Trojaner-Board - GVU - Trojaner entfernen - ähnlich wie 2.04 nur mit Webcamfenster !

Hallo

Auch ich hab den GVU - Trojaner eingefangen und werde Ihn nicht los.
Er sieht aus wie Version 2.04 nur leicht abgewandelt mit Webcamfenster.
Er taucht aber nur auf und sperrt den Rechner, wenn ich mit dem Internet verbunden bin. Sonst läuft mein Rechner, bis auf den Taskmanager.
Demzufolge kann ich auch leider keine Aktualisierungen vom Mailware, Avira, ect. runterladen.

Kaspersky rescue disc/unlocker habe ich angewandt......
Systemwiederherstellung funktioniert auch nicht......
sämtliche Virenprogramme haben nichts gefunden.....

Was kann ich tun.... Hilfe!!!!!! Will keine Neuinstallation des Systems machen.
Wenn ich eine Sicherung des Systems anlege, ist der Trojaner mit dabei?

Vielen Dank im Voraus.

Christian!!!!

:balla:

Zitat:

Zitat von cypcom (Beitrag 857090)

Habe auch die OTL logs:OTL Logfile:

Code:

OTL logfile created on: 04.07.2012 10:58:57 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\cypcom\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 0,56 Gb Available Physical Memory | 27,80% Memory free

4,00 Gb Paging File | 2,42 Gb Available in Paging File | 60,52% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39,06 Gb Total Space | 1,57 Gb Free Space | 4,01% Space Free | Partition Type: NTFS

Drive E: | 78,13 Gb Total Space | 46,38 Gb Free Space | 59,36% Space Free | Partition Type: NTFS

Drive F: | 180,89 Gb Total Space | 59,65 Gb Free Space | 32,98% Space Free | Partition Type: NTFS

Drive H: | 465,76 Gb Total Space | 349,52 Gb Free Space | 75,04% Space Free | Partition Type: NTFS

 

Computer Name: CYPCOM-PC | User Name: cypcom | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.04 10:57:33 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\cypcom\Desktop\OTL.exe

PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.03.18 13:26:55 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012.02.24 10:36:06 | 002,659,768 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Security\pctsGui.exe

PRC - [2012.02.24 10:36:06 | 001,117,624 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Security\pctsSvc.exe

PRC - [2012.02.24 09:16:12 | 000,402,336 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Security\pctsAuxs.exe

PRC - [2012.01.03 17:31:34 | 001,391,272 | ---- | M] (Ask) -- C:\Program Files\Ask.com\Updater\Updater.exe

PRC - [2011.12.18 22:08:42 | 002,420,616 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe

PRC - [2011.12.18 22:04:24 | 000,073,360 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe

PRC - [2011.11.21 16:12:58 | 000,745,280 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

PRC - [2011.11.21 16:11:58 | 001,052,480 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

PRC - [2011.11.03 16:44:32 | 000,009,344 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWUPDE.exe

PRC - [2011.11.03 16:44:28 | 000,497,280 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

PRC - [2011.11.03 16:44:24 | 000,738,944 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

PRC - [2011.07.16 06:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.12.08 07:28:06 | 000,579,384 | ---- | M] (Autodesk, Inc.) -- E:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe

PRC - [2010.03.25 14:39:22 | 000,490,280 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.07.03 08:07:51 | 000,179,872 | ---- | M] () -- C:\Users\cypcom\AppData\Local\Temp\0_0u_l.exe

MOD - [2012.03.18 13:26:55 | 001,014,744 | ---- | M] () -- C:\Program Files\Mozilla Firefox\js3250.dll

MOD - [2011.08.05 17:38:08 | 006,271,136 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll

MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.02.24 10:36:06 | 001,117,624 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\PC Tools Security\pctsSvc.exe -- (sdCoreService)

SRV - [2012.02.24 09:16:12 | 000,402,336 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\PC Tools Security\pctsAuxs.exe -- (sdAuxService)

SRV - [2012.01.22 18:44:38 | 000,435,008 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)

SRV - [2011.12.18 22:08:42 | 002,420,616 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)

SRV - [2011.12.13 21:17:41 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.12.05 19:50:05 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.11.21 16:11:58 | 001,052,480 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)

SRV - [2011.11.21 16:10:04 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)

SRV - [2011.11.03 16:44:28 | 000,497,280 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)

SRV - [2010.12.08 07:28:06 | 000,579,384 | ---- | M] (Autodesk, Inc.) [Auto | Running] -- E:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe -- (mitsijm2012)

SRV - [2010.08.13 09:13:32 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)

SRV - [2010.03.25 14:39:22 | 000,490,280 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\cypcom\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012.02.24 10:36:44 | 000,185,560 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\PCTSD.sys -- (PCTSD)

DRV - [2011.12.13 14:42:09 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2011.12.01 16:07:06 | 000,909,728 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\Windows\System32\drivers\pctEFA.sys -- (pctEFA)

DRV - [2011.12.01 16:07:06 | 000,342,168 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pctDS.sys -- (pctDS)

DRV - [2011.11.14 15:12:26 | 000,331,880 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PCTCore.sys -- (PCTCore)

DRV - [2011.11.03 16:44:20 | 000,027,016 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)

DRV - [2011.05.07 18:51:28 | 000,455,256 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.02.24 14:41:50 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)

DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2009.07.14 00:02:53 | 000,044,032 | ---- | M] (VIA Technologies, Inc.              ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fetnd6.sys -- (FETNDIS)

DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.01.19 05:55:22 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\irsir.sys -- (irsir)

DRV - [2008.01.09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook:  - No CLSID value found

IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found

IE - HKLM\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\prxtbZone.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=14672

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8C 88 7D 9A F8 44 CB 01  [binary data]

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - No CLSID value found

IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\prxtbZone.dll (Conduit Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\..\SearchScopes\{87D71D33-DA12-4C86-92C9-F8F78D43B5A2}: "URL" = hxxp://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com Search"

FF - prefs.js..browser.search.defaultenginename: "Ask.com Search"

FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Ask.com Search"

FF - prefs.js..browser.search.selectedEngine: "Ask.com Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.90

FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0

FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:3.8.1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31

FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - prefs.js..network.proxy.type: 0

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012.03.10 14:48:31 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.18 13:26:56 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.18 13:26:56 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\cypcom\AppData\Roaming\5064 [2011.12.22 19:44:11 | 000,000,000 | ---D | M]

 

[2010.08.26 10:41:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\cypcom\AppData\Roaming\mozilla\Extensions

[2012.06.25 19:46:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\cypcom\AppData\Roaming\mozilla\Firefox\Profiles\19k0qzv3.default\extensions

[2010.08.29 10:15:25 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\cypcom\AppData\Roaming\mozilla\Firefox\Profiles\19k0qzv3.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

[2011.12.22 19:57:18 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Users\cypcom\AppData\Roaming\mozilla\Firefox\Profiles\19k0qzv3.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}

[2012.02.16 09:58:47 | 000,002,401 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\askcom.xml

[2012.04.14 09:43:35 | 000,002,306 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\askcomsearch.xml

[2010.03.24 17:13:02 | 000,000,917 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\conduit.xml

[2012.06.25 19:46:32 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-1.xml

[2011.03.31 07:41:28 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-2.xml

[2011.04.10 20:11:04 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-3.xml

[2011.05.04 08:05:37 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-4.xml

[2011.06.09 14:02:37 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-5.xml

[2011.08.21 18:39:13 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-6.xml

[2011.12.16 09:22:09 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-7.xml

[2011.12.22 20:06:10 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-8.xml

[2012.02.16 09:58:44 | 000,000,950 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin-9.xml

[2010.11.06 16:24:00 | 000,001,056 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Mozilla\Firefox\Profiles\19k0qzv3.default\searchplugins\icqplugin.xml

[2012.06.23 11:26:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2012.04.14 09:43:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

[2011.12.22 19:44:11 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\CYPCOM\APPDATA\ROAMING\5064

[2012.04.14 09:42:47 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.03.17 12:07:47 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.03.17 12:07:47 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.03.17 12:07:47 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.03.17 12:07:47 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.03.17 12:07:47 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.06.07 20:56:15 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\prxtbZone.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\prxtbZone.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm-Sicherheit Toolbar) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - C:\Program Files\ZoneAlarm-Sicherheit\prxtbZone.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools)

O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\cypcom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{003234EA-67CE-427D-9101-38A315BA761B}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GRA32A~1.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2011.12.05 19:11:25 | 000,000,000 | ---D | M] - E:\Autodesk -- [ NTFS ]

O32 - AutoRun File - [2011.12.05 18:13:08 | 2147,483,648 | ---- | M] () - E:\Autodesk_Inventor_2012_German_MLD_Win_32bit.part1.exe -- [ NTFS ]

O32 - Unable to obtain root file information for disk E:\

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.04 10:57:26 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\cypcom\Desktop\OTL.exe

[2012.07.04 09:11:23 | 000,909,728 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctEFA.sys

[2012.07.04 09:11:23 | 000,342,168 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctDS.sys

[2012.07.04 09:11:22 | 000,253,352 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys

[2012.07.04 09:11:22 | 000,107,864 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys

[2012.07.04 09:11:18 | 000,331,880 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys

[2012.07.04 09:11:18 | 000,162,584 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys

[2012.07.04 09:11:16 | 000,185,560 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys

[2012.07.04 09:11:16 | 000,017,848 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctBTFix.sys

[2012.07.04 09:11:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security

[2012.07.04 09:11:11 | 000,070,536 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys

[2012.07.04 09:11:01 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools

[2012.07.04 09:11:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools

[2012.07.04 09:11:00 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP

[2012.07.04 09:11:00 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools Security

[2012.07.04 09:00:21 | 000,000,000 | ---D | C] -- C:\Users\cypcom\AppData\Roaming\GetRightToGo

[2012.07.04 00:41:02 | 000,000,000 | -HSD | C] -- C:\found.001

[2012.07.03 23:33:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\%LOCALAPPDATA%

[2012.07.03 21:34:25 | 000,000,000 | -HSD | C] -- C:\found.000

[2012.07.03 21:15:28 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2012.06.19 17:35:38 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll

[2012.06.19 17:35:38 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll

[2012.06.19 17:35:20 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll

[2012.06.19 17:35:20 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll

[2012.06.19 17:35:20 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll

[2012.06.19 17:35:09 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll

[2012.06.19 17:35:09 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe

[2012.06.14 07:19:58 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012.06.14 07:19:57 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012.06.14 07:19:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012.06.14 07:19:57 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012.06.14 07:19:56 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2012.06.14 07:19:56 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012.06.14 07:19:55 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012.06.14 07:09:08 | 002,342,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2012.06.14 07:09:06 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll

[2012.06.14 07:09:06 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll

[2012.06.14 07:09:06 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.04 10:57:33 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\cypcom\Desktop\OTL.exe

[2012.07.04 10:45:32 | 000,024,064 | ---- | M] (Gerhard Schlager) -- C:\Windows\System32\ctfmon.exe

[2012.07.04 10:36:05 | 000,001,889 | ---- | M] () -- C:\Users\cypcom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

[2012.07.04 10:21:53 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.04 10:21:53 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.04 10:16:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.04 09:21:29 | 261,978,750 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.07.04 09:12:55 | 004,503,728 | ---- | M] () -- C:\ProgramData\l_u0_0.pad

[2012.07.04 09:12:03 | 001,486,903 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB

[2012.07.04 09:11:16 | 000,002,078 | ---- | M] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor with AntiVirus.lnk

[2012.07.03 21:35:12 | 000,003,224 | ---- | M] () -- C:\bootsqm.dat

[2012.07.03 18:20:38 | 000,002,076 | ---- | M] () -- C:\Users\cypcom\Desktop\Entfernen des Avira DE-Cleaners.lnk

[2012.07.03 18:20:38 | 000,002,005 | ---- | M] () -- C:\Users\cypcom\Desktop\Avira DE-Cleaner.lnk

[2012.06.14 10:35:37 | 000,556,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.06.14 07:24:24 | 000,696,620 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.06.14 07:24:24 | 000,651,938 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.06.14 07:24:24 | 000,147,916 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.06.14 07:24:24 | 000,120,870 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.07.04 09:11:24 | 001,486,903 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB

[2012.07.04 09:11:16 | 000,002,078 | ---- | C] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor with AntiVirus.lnk

[2012.07.03 23:43:30 | 261,978,750 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2012.07.03 21:35:12 | 000,003,224 | ---- | C] () -- C:\bootsqm.dat

[2012.07.03 18:19:56 | 000,002,076 | ---- | C] () -- C:\Users\cypcom\Desktop\Entfernen des Avira DE-Cleaners.lnk

[2012.07.03 18:19:56 | 000,002,005 | ---- | C] () -- C:\Users\cypcom\Desktop\Avira DE-Cleaner.lnk

[2012.07.03 08:07:52 | 004,503,728 | ---- | C] () -- C:\ProgramData\l_u0_0.pad

[2012.07.03 08:07:52 | 000,001,889 | ---- | C] () -- C:\Users\cypcom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

[2011.06.07 20:47:09 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe

[2011.06.07 20:47:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2011.06.07 20:47:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2011.06.07 20:47:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2011.06.07 20:47:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2011.03.07 20:39:38 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE

[2011.01.12 16:11:16 | 000,007,602 | ---- | C] () -- C:\Users\cypcom\AppData\Local\Resmon.ResmonCfg

[2010.11.02 09:49:23 | 000,000,092 | ---- | C] () -- C:\Windows\lexstat.ini

[2010.09.07 09:11:27 | 000,031,744 | ---- | C] () -- C:\Users\cypcom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

 
 ========== LOP Check ==========

 

[2011.12.08 17:48:05 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\5053

[2011.12.13 14:26:30 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\5056

[2011.12.22 19:44:11 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\5064

[2011.03.11 15:58:17 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\Abelssoft

[2012.03.18 13:29:09 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\Autodesk

[2010.08.26 10:47:28 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\CheckPoint

[2011.12.13 15:07:54 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\DAEMON Tools Lite

[2011.08.19 07:36:44 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\DVDVideoSoft

[2011.04.04 18:07:02 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.09.16 18:14:10 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\fotobuch.de AG

[2012.07.04 09:01:45 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\GetRightToGo

[2012.02.18 01:10:30 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\ICQ

[2010.08.28 21:40:56 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\IrfanView

[2011.12.13 14:43:00 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\OpenCandy

[2010.11.12 13:28:33 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\OpenOffice.org

[2010.11.04 09:56:57 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\The Creative Assembly

[2010.10.17 14:56:45 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\TuneUp Software

[2012.06.19 10:26:28 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\TuneUpMedia

[2012.05.07 18:02:57 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\wargaming.net

[2011.12.28 10:28:11 | 000,000,000 | ---D | M] -- C:\Users\cypcom\AppData\Roaming\xmldm

[2012.02.01 22:41:32 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 189 bytes -> C:\ProgramData\TEMP:DFC5A2B2

@Alternate Data Stream - 186 bytes -> C:\ProgramData\TEMP:DFC5A2B2
 

< End of report >

--- --- ---

Extras:OTL Logfile:

Code:

OTL Extras logfile created on: 04.07.2012 10:58:57 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\cypcom\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 0,56 Gb Available Physical Memory | 27,80% Memory free

4,00 Gb Paging File | 2,42 Gb Available in Paging File | 60,52% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39,06 Gb Total Space | 1,57 Gb Free Space | 4,01% Space Free | Partition Type: NTFS

Drive E: | 78,13 Gb Total Space | 46,38 Gb Free Space | 59,36% Space Free | Partition Type: NTFS

Drive F: | 180,89 Gb Total Space | 59,65 Gb Free Space | 32,98% Space Free | Partition Type: NTFS

Drive H: | 465,76 Gb Total Space | 349,52 Gb Free Space | 75,04% Space Free | Partition Type: NTFS

 

Computer Name: CYPCOM-PC | User Name: cypcom | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"E:\Programme\fotobuch.de\Designer 2.0\Designer.exe" = E:\Programme\fotobuch.de\Designer 2.0\Designer.exe:*:Designer.exe -- ()

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{03BA8737-C157-48A9-BEA7-EE1B0E626D3B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{0E4E4684-2923-42B6-91F7-13EB0F8B5DF9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{10CED6D1-1D55-45FB-B76F-8155DF8020B1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{1B3AEE9D-1956-446E-BA53-AC5A2ADAA09B}" = lport=445 | protocol=6 | dir=in | app=system | 

"{1BE24E1B-1527-40A9-B453-893970A7461E}" = rport=138 | protocol=17 | dir=out | app=system | 

"{20F7253D-680D-47D1-90EF-0F74D1D98C35}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{309A19D1-6BA1-4985-A543-50F9DC85C599}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{56EBB56E-59FF-4845-A075-CB37536878F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{57AFAF5D-7B2C-4CF7-85AB-8775E8B0DF20}" = rport=445 | protocol=6 | dir=out | app=system | 

"{71091A32-D805-4432-B294-AB972D224B22}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 

"{904A026F-9D89-4B33-9866-481379A94259}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{918C9B42-C0ED-414F-AE95-9AD457DA033C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A18754B8-1B20-40EC-BE5A-04C70E7F0080}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{AA685A09-C0C5-4478-A0BB-184892EEE713}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{B3D4FF1A-3B9C-4DB8-B9DA-6DBFB58ADC9A}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{C1766BB9-A437-4787-BC16-6ACACECCC465}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{CA38E110-D7F4-4C50-B8F2-69D98E31B20E}" = rport=139 | protocol=6 | dir=out | app=system | 

"{CFED337A-4C3C-4CEE-8ACD-081FB3F2A998}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D5D09C14-CD1B-4F66-B73C-03E3A40A6D1E}" = lport=139 | protocol=6 | dir=in | app=system | 

"{E4655C96-7CD8-4534-A122-F191FA4E9F43}" = lport=137 | protocol=17 | dir=in | app=system | 

"{E7C32DE0-0B66-4920-8292-1E1AA9EC7C99}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{EC106B03-C267-4EBC-990B-3DBDA8DEA96B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{EF102D1F-22B3-4F9A-8A05-12542709FEF2}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0701E47A-CAE5-4646-B0B0-58342F4C2CAF}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{0ED32FC2-53B3-40AB-AE22-DE976C71D70C}" = protocol=6 | dir=in | app=f:\gta4\grand theft auto iv\launchgtaiv.exe | 

"{1B7AF3AE-9843-462E-9318-6C1EC588663A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{1F494CD1-CCE9-48FE-96DD-146FBBAED1F4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{23C7E776-BFC1-436B-AF95-6F181188A980}" = protocol=6 | dir=in | app=f:\steam\steam.exe | 

"{2FF371FD-B191-4676-BC0B-E18EA43C2F1D}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{317CEF3E-BC82-4172-BF46-85421FF807ED}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{32DDB4AA-A22E-48E5-B1A2-DA635857598D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{3E2AAEBE-CEB6-4412-9737-6482C4258F57}" = protocol=6 | dir=in | app=f:\steam\steamapps\common\mafia ii\pc\mafia2.exe | 

"{3ECC7EE4-A4A9-455A-8B4D-3BCAF0C9324C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{41406465-7146-40B1-9146-9606E17BD6FC}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{4570D18A-24C7-493E-9F3B-D460B990F71E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{56FE7AB2-25F2-4958-B9C9-E2853BDAE0A5}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{5CDC9BC3-521B-428B-A13E-30E3B43E1CEB}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{68A62095-744D-4457-9A8F-155544EED93D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{68BBB8E0-5DB9-4FD1-915C-12B4F60CD3AC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{6A4B3359-D176-4C4C-B25C-38309C001302}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{7732F850-CEC4-4A20-AD80-E853FA82B8C2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{79802B92-36DE-473B-A2B0-BD8514007CFA}" = protocol=6 | dir=in | app=f:\steam\steamapps\common\empire total war\empire.exe | 

"{7CF6C33C-5964-478F-B0BC-5EA28A2962A2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{8685FB0B-BBAE-4D78-9205-5031738A24E8}" = protocol=17 | dir=in | app=f:\steam\steamapps\common\mafia ii\pc\mafia2.exe | 

"{90650A39-91D4-47CF-980F-0421253D6233}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{A6BE0CAC-C2E0-43A6-BB30-B56FC077D703}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{B0ADE907-20B1-4ABC-B2B1-E3AC43C056DA}" = protocol=17 | dir=in | app=f:\steam\steamapps\common\empire total war\empire.exe | 

"{C64F5224-3051-48EC-BAB8-9CA8F6FBA8FD}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{CA87621D-98E6-47F1-BA0D-7B3B27192302}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{CBCAE029-4CFF-4029-B456-1AF72C451A9D}" = protocol=6 | dir=out | app=system | 

"{CBEED19C-9FCE-444E-A2AA-3EDB82F7A2B0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{D4CD28BF-E19E-44E7-AA28-0A73F36B0CFE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 

"{D5D50D3D-E6A7-4960-A18C-0E4065B3E2E6}" = protocol=17 | dir=in | app=f:\steam\steam.exe | 

"{D6761CC1-65C3-4743-9061-2A566FF77C2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{D816A47E-02D8-4E1F-AB24-61C2133A71D3}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{EC278E89-3169-48D6-9838-603AA64EB921}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{F3CE2DC9-7DF6-4ECA-9207-4FC663D82F6E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 

"{F7028A52-28BD-4633-9E6C-BD7B4E7C0E9C}" = protocol=17 | dir=in | app=f:\gta4\grand theft auto iv\launchgtaiv.exe | 

"{FC626772-BA39-41C7-92ED-B4110CFE488A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{FE0F8223-805B-43E0-BBC4-FFDBB83F37DE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{FFD8553E-C47F-4F0C-ABDF-21F455967043}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"TCP Query User{3A45B709-2E10-4506-B3D2-9A1DB1DD7450}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 

"TCP Query User{48F3C65B-2BFC-4124-9F6D-C78107D168CF}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 

"UDP Query User{3B4CE659-78B0-4FFC-997C-9C3DD1EBE211}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 

"UDP Query User{711094E4-E283-4382-98B1-803CF697EC4A}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)

"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{207780D5-A515-4E79-B7C2-E4D32F8A6CA1}" = Eco Materials Adviser

"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10

"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10

"{24FF088D-CDCF-480C-8A4B-98F14A54CAA8}" = Autodesk Material Library Low Resolution Image Library 2012

"{266597A9-1632-0000-0100-DCBF2B69166B}" = Autodesk Vault 2012 (Client) German Language Pack

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10

"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)

"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)

"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support

"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4E1A54A9-FFB3-4BE6-B59B-3CC94C3B31D2}" = Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul Language Pack

"{4E3B47F2-21EB-4F20-87C8-5A0E4D5F3858}" = Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul

"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)

"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)

"{5545EEE4-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2701.01)

"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)

"{5783F2D7-A028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2012

"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV

"{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable

"{5D6C26B9-D9E7-4E77-A4DE-0C2B242E85FA}" = ZoneAlarm Firewall

"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)

"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic

"{65420DC9-306E-4371-905F-F4DC3B418E52}" = Autodesk Material Library Base Resolution Image Library 2012

"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update

"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)

"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10

"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10

"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2

"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)

"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10

"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime

"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)

"{7F4DD591-1632-0409-0000-7107D70F3DB4}" = Autodesk Inventor Professional 2012

"{7F4DD591-1632-0409-0001-7107D70F3DB4}" = Autodesk Inventor Professional 2012 Language Pack - Deutsch

"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar

"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10

"{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}" = Autodesk Material Library 2012

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)

"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10

"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10

"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)

"{A49BDCBE-590E-43A6-AB77-7C40E499B7C1}" = Autodesk Design Review 2012

"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom

"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.0 - Deutsch

"{B46DECD1-1632-4EF1-0000-22D71E81877C}" = Autodesk Inventor Content Center Libraries 2012 (Desktop Content)

"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes

"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)

"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)

"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10

"{C4BC01F3-B7E6-49FA-8FBE-6B62FDF9CED0}" = ZoneAlarm Security

"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack

"{CF526A26-1632-0000-0000-02E95019B628}" = Autodesk Vault 2012 (Client)

"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005

"{D25FF5C1-1632-469A-9794-69309387C193}" = Schnell-Deinstallations-Tool für Autodesk Inventor 2012

"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities

"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)

"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10

"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager

"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10

"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime

"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10

"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)

"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic

"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)

"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10

"{FFF5619F-6669-4EC5-A85E-9994F70A9E5D}" = Autodesk Inventor Fusion 2012

"{FFF7F80F-929E-497F-A112-B070DE816128}" = Autodesk Inventor Fusion 2012 Language Pack

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul" = Autodesk Inventor Fusion for Inventor 2012 Add-in

"Autodesk Inventor Professional 2012" = Autodesk Inventor Professional 2012 Deutsch

"Autodesk Vault 2012 (Client)" = Autodesk Vault 2012 (Client)

"Avira AntiVir Desktop" = Avira Free Antivirus

"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2

"DAEMON Tools Lite" = DAEMON Tools Lite

"Designer 2.0_is1" = Designer 2.0

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.815

"IrfanView" = IrfanView (remove only)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack

"Mozilla Firefox (3.6.28)" = Mozilla Firefox (3.6.28)

"Spyware Doctor" = PC Tools Spyware Doctor with AntiVirus 9.0

"Steam App 50130" = Mafia II

"TuneUp Utilities" = TuneUp Utilities

"TuneUpMedia" = TuneUp Companion 2.2.1

"Uninstall_is1" = Uninstall 1.0.0.1

"WinRAR archiver" = WinRAR

"ZoneAlarm Free" = ZoneAlarm Free

"ZoneAlarm Toolbar" = ZoneAlarm Toolbar

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 04.06.2012 15:01:21 | Computer Name = cypcom-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 04.06.2012 15:01:22 | Computer Name = cypcom-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.06.2012 09:27:35 | Computer Name = cypcom-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: worldoftanks.exe, Version: 0.7.2.0,

 Zeitstempel: 0x4f992546  Name des fehlerhaften Moduls: worldoftanks.exe, Version:

 0.7.2.0, Zeitstempel: 0x4f992546  Ausnahmecode: 0xc0000005  Fehleroffset: 0x008f9079

ID

 des fehlerhaften Prozesses: 0xf68  Startzeit der fehlerhaften Anwendung: 0x01cd4bbef49853bc

Pfad

 der fehlerhaften Anwendung: F:\World_of_Tanks\worldoftanks.exe  Pfad des fehlerhaften

 Moduls: F:\World_of_Tanks\worldoftanks.exe  Berichtskennung: 0824dd6d-b7b7-11e1-928f-002522392053

 

Error - 25.06.2012 13:28:25 | Computer Name = cypcom-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: worldoftanks.exe, Version: 0.7.4.0,

 Zeitstempel: 0x4fce070c  Name des fehlerhaften Moduls: worldoftanks.exe, Version:

 0.7.4.0, Zeitstempel: 0x4fce070c  Ausnahmecode: 0xc0000005  Fehleroffset: 0x002e6e48

ID

 des fehlerhaften Prozesses: 0x1d0  Startzeit der fehlerhaften Anwendung: 0x01cd52ee87d0491b

Pfad

 der fehlerhaften Anwendung: F:\World_of_Tanks\worldoftanks.exe  Pfad des fehlerhaften

 Moduls: F:\World_of_Tanks\worldoftanks.exe  Berichtskennung: 2acedb63-beeb-11e1-b8b5-002522392053

 

Error - 03.07.2012 02:21:06 | Computer Name = cypcom-PC | Source = System Restore | ID = 8210

Description = 

 

Error - 03.07.2012 12:10:26 | Computer Name = cypcom-PC | Source = System Restore | ID = 8210

Description = 

 

Error - 03.07.2012 12:14:39 | Computer Name = cypcom-PC | Source = System Restore | ID = 8210

Description = 

 

Error - 03.07.2012 12:16:19 | Computer Name = cypcom-PC | Source = System Restore | ID = 8210

Description = 

 

Error - 03.07.2012 12:19:40 | Computer Name = cypcom-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: svchost.exe_WinDefend, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: mpengine.dll, Version: 1.1.8502.0,

 Zeitstempel: 0x4fc6e84f  Ausnahmecode: 0xc000001d  Fehleroffset: 0x00158cfa  ID des fehlerhaften

 Prozesses: 0x6b4  Startzeit der fehlerhaften Anwendung: 0x01cd593775510c78  Pfad der

 fehlerhaften Anwendung: C:\Windows\System32\svchost.exe  Pfad des fehlerhaften Moduls:

 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2C58EBE9-3669-4144-B630-AB4900FB1E7D}\mpengine.dll

Berichtskennung:

 e39a4cbe-c52a-11e1-a0f6-002522392053

 

Error - 03.07.2012 12:19:40 | Computer Name = cypcom-PC | Source = Application Error | ID = 1005

Description = Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen

 werden:  Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der

 gespeicherten Datei bzw. den auf dem Computer installierten  Speichertreibern, oder

 der Datenträger fehlt.  Das Programm Hostprozess für Windows-Dienste wurde wegen 

dieses Fehlers geschlossen.    Programm: Hostprozess für Windows-Dienste  Datei:     Der Fehlerwert

 ist im Abschnitt "Zusätzliche Dateien" aufgelistet.  Benutzeraktion  1. Öffnen Sie 

die Datei erneut.  Diese Situation ist eventuell ein temporäres Problem, das selbstständig

 behoben wird, wenn das Programm erneut ausgeführt wird.  2.  Wenn Sie weiterhin nicht

 auf die Datei zugreifen können und   - diese sich im Netzwerk befindet,   dann sollte

 der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass

 eine Verbindung mit dem Server hergestellt werden kann.   - diese sich auf einem Wechseldatenträger,

 wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger

 richtig in den Computer eingelegt ist.  3. Überprüfen und reparieren Sie das Dateisystem,

 indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben

 Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK

 /F ein, und drücken Sie die EINGABETASTE.  4. Stellen Sie die Datei von einer Sicherungskopie

 wieder her, wenn das Problem weiterhin besteht.  5. Überprüfen Sie, ob andere Dateien

 auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist,

 ist der Datenträger eventuell beschädigt.   Wenden Sie sich an den Administrator 

oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, 

wenn es sich um eine Festplatte handelt.    Zusätzliche Daten  Fehlerwert: 00000000  Datenträgertyp:

 0

 

[ OSession Events ]

Error - 09.10.2011 14:04:05 | Computer Name = cypcom-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 190

 seconds with 180 seconds of active time.  This session ended with a crash.

 

Error - 09.10.2011 14:09:58 | Computer Name = cypcom-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 310

 seconds with 300 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 24.09.2011 02:44:00 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 24.09.2011 02:44:00 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler

 beendet:   %%-2140993535

 

Error - 24.09.2011 02:44:00 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 24.09.2011 03:12:30 | Computer Name = cypcom-PC | Source = PNRPSvc | ID = 102

Description = 

 

Error - 24.09.2011 03:12:30 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler

 beendet:   %%-2140993535

 

Error - 24.09.2011 03:12:30 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 24.09.2011 03:12:39 | Computer Name = cypcom-PC | Source = PNRPSvc | ID = 102

Description = 

 

Error - 24.09.2011 03:12:39 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler

 beendet:   %%-2140993535

 

Error - 24.09.2011 03:12:39 | Computer Name = cypcom-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 26.09.2011 01:59:03 | Computer Name = cypcom-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

 

< End of report >

--- --- ---