=c:\program files\windows sidebar\sidebar.exe |
"TCP Query User{79E50A5C-6A67-4D3A-9927-AD285328A753}C:\users\erica\appdata\local\temp\setup.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\setup.exe |
"TCP Query User{7A41C7D5-9DC1-4D51-9774-BA81E1251DA1}C:\program files\divx\divx update\divxupdate.exe" = protocol=6 | dir=in | app=c:\program files\divx\divx update\divxupdate.exe |
"TCP Query User{7D226F84-1707-48DE-92ED-89D069A7965A}C:\windows\system32\mmc.exe" = protocol=6 | dir=in | app=c:\windows\system32\mmc.exe |
"TCP Query User{807FE461-4416-4E95-9F0C-4460D65B5AB3}C:\programdata\{8f6a59ae-835f-46b0-90b3-07adbc8494f0}\bearshare_v10_en_setup.exe" = protocol=6 | dir=in | app=c:\programdata\{8f6a59ae-835f-46b0-90b3-07adbc8494f0}\bearshare_v10_en_setup.exe |
"TCP Query User{8BA04146-D83B-46F1-83AD-308A3BBAD182}C:\users\erica\downloads\brothersoftdownloader_for_magix_xtreme_foto_designer.exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\brothersoftdownloader_for_magix_xtreme_foto_designer.exe |
"TCP Query User{8CCCB3B7-CBB0-4CB0-8EC5-61A33C2A9631}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{8F274E51-56FC-4995-B33F-4CA46FB6234F}C:\program files\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"TCP Query User{8F5451A5-5BE4-4A4C-B14E-B571FECE8A7B}C:\program files\ask.com\taskscheduler.exe" = protocol=6 | dir=in | app=c:\program files\ask.com\taskscheduler.exe |
"TCP Query User{934EC956-2317-480F-8AF1-09CCA899EF6E}C:\program files\divx\divx plus player\divx plus player.exe" = protocol=6 | dir=in | app=c:\program files\divx\divx plus player\divx plus player.exe |
"TCP Query User{93B48719-CB3C-4B2E-9C7D-CF00C8D23D6D}C:\windows\helppane.exe" = protocol=6 | dir=in | app=c:\windows\helppane.exe |
"TCP Query User{968AAA81-E6FC-43D4-A8F0-1B796B0AC099}C:\users\erica\appdata\local\temp\{962cf745-084c-4437-87cb-9c6f8ad136c8}\setup.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\{962cf745-084c-4437-87cb-9c6f8ad136c8}\setup.exe |
"TCP Query User{970076C2-F2F5-433D-8F29-6D688EE2325F}C:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe" = protocol=6 | dir=in | app=c:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe |
"TCP Query User{9B90B8A8-440C-4027-92FD-0CE7BD01EB98}C:\users\erica\appdata\local\temp\mia1b0f.tmp\bearshare_v10_en_setup.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\mia1b0f.tmp\bearshare_v10_en_setup.exe |
"TCP Query User{9E44AF8D-E704-4C8B-9EC7-E5F9797B06C7}C:\program files\ask.com\updater\updater.exe" = protocol=6 | dir=in | app=c:\program files\ask.com\updater\updater.exe |
"TCP Query User{9E711825-254D-44F2-8EA0-95F5A78E0D0C}C:\users\erica\appdata\local\temp\bearshare_dm\bearsharemediabar.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\bearshare_dm\bearsharemediabar.exe |
"TCP Query User{A11D1FF2-5DFA-48BB-89E8-B642B1AD1EFD}C:\users\erica\appdata\local\temp\rarsfx0\fact.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\rarsfx0\fact.exe |
"TCP Query User{A1425E06-5C9F-470D-8687-FBF3E0DE5A87}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{A2DAD568-D437-4910-A0F4-D8F4CAAAA4EA}C:\program files\easy driver pro\easy driver pro\easydriverpro.updater.exe" = protocol=6 | dir=in | app=c:\program files\easy driver pro\easy driver pro\easydriverpro.updater.exe |
"TCP Query User{A50EFDB6-2F50-4B7E-888D-2EC1BE3BFF48}C:\program files\windows defender\msascui.exe" = protocol=6 | dir=in | app=c:\program files\windows defender\msascui.exe |
"TCP Query User{A6DC669D-CF35-4A5B-997D-D3D4B1105F20}C:\program files\msn messenger\msnmsgr.exe" = protocol=6 | dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"TCP Query User{AA03315B-D5B6-45D0-90AE-AB02A4E4364C}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B1C97366-DCE1-4385-A9CB-1DA7886C17F1}C:\program files\photoscape\photoscape.exe" = protocol=6 | dir=in | app=c:\program files\photoscape\photoscape.exe |
"TCP Query User{B43C11E5-8ECE-4713-BC55-D3CD1AC4193A}C:\users\erica\appdata\local\temp\apntoolbarinstaller.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\apntoolbarinstaller.exe |
"TCP Query User{B6D3E374-4A14-4B40-AFC1-A4199F1CD75B}C:\windows\system32\adobe\director\swdnld.exe" = protocol=6 | dir=in | app=c:\windows\system32\adobe\director\swdnld.exe |
"TCP Query User{B73CCE0C-D13F-452B-BF61-824EEEEEF4E7}C:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe" = protocol=6 | dir=in | app=c:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe |
"TCP Query User{BC0CFCFF-F712-452D-80D2-1B894CD9D910}C:\program files\manycam\bin\manycam.exe" = protocol=6 | dir=in | app=c:\program files\manycam\bin\manycam.exe |
"TCP Query User{BFDCDB16-396E-4143-B002-6FAB01FFDD72}C:\users\erica\appdata\local\temp\toolbarpagerage.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\toolbarpagerage.exe |
"TCP Query User{C10B3044-67A0-46AE-A3D6-EEC781EA05F5}C:\program files\cyberlink\youcam\youcam.exe" = protocol=6 | dir=in | app=c:\program files\cyberlink\youcam\youcam.exe |
"TCP Query User{C45D9AF0-D02B-45A5-A44B-76B2C12D425F}C:\users\erica\appdata\local\temp\__28072011130734\setup.exe" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\__28072011130734\setup.exe |
"TCP Query User{C4C2BC95-CB70-4F63-BEC9-C1E013BD4C19}C:\program files\easy driver pro\easy driver pro\easydriverpro.exe" = protocol=6 | dir=in | app=c:\program files\easy driver pro\easy driver pro\easydriverpro.exe |
"TCP Query User{C6998FAA-374D-4679-BC80-455542DEADF9}C:\program files\ask.com\taskscheduler.exe" = protocol=6 | dir=in | app=c:\program files\ask.com\taskscheduler.exe |
"TCP Query User{CB5EC142-A6B6-4317-A841-F90F3AFF4597}C:\windows\system32\wermgr.exe" = protocol=6 | dir=in | app=c:\windows\system32\wermgr.exe |
"TCP Query User{CBC4D74E-A260-4C9C-BD35-6F26C70EA806}C:\program files\google\update\googleupdate.exe" = protocol=6 | dir=in | app=c:\program files\google\update\googleupdate.exe |
"TCP Query User{CBF3BC58-4044-4333-A8A5-517DCC5FCF3E}C:\windows\system32\macromed\flash\flashutil10s_plugin.exe" = protocol=6 | dir=in | app=c:\windows\system32\macromed\flash\flashutil10s_plugin.exe |
"TCP Query User{D3BE287B-3E38-4099-A518-94FB0BD70DD6}C:\windows\system32\macromed\flash\flashutil11c_plugin.exe" = protocol=6 | dir=in | app=c:\windows\system32\macromed\flash\flashutil11c_plugin.exe |
"TCP Query User{D61BB9B3-0023-429F-BF7B-8146119A90FE}C:\program files\common files\dvdvideosoft\dvsupdate.exe" = protocol=6 | dir=in | app=c:\program files\common files\dvdvideosoft\dvsupdate.exe |
"TCP Query User{D7F68C08-322F-4BD3-972A-6CA902CA0F97}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe |
"TCP Query User{DABF806D-A99E-45DF-8B71-182FFA0542A3}C:\program files\avira\antivir desktop\setup.exe" = protocol=6 | dir=in | app=c:\program files\avira\antivir desktop\setup.exe |
"TCP Query User{DC0904FE-B197-4D11-854B-B384BA9C918D}C:\users\erica\downloads\softonicdownloader_fuer_magix-xtreme-foto-grafik-designer.exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\softonicdownloader_fuer_magix-xtreme-foto-grafik-designer.exe |
"TCP Query User{DD9A3E6F-D93C-4EC9-9C19-55990CF3AE18}C:\program files\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"TCP Query User{DEA68BF3-66D7-4068-8C4B-F371384C6CD5}C:\windows\system32\msiexec.exe" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"TCP Query User{E5914C7F-6DFF-4B73-AFC7-DA096D00F8C6}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{E5DAEBDE-5A56-4806-B964-2F4E5369B2ED}C:\users\erica\appdata\local\temp\divf6ea.tmp\div1dce.tmp" = protocol=6 | dir=in | app=c:\users\erica\appdata\local\temp\divf6ea.tmp\div1dce.tmp |
"TCP Query User{E644A888-B08A-4F19-8ECA-F6E44021B678}C:\program files\divx\symantec\symantec.exe" = protocol=6 | dir=in | app=c:\program files\divx\symantec\symantec.exe |
"TCP Query User{E8D4B3DF-787F-4970-8712-FA2CD0B01DA1}C:\program files\windows defender\msascui.exe" = protocol=6 | dir=in | app=c:\program files\windows defender\msascui.exe |
"TCP Query User{EC01C52F-4659-43AD-8A56-5C4EC98E81CA}C:\windows\system32\rundll32.exe" = protocol=6 | dir=in | app=c:\windows\system32\rundll32.exe |
"TCP Query User{EC60813C-9431-43F9-A088-8509E40A4C62}C:\amd\catalyst_mobility_32-bit_util\catalystmobility.exe" = protocol=6 | dir=in | app=c:\amd\catalyst_mobility_32-bit_util\catalystmobility.exe |
"TCP Query User{F220B23D-5551-4677-831D-C3C3374724AF}C:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe" = protocol=6 | dir=in | app=c:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe |
"TCP Query User{F275B621-DFA9-4491-8B5C-7369D2D29ECD}C:\program files\magix\foto_designer_7\xtremephoto.exe" = protocol=6 | dir=in | app=c:\program files\magix\foto_designer_7\xtremephoto.exe |
"TCP Query User{F30DB320-4B1E-43AA-91B5-791A0CEB9B2C}C:\users\erica\downloads\install_icq7.exe" = protocol=6 | dir=in | app=c:\users\erica\downloads\install_icq7.exe |
"TCP Query User{F334417B-2AD0-4E38-AC4D-C02F9CC8B0E8}C:\program files\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"TCP Query User{F679F2C6-E42B-4E1D-97D4-0C3B5DB4618A}C:\program files\portrait professional 9 test\portraitprofessionaltrial.exe" = protocol=6 | dir=in | app=c:\program files\portrait professional 9 test\portraitprofessionaltrial.exe |
"TCP Query User{F9A21477-01C2-48F3-8877-40FB8934FF13}C:\program files\divx\divx update\divxupdate.exe" = protocol=6 | dir=in | app=c:\program files\divx\divx update\divxupdate.exe |
"TCP Query User{FED08941-9780-4CF8-8DA5-F37D46EF00BA}C:\program files\avira\antivir desktop\avnotify.exe" = protocol=6 | dir=in | app=c:\program files\avira\antivir desktop\avnotify.exe |
"TCP Query User{FF1CB791-7F95-43C3-BC4B-ECBADF8A974D}C:\program files\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\miranda im\miranda32.exe |
"UDP Query User{00E1FE81-8D0B-4D35-8BF9-E76161DD6C71}C:\users\erica\appdata\local\temp\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe |
"UDP Query User{0A1DD9EC-0E15-4F72-AA1A-AEC67CE188D4}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{0A9EB1C6-A21A-45F7-8CB4-EFAEE4CDCE27}C:\windows\system32\rundll32.exe" = protocol=17 | dir=in | app=c:\windows\system32\rundll32.exe |
"UDP Query User{0FFE8457-5B04-4661-865F-8FD4C1912C61}C:\program files\photoscape\photoscape.exe" = protocol=17 | dir=in | app=c:\program files\photoscape\photoscape.exe |
"UDP Query User{115D8DCE-1B14-4D2B-9B06-AD66169A9C3B}C:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe" = protocol=17 | dir=in | app=c:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe |
"UDP Query User{1291386F-70C3-4AF8-A35D-20E2CD0048B0}C:\program files\ask.com\updatetask.exe" = protocol=17 | dir=in | app=c:\program files\ask.com\updatetask.exe |
"UDP Query User{12B9457F-A977-4124-85C2-96349427F3F7}C:\users\erica\appdata\local\temp\bearshare_dm\bearsharemediabar.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\bearshare_dm\bearsharemediabar.exe |
"UDP Query User{1316F193-0702-4C0B-83DB-E6FE1CF15281}C:\users\erica\downloads\softonicdownloader_fuer_magix-xtreme-foto-grafik-designer.exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\softonicdownloader_fuer_magix-xtreme-foto-grafik-designer.exe |
"UDP Query User{1500E5FA-68E8-4788-8A5D-6594F7039F06}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{15BF5899-F11C-4739-A619-29ADF72CA550}C:\users\erica\appdata\local\facebook\update\facebookupdate.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\facebook\update\facebookupdate.exe |
"UDP Query User{16B45046-5CDC-4C06-89F3-3A2C040E6F0F}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{1B34FC44-7625-4E2E-8FC5-0C92CCBB5798}C:\program files\mirandafusion\fusiontools\updater.exe" = protocol=17 | dir=in | app=c:\program files\mirandafusion\fusiontools\updater.exe |
"UDP Query User{1D6EB004-3E14-417A-8347-FDA10B0CFF34}C:\program files\easy driver pro\easy driver pro\easydriverpro.updater.exe" = protocol=17 | dir=in | app=c:\program files\easy driver pro\easy driver pro\easydriverpro.updater.exe |
"UDP Query User{1E4C79B3-8923-4D8F-9BC7-8E5DF6B657E6}C:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe" = protocol=17 | dir=in | app=c:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe |
"UDP Query User{20905800-1FA6-46D9-9EB6-49BED0D7D8ED}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"UDP Query User{20A635DE-CF8A-4023-B55D-D32A89A2FBF2}C:\windows\system32\adobe\director\swdnld.exe" = protocol=17 | dir=in | app=c:\windows\system32\adobe\director\swdnld.exe |
"UDP Query User{2376E7BD-D98D-4ACF-932F-AE7F47328C2E}C:\program files\ask.com\taskscheduler.exe" = protocol=17 | dir=in | app=c:\program files\ask.com\taskscheduler.exe |
"UDP Query User{27A2E44F-D9E8-41B6-92D1-507BFF378373}C:\program files\divx\divx update\divxupdate.exe" = protocol=17 | dir=in | app=c:\program files\divx\divx update\divxupdate.exe |
"UDP Query User{2DC9BF34-F50F-4329-8A30-000EAFFB8D86}C:\program files\msn messenger\msnmsgr.exe" = protocol=17 | dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"UDP Query User{2E6DD988-45A2-40A1-9482-8276A08482A9}C:\program files\ask.com\updater\updater.exe" = protocol=17 | dir=in | app=c:\program files\ask.com\updater\updater.exe |
"UDP Query User{307369F2-684F-4192-9A2D-268EBEFEAB33}C:\program files\windows sidebar\sidebar.exe" = protocol=17 | dir=in | app=c:\program files\windows sidebar\sidebar.exe |
"UDP Query User{31B5EF0B-676C-480D-901F-B66096FB3A61}C:\program files\portrait professional 9 test\portraitprofessionaltrial.exe" = protocol=17 | dir=in | app=c:\program files\portrait professional 9 test\portraitprofessionaltrial.exe |
"UDP Query User{34084B0C-98A9-4441-81D1-7558088E7A41}C:\program files\divx\divx plus web player\ddmservice.exe" = protocol=17 | dir=in | app=c:\program files\divx\divx plus web player\ddmservice.exe |
"UDP Query User{3608608D-E139-4602-87CA-55AD6800F3E8}C:\windows\system32\rundll32.exe" = protocol=17 | dir=in | app=c:\windows\system32\rundll32.exe |
"UDP Query User{3A1679AE-E3F9-431C-AFF0-27784D4DD41B}C:\users\erica\appdata\local\temp\{962cf745-084c-4437-87cb-9c6f8ad136c8}\setup.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\{962cf745-084c-4437-87cb-9c6f8ad136c8}\setup.exe |
"UDP Query User{3C534096-5C66-4DB6-AEF4-374F8FE298E2}C:\program files\divx\divx update\divxupdate.exe" = protocol=17 | dir=in | app=c:\program files\divx\divx update\divxupdate.exe |
"UDP Query User{3CDBF2AB-E400-460B-93C7-0F15AEE7FFE9}C:\program files\google\update\googleupdate.exe" = protocol=17 | dir=in | app=c:\program files\google\update\googleupdate.exe |
"UDP Query User{3D20585A-1941-44EB-AB4D-A69F00F07917}C:\program files\common files\adobe\updater5\adobeupdater.exe" = protocol=17 | dir=in | app=c:\program files\common files\adobe\updater5\adobeupdater.exe |
"UDP Query User{3E179112-4B19-4F32-AD31-7DCDEFB3B86E}C:\windows\system32\adobe\shockwave 11\swhelper_1163633.exe" = protocol=17 | dir=in | app=c:\windows\system32\adobe\shockwave 11\swhelper_1163633.exe |
"UDP Query User{4063D399-8866-40EA-8B3E-622333733D44}C:\program files\norton security scan\engine\2.7.6.3\defload.exe" = protocol=17 | dir=in | app=c:\program files\norton security scan\engine\2.7.6.3\defload.exe |
"UDP Query User{41992C55-5F8E-4AFC-92BC-3832A3EAC6E0}C:\program files\cyberlink\youcam\youcam.exe" = protocol=17 | dir=in | app=c:\program files\cyberlink\youcam\youcam.exe |
"UDP Query User{4301FB0C-DDC7-4744-8567-E2DAE77DADCD}C:\users\erica\appdata\local\temp\divf6ea.tmp\div1dce.tmp" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\divf6ea.tmp\div1dce.tmp |
"UDP Query User{4318732B-365B-4396-98FF-39A8F5A84990}C:\program files\common files\symantec shared\ccsvchst.exe" = protocol=17 | dir=in | app=c:\program files\common files\symantec shared\ccsvchst.exe |
"UDP Query User{44E6068D-FB80-4D1C-B1C9-A3467476D4C7}C:\users\erica\appdata\local\temp\wzse0.tmp\setup.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\wzse0.tmp\setup.exe |
"UDP Query User{45E77866-BD44-4755-A03A-996249635FB5}C:\users\erica\appdata\local\temp\rarsfx0\fact.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\rarsfx0\fact.exe |
"UDP Query User{4E54CDF5-BD08-427D-A4DA-739C72951FC2}C:\windows\system32\werfault.exe" = protocol=17 | dir=in | app=c:\windows\system32\werfault.exe |
"UDP Query User{4FCF83FC-68F8-4A4E-AD26-F1BA9B67424A}C:\windows\system32\msiexec.exe" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"UDP Query User{56AAA6D6-E73A-4600-B3BB-15F27498D8E7}C:\program files\manycam\bin\manycam.exe" = protocol=17 | dir=in | app=c:\program files\manycam\bin\manycam.exe |
"UDP Query User{5AAE7E14-B566-407D-8781-76AE6523F789}C:\users\erica\appdata\local\facebook\update\facebookupdate.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\facebook\update\facebookupdate.exe |
"UDP Query User{5D0DEE62-1216-41A9-BE60-29C48768C8B1}C:\users\erica\appdata\local\temp\apntoolbarinstaller.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\apntoolbarinstaller.exe |
"UDP Query User{602784C3-6350-4C2D-83AE-B4E150FC0136}C:\users\erica\downloads\install_icq7.exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\install_icq7.exe |
"UDP Query User{60C74857-5D7B-405D-8878-3C79A271A5FA}C:\amd\catalyst_mobility_32-bit_util\catalystmobility.exe" = protocol=17 | dir=in | app=c:\amd\catalyst_mobility_32-bit_util\catalystmobility.exe |
"UDP Query User{62E9FC37-593A-426E-99DC-F9AD9955AF5E}C:\program files\divx\divx plus player\divx plus player.exe" = protocol=17 | dir=in | app=c:\program files\divx\divx plus player\divx plus player.exe |
"UDP Query User{6425BDCF-0DE2-4902-89B3-4A6E27CFA654}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{68306D7F-D915-4BB0-9CC2-F13987D78320}C:\program files\common files\dvdvideosoft\tb\conduitinstaller.exe" = protocol=17 | dir=in | app=c:\program files\common files\dvdvideosoft\tb\conduitinstaller.exe |
"UDP Query User{6B06FD64-BC9C-40D8-9D76-CB638A3A761D}C:\users\erica\appdata\local\temp\setup.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\setup.exe |
"UDP Query User{6CBD58F9-B995-4217-B8FE-933BF2B93069}C:\users\erica\appdata\local\temp\nsn9916.tmp\manycam_stat_params.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\nsn9916.tmp\manycam_stat_params.exe |
"UDP Query User{6CCF51F1-0B35-41C0-9AE7-6981ACE77333}C:\users\erica\downloads\easydriverpro (1).exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\easydriverpro (1).exe |
"UDP Query User{716FF523-0708-41CE-9596-45EB9BDDC872}C:\program files\avira\antivir desktop\apnstub.exe" = protocol=17 | dir=in | app=c:\program files\avira\antivir desktop\apnstub.exe |
"UDP Query User{74836AD8-72EB-4F66-AFF0-E76BB4AA813A}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe |
"UDP Query User{766FA811-5343-46F2-8AD6-6A4CBF3BF722}C:\windows\system32\wercon.exe" = protocol=17 | dir=in | app=c:\windows\system32\wercon.exe |
"UDP Query User{7869E342-7D1D-4991-AE4C-848B44EEDD01}C:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe" = protocol=17 | dir=in | app=c:\programdata\tarma installer\{889df117-14d1-44ee-9f31-c5fb5d47f68b}\setup.exe |
"UDP Query User{78742D9D-CE95-4FBF-979F-23B8FC251A2B}C:\program files\magix\foto_designer_7\xtremephoto.exe" = protocol=17 | dir=in | app=c:\program files\magix\foto_designer_7\xtremephoto.exe |
"UDP Query User{7875E02E-5E1A-4176-AC79-73628512DDE2}C:\program files\windows defender\msascui.exe" = protocol=17 | dir=in | app=c:\program files\windows defender\msascui.exe |
"UDP Query User{8132C0B7-BE70-495E-82C5-020858E5CE69}C:\users\erica\appdata\local\mozilla\firefox\firefox.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\mozilla\firefox\firefox.exe |
"UDP Query User{8212C428-CC93-4F1E-A927-CB10F6DF28FE}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{845B71C8-FBD4-4F97-A887-4C4EB348C4DE}C:\users\erica\appdata\local\temp\toolbarpagerage.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\toolbarpagerage.exe |
"UDP Query User{870C5BBD-7465-4AD5-B160-1067E6904F65}C:\program files\adobe\reader 8.0\reader\acrord32.exe" = protocol=17 | dir=in | app=c:\program files\adobe\reader 8.0\reader\acrord32.exe |
"UDP Query User{89278914-0496-4315-A2ED-DF6B534CFFC7}C:\windows\system32\wermgr.exe" = protocol=17 | dir=in | app=c:\windows\system32\wermgr.exe |
"UDP Query User{892AD1E1-E13C-4035-AAFF-F576AD08E711}C:\program files\common files\dvdvideosoft\dvsupdate.exe" = protocol=17 | dir=in | app=c:\program files\common files\dvdvideosoft\dvsupdate.exe |
"UDP Query User{8C5C28D6-ACF5-4835-B48B-ED38D7E6537D}C:\program files\magix\xtreme foto grafik designer 5 download-version\yahoo\ytb.exe" = protocol=17 | dir=in | app=c:\program files\magix\xtreme foto grafik designer 5 download-version\yahoo\ytb.exe |
"UDP Query User{8CEDFD16-05F9-4107-9194-0C97AA23BFA2}C:\programdata\{8f6a59ae-835f-46b0-90b3-07adbc8494f0}\bearshare_v10_en_setup.exe" = protocol=17 | dir=in | app=c:\programdata\{8f6a59ae-835f-46b0-90b3-07adbc8494f0}\bearshare_v10_en_setup.exe |
"UDP Query User{8DAA6F32-E02F-4B62-85F0-4EBBE9666E28}C:\windows\microsoft.net\framework\v2.0.50727\dw20.exe" = protocol=17 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe |
"UDP Query User{8FC725A3-3570-4FBF-B926-7D2CDD1FB8B9}C:\users\erica\downloads\get_magix_foto___grafik_designer_6.exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\get_magix_foto___grafik_designer_6.exe |
"UDP Query User{90D64BB4-3ACB-4E54-8DBA-B4B8777672AE}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{92613134-460B-4A13-9EEC-8ACDF6AF7B64}C:\users\erica\downloads\wlsetup-web.exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\wlsetup-web.exe |
"UDP Query User{963CCEFD-F365-4C67-8CBB-CFBB52C300BA}C:\users\erica\appdata\local\temp\is-aana8.tmp\setup.tmp" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\is-aana8.tmp\setup.tmp |
"UDP Query User{993793A2-A4BC-4DF6-B3D3-EF5706A6D101}C:\windows\helppane.exe" = protocol=17 | dir=in | app=c:\windows\helppane.exe |
"UDP Query User{9D08522A-B854-439D-8917-8183CCAA9D20}C:\program files\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"UDP Query User{9DECF174-2100-4F7A-BC1C-2DF99F534121}C:\users\erica\downloads\brothersoftdownloader_for_magix_xtreme_foto_designer.exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\brothersoftdownloader_for_magix_xtreme_foto_designer.exe |
"UDP Query User{A1622C89-839E-41F3-B3CE-408174856CE7}C:\program files\photoscape\photoscape.exe" = protocol=17 | dir=in | app=c:\program files\photoscape\photoscape.exe |
"UDP Query User{A17BB810-9606-4B62-90FE-118D6776C6C7}C:\program files\windows defender\msascui.exe" = protocol=17 | dir=in | app=c:\program files\windows defender\msascui.exe |
"UDP Query User{A373D216-B8C6-4700-AD26-EB2DF397C3B4}C:\windows\system32\mmc.exe" = protocol=17 | dir=in | app=c:\windows\system32\mmc.exe |
"UDP Query User{A522A8B7-F94C-48FC-867A-9A3AED50F7CE}C:\program files\manycam\bin\manycam.exe" = protocol=17 | dir=in | app=c:\program files\manycam\bin\manycam.exe |
"UDP Query User{A72915B2-0D8A-47E8-8353-E7EAEB2F0685}C:\program files\easy driver pro\easy driver pro\easydriverpro.exe" = protocol=17 | dir=in | app=c:\program files\easy driver pro\easy driver pro\easydriverpro.exe |
"UDP Query User{A78471B9-346A-434C-B98A-0CE2EBA21C6A}C:\programdata\divx\symantec\syminstallstub.exe" = protocol=17 | dir=in | app=c:\programdata\divx\symantec\syminstallstub.exe |
"UDP Query User{A8BEE2E7-E500-417C-8C1A-7E0D8AFBCD6A}C:\program files\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"UDP Query User{ACFEF69B-B22E-43FE-9EA4-83D558798BE1}C:\users\erica\downloads\brothersoftdownloader_for_windows_live_messenger.exe" = protocol=17 | dir=in | app=c:\users\erica\downloads\brothersoftdownloader_for_windows_live_messenger.exe |
"UDP Query User{B4BE6788-806C-41E9-8612-D6FA2EAD4522}C:\program files\divx\symantec\symantec.exe" = protocol=17 | dir=in | app=c:\program files\divx\symantec\symantec.exe |
"UDP Query User{B55F8D94-0224-4518-9D93-F9C9C4FA2D0B}C:\program files\windows media player\setup_wm.exe" = protocol=17 | dir=in | app=c:\program files\windows media player\setup_wm.exe |
"UDP Query User{B6A336A8-D14B-4AE0-AA55-38CBBCD89B3A}C:\windows\system32\adobe\shockwave 11\gt.exe" = protocol=17 | dir=in | app=c:\windows\system32\adobe\shockwave 11\gt.exe |
"UDP Query User{B79B83DB-F22F-4834-9B04-1962CACC360C}C:\users\erica\appdata\local\temp\pageragesetup-14c0.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\pageragesetup-14c0.exe |
"UDP Query User{BB90AA2D-0553-4693-8923-CBD47A0DA8EF}C:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe" = protocol=17 | dir=in | app=c:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe |
"UDP Query User{BBF17F9D-0AF3-4ED6-9B5F-1799CAB38947}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{BC597CDD-57E4-4CF3-8D69-D0C7D1E3A189}C:\users\erica\appdata\local\temp\mia1b0f.tmp\bearshare_v10_en_setup.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\mia1b0f.tmp\bearshare_v10_en_setup.exe |
"UDP Query User{BDF7F9FD-11AE-404B-A749-81504D7220F4}C:\program files\mirandafusion\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\mirandafusion\miranda32.exe |
"UDP Query User{C0A27580-5071-4D11-BE5E-98150E60F546}C:\program files\divx\divx plus web player\ddmservice.exe" = protocol=17 | dir=in | app=c:\program files\divx\divx plus web player\ddmservice.exe |
"UDP Query User{C1AAB6E2-9B5F-4E74-8448-D0CA944D6B84}C:\program files\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\miranda im\miranda32.exe |
"UDP Query User{C6A192A0-EA01-453D-947A-70E0F4EF53B5}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe |
"UDP Query User{C70BE35C-25DB-4481-98F7-AF7282401403}C:\users\erica\appdata\local\temp\wzse0.tmp\s_install.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\wzse0.tmp\s_install.exe |
"UDP Query User{C994A99B-8DBC-45DA-9EE7-5A8FB48C9FFC}C:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe" = protocol=17 | dir=in | app=c:\program files\dvdvideosoft\free youtube to mp3 converter\freeyoutubetomp3converter.exe |
"UDP Query User{CA94B309-77DA-4AC2-B489-C32D9A83C90C}C:\program files\norton security scan\engine\2.7.6.3\nss.exe" = protocol=17 | dir=in | app=c:\program files\norton security scan\engine\2.7.6.3\nss.exe |
"UDP Query User{CB35E40B-DB0F-48E4-951E-61FEE701753F}C:\windows\system32\wermgr.exe" = protocol=17 | dir=in | app=c:\windows\system32\wermgr.exe |
"UDP Query User{D5A71EB3-555B-4123-B3DA-26A3C4ABAFAD}C:\program files\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"UDP Query User{D7283906-0826-41E0-93BD-EFF9F6C9375E}C:\users\erica\appdata\local\temp\pageragetoolbar.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\pageragetoolbar.exe |
"UDP Query User{D732C577-333F-4E1E-BF24-F8D6885AF1C0}C:\program files\divx\divx plus player\divx plus player.exe" = protocol=17 | dir=in | app=c:\program files\divx\divx plus player\divx plus player.exe |
"UDP Query User{D9003560-245A-4F49-A0A5-875607D7B191}C:\windows\system32\macromed\flash\flashutil11c_plugin.exe" = protocol=17 | dir=in | app=c:\windows\system32\macromed\flash\flashutil11c_plugin.exe |
"UDP Query User{DA498DA6-544B-4A7E-A70D-96E8F6C27BC8}C:\windows\system32\msiexec.exe" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"UDP Query User{DB4F92B5-54E9-43E7-9C7C-B8023A4F2320}C:\windows\system32\werfault.exe" = protocol=17 | dir=in | app=c:\windows\system32\werfault.exe |
"UDP Query User{DC358E9F-4641-494F-9EF6-1A643C63A187}C:\windows\helppane.exe" = protocol=17 | dir=in | app=c:\windows\helppane.exe |
"UDP Query User{DC755D39-F8FD-4140-BA72-8CC07054D5E8}C:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe" = protocol=17 | dir=in | app=c:\program files\packard bell\carbonite\carbonitesetuplitepbpreinstaller.exe |
"UDP Query User{DD5DB8AD-0157-43B1-8A54-6B6C427E8186}C:\program files\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"UDP Query User{DFECE73D-5108-4497-AFA6-69D708B5B565}C:\program files\norton security scan\engine\3.5.1.8\nss.exe" = protocol=17 | dir=in | app=c:\program files\norton security scan\engine\3.5.1.8\nss.exe |
"UDP Query User{E0B879E6-FAC1-448F-90C1-EA1C68C12299}C:\program files\avira\antivir desktop\setup.exe" = protocol=17 | dir=in | app=c:\program files\avira\antivir desktop\setup.exe |
"UDP Query User{E5F16B5C-66F4-4F18-8B65-1F5BB1A1565B}C:\program files\avira\antivir desktop\avnotify.exe" = protocol=17 | dir=in | app=c:\program files\avira\antivir desktop\avnotify.exe |
"UDP Query User{E8E35F8C-4148-4675-8EC0-10DA7AA0EF9B}C:\windows\system32\macromed\flash\flashutil10s_plugin.exe" = protocol=17 | dir=in | app=c:\windows\system32\macromed\flash\flashutil10s_plugin.exe |
"UDP Query User{E9B496CA-CA23-49B3-BAB6-6D564B094D4B}C:\program files\ask.com\updater\updater.exe" = protocol=17 | dir=in | app=c:\program files\ask.com\updater\updater.exe |
"UDP Query User{EAA8CB1F-DAF2-4922-B8F2-5C1F69B708DE}C:\users\erica\appdata\local\temp\divxsetup.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\divxsetup.exe |
"UDP Query User{EC4B9362-DBA9-4409-B281-241919C4D58D}C:\program files\common files\adobe\updater5\adobeupdater.exe" = protocol=17 | dir=in | app=c:\program files\common files\adobe\updater5\adobeupdater.exe |
"UDP Query User{EF5369E4-788D-412C-85E6-652E6AA484B7}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{F0835FC2-57C7-457A-B828-47355BDA9FC2}C:\program files\ask.com\updatetask.exe" = protocol=17 | dir=in | app=c:\program files\ask.com\updatetask.exe |
"UDP Query User{F478A25F-9465-4FB2-A960-87F3D67455CF}C:\users\erica\appdata\local\temp\__28072011130734\setup.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\__28072011130734\setup.exe |
"UDP Query User{F99093E7-85E6-460D-BF8C-014205007818}C:\windows\system32\wercon.exe" = protocol=17 | dir=in | app=c:\windows\system32\wercon.exe |
"UDP Query User{FA280EEE-AEB5-42B4-AC97-B1F5F70C862B}C:\program files\ask.com\taskscheduler.exe" = protocol=17 | dir=in | app=c:\program files\ask.com\taskscheduler.exe |
"UDP Query User{FE57EE25-09E7-4A16-A26C-64F612594070}C:\users\erica\appdata\local\temp\nsn9916.tmp\apnstub.exe" = protocol=17 | dir=in | app=c:\users\erica\appdata\local\temp\nsn9916.tmp\apnstub.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.5600
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05BACCCD-A20A-B42D-94FD-97E58A7E82EF}" = ccc-utility
"{0E33EC53-22CE-426C-A88B-2AAC231BAC85}" = Catalyst Control Center - Branding
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F4748E6-E093-FA89-7999-737F48C4767F}" = Catalyst Control Center InstallProxy
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}" = Firebird SQL Server - MAGIX Edition
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{624E54D0-E4F4-434F-9EF6-D4D066EE4348}" = Facebook Video Calling 1.1.1.1
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Search-Results Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A180ABF7-A88F-FEB2-E94D-ED459821B86B}" = AMD Catalyst Install Manager
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A79024ED-1969-334A-1ED6-16753F9DE377}" = CCC Help English
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600813}" = MSN Messenger 7.0
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{AFD36BF1-DA28-4702-A83F-C49D03199A0F}" = Broadcom 802.11n Network Adapter
"{C57C21C0-CE1B-26D5-1215-B26862051F6F}" = Catalyst Pro Control Center
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C86CB1B1-4BD0-7BFB-88CF-76762C8CE1D3}" = Catalyst Control Center Graphics Previews Common
"{CD05F1BC-FC63-1E93-4094-82BC33662E76}" = Catalyst Control Center Localization All
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D359B12F-9B1A-46FD-B70C-F507B5B11590}" = HDRegDE
"{E6DB139F-DE64-4F3A-AFBD-5ABF7E434F12}" = AMD USB Audio Driver Filter
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EABCA81A-E96B-6163-CF2B-1A7DF959BEB4}" = Catalyst Control Center InstallProxy
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FCED9B62-34FF-4C15-8A23-F65221F7874D}" = ITECIR Driver
"0B63C37025C2F467B0BAF5BC9C10E853F201C510" = Windows-Treiberpaket - ITE Tech.Inc. (itecir) HIDClass  (10/03/2007 5.0.0004.5)
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AdobeReader" = Adobe Reader 8
"AUDIO" = AUDIO DRIVER V6.0.1.5653
"BearShare 2 MediaBar" = MediaBar
"BrotherSoft_Extreme Toolbar" = BrotherSoft Extreme Toolbar
"Carbonite" = Carbonite
"Carbonite Setup Lite" = Sichern Sie Ihre Daten
"CARDREADER" = cardreader Driver V1.0.10.4
"CIR" = ITECIR Infrared Receiver V5.0.4.5
"conduitEngine" = Conduit Engine
"DivX Setup" = DivX-Setup
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"facetheme" = Facetheme
"Flatcast_is1" = Flatcast Viewer Plugin 5.2.2.454
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.815
"Google Chrome" = Google Chrome
"ICQToolbar" = ICQ Toolbar
"ImageWriter" = Packard Bell ImageWriter
"Infocentre" = Infocentre Rev. 2.0.0.1
"LAN" = Realtek RTL8102 Driver V6.203.214.2008
"LCDTest" = Packard Bell LCD Test
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6 6.0.19.0 (D)
"ManyCam" = ManyCam 2.6.43 (remove only)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Miranda IM" = Miranda IM 0.9.29
"MirandaFusion" = Miranda Fusion 3.1.3.0
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"NSS" = Norton Security Scan
"PhotoScape" = PhotoScape
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"Registry Mechanic_is1" = PC Tools Registry Mechanic 11.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"toolplugin" = toolplugin
"TOUCHPAD" = TOUCHPAD DRIVER V10.0.1.0
"Updator" = Packard Bell Updator
"VGA" = VGA DRIVERS V8.479
"X10Hardware" = X10 Hardware(TM)
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 14.01.2012 22:00:28 | Computer Name = Erica-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wuauclt.exe, Version 7.4.7600.226, Zeitstempel
 0x4a7b870b, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00404968,  Prozess-ID 0x4fc, Anwendungsstartzeit
 01ccd329741513c0.
 
Error - 14.01.2012 22:13:05 | Computer Name = Erica-PC | Source = Google Update | ID = 20
Description =
 
Error - 15.01.2012 22:01:08 | Computer Name = Erica-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wuauclt.exe, Version 7.4.7600.226, Zeitstempel
 0x4a7b870b, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00404968,  Prozess-ID 0xe68, Anwendungsstartzeit
 01ccd3f2b5aa1230.
 
Error - 15.01.2012 22:13:05 | Computer Name = Erica-PC | Source = Google Update | ID = 20
Description =
 
Error - 16.01.2012 01:13:05 | Computer Name = Erica-PC | Source = Google Update | ID = 20
Description =
 
Error - 16.01.2012 04:13:05 | Computer Name = Erica-PC | Source = Google Update | ID = 20
Description =
 
Error - 16.01.2012 22:00:29 | Computer Name = Erica-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wuauclt.exe, Version 7.4.7600.226, Zeitstempel
 0x4a7b870b, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00404968,  Prozess-ID 0x95c, Anwendungsstartzeit
 01ccd4bbc9b384e0.
 
Error - 16.01.2012 22:13:05 | Computer Name = Erica-PC | Source = Google Update | ID = 20
Description =
 
Error - 17.01.2012 22:01:06 | Computer Name = Erica-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wuauclt.exe, Version 7.4.7600.226, Zeitstempel
 0x4a7b870b, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00404968,  Prozess-ID 0xee0, Anwendungsstartzeit
 01ccd58509bf2430.
 
Error - 17.01.2012 22:13:06 | Computer Name = Erica-PC | Source = Google Update | ID = 20
Description =
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---

markusg 08.02.2012 13:46
hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [ffdwnd] C:\Users\Erica\AppData\Local\Mozilla\Firefox\firefox.exe ()
 :Files
C:\Users\Erica\AppData\Local\Mozilla\Firefox\firefox.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Snow_White 08.02.2012 14:33
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ffdwnd deleted successfully.
C:\Users\Erica\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Erica
->Flash cache emptied: 156258 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Default User

User: Erica
->Temp folder emptied: 1254358535 bytes
->Temporary Internet Files folder emptied: 167888261 bytes
->FireFox cache emptied: 877329641 bytes
->Google Chrome cache emptied: 30397845 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 22016 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 131423476 bytes
RecycleBin emptied: 1111616080 bytes

Total Files Cleaned = 3.408,00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 02082012_142655

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Snow_White 08.02.2012 14:37
Das ding is endlich weg :) Vielen Dank für deine Hilfe ...LG :)

markusg 08.02.2012 14:58
danke für den upload.
bei dem schlecht gewartetem system wird das nicht lange so bleiben, befor wir weiter reinigen können:
servicepack 2 laden und instalieren:
http://www.chip.de/downloads/Windows..._33360511.html
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:51 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131