Neue Software installiert / PC sauber? - Virus Hilfe

Home » Viren, Trojaner & Malware Forum » Neue Software installiert / PC sauber? » Themenansicht

Seite(n): 1

Antworten

Neue Software installiert / PC sauber?

24.11.2013, 19:44 maravilha Member Beiträge: 32	#1 Liebe Protecus - Cracks Ich habe mir heute Software heruntergeladen (von Softonic und anderen Seiten) und wollte diese dann wieder deinstallieren. Leider ging das mit der Deinstallation nicht voll umfänglich. Ich befürchte, dass einige Dateien liegen geblieben sind. Eigentlich gegen meinen Willen wurde eine Radio Total Toolbar installiert. Die habe ich nun wieder draussen, aber eben - so glaube ich - nicht ganz. Bitte schaut euch doch meine Logs an, welche ich hier poste und sagt mir, ob ich versteckte Malware habe. Thx a lot! OTL logfile created on: 11/24/2013 7:26:48 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16428) Locale: 00000409 \| Country: Schweiz \| Language: DES \| Date Format: dd.MM.yyyy 3.99 Gb Total Physical Memory \| 2.14 Gb Available Physical Memory \| 53.67% Memory free 7.98 Gb Paging File \| 5.55 Gb Available in Paging File \| 69.55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files (x86) Drive C: \| 919.99 Gb Total Space \| 777.76 Gb Free Space \| 84.54% Space Free \| Partition Type: NTFS Drive E: \| 3.77 Gb Total Space \| 3.72 Gb Free Space \| 98.55% Space Free \| Partition Type: FAT32 Drive X: \| 919.99 Gb Total Space \| 777.76 Gb Free Space \| 84.54% Space Free \| Partition Type: FAT32 Computer Name: THARSIS \| User Name: Admin \| Logged in as Administrator. Boot Mode: Normal \| Scan Mode: Current user \| Quick Scan \| Include 64bit Scans Company Name Whitelist: On \| Skip Microsoft Files: On \| No Company Name Whitelist: On \| File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013/11/24 19:24:53 \| 000,602,112 \| ---- \| M] (OldTimer Tools) -- C:\Users\Admin\Downloads\OTL.exe PRC - [2013/10/11 07:56:41 \| 000,356,128 \| ---- \| M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe PRC - [2013/09/15 13:34:06 \| 000,059,720 \| ---- \| M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe PRC - [2013/09/14 02:38:54 \| 000,059,720 \| ---- \| M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe PRC - [2013/09/14 02:27:52 \| 000,059,720 \| ---- \| M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe PRC - [2013/05/10 08:57:22 \| 000,065,640 \| ---- \| M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013/04/30 15:45:52 \| 004,143,360 \| ---- \| M] (Secomba GmbH) -- C:\Program Files (x86)\BoxCryptor\BoxCryptor.exe PRC - [2013/03/14 21:07:46 \| 000,383,264 \| ---- \| M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2013/02/19 10:53:08 \| 000,162,856 \| ---- \| M] (Geek Software GmbH) -- C:\Program Files (x86)\PDF24\pdf24.exe PRC - [2013/01/04 11:46:00 \| 002,587,576 \| ---- \| M] (FSPro Labs) -- C:\Program Files\My Lockbox\mylbx.exe PRC - [2012/09/12 23:38:44 \| 000,204,136 \| ---- \| M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe PRC - [2012/03/28 01:28:44 \| 000,735,168 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE PRC - [2012/03/28 01:27:06 \| 000,309,184 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe PRC - [2012/03/28 01:10:02 \| 000,075,712 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\ssonsvr.exe PRC - [2011/10/15 12:08:56 \| 003,246,040 \| ---- \| M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe PRC - [2011/09/22 21:20:44 \| 005,587,832 \| ---- \| M] (Acronis) -- C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe PRC - [2011/09/22 15:00:52 \| 002,571,032 \| ---- \| M] (Acronis) -- C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe PRC - [2011/08/19 09:26:50 \| 000,450,848 \| ---- \| M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe PRC - [2011/01/31 11:16:40 \| 000,703,360 \| ---- \| M] (Nokia) -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe PRC - [2011/01/10 15:24:20 \| 000,993,848 \| ---- \| M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe PRC - [2011/01/10 15:24:20 \| 000,399,416 \| ---- \| M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe PRC - [2011/01/10 15:24:20 \| 000,291,896 \| ---- \| M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe PRC - [2010/12/23 11:41:36 \| 003,304,768 \| ---- \| M] (devolo AG) -- C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe PRC - [2010/12/08 14:31:06 \| 000,628,736 \| ---- \| M] (Nokia) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe PRC - [2010/12/06 06:55:34 \| 000,391,240 \| ---- \| M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe PRC - [2010/11/23 17:49:24 \| 001,540,096 \| ---- \| M] (Nokia) -- C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe PRC - [2010/11/15 13:41:18 \| 000,367,496 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\nokiaaserver.exe PRC - [2010/05/11 10:16:34 \| 000,140,288 \| ---- \| M] (Nokia) -- C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe PRC - [2009/10/27 09:15:02 \| 000,120,832 \| ---- \| M] (Nokia) -- C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe PRC - [2009/10/21 21:12:50 \| 000,106,496 \| ---- \| M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2009/10/02 22:26:12 \| 000,013,336 \| ---- \| M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2009/10/02 22:26:10 \| 000,284,696 \| ---- \| M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2009/07/14 21:53:00 \| 000,185,632 \| ---- \| M] (Ralink Technology, Corp.) -- C:\Program Files (x86)\ZyXEL\NWD2105\Common\RaRegistry.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2013/11/14 12:29:31 \| 000,399,312 \| ---- \| M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll MOD - [2013/11/14 12:29:29 \| 004,055,504 \| ---- \| M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll MOD - [2013/11/14 12:28:37 \| 000,702,416 \| ---- \| M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\libglesv2.dll MOD - [2013/11/14 12:28:36 \| 000,099,792 \| ---- \| M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\libegl.dll MOD - [2013/11/14 12:28:34 \| 001,619,408 \| ---- \| M] () -- C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll MOD - [2013/10/09 19:49:10 \| 012,436,480 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll MOD - [2013/10/09 19:48:58 \| 003,348,480 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll MOD - [2013/10/09 19:48:55 \| 000,978,432 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll MOD - [2013/10/09 19:32:35 \| 013,199,360 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\485a21406ce7d08fe6cf0b40b706f460\System.Windows.Forms.ni.dll MOD - [2013/10/09 19:32:33 \| 007,070,720 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\7ece4823b0e12cae58be346bbc3cdeac\System.Core.ni.dll MOD - [2013/10/09 19:32:28 \| 001,014,272 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\b21ef81fc4131bd1edd6d0bae9d58932\System.Configuration.ni.dll MOD - [2013/10/09 19:32:28 \| 000,751,616 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\8aa82f86d6290eb261dcfa5b14c3fb37\System.Security.ni.dll MOD - [2013/09/14 00:51:02 \| 000,087,952 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll MOD - [2013/09/14 00:50:36 \| 001,242,952 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll MOD - [2013/09/11 22:05:53 \| 000,771,584 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll MOD - [2013/09/05 00:14:10 \| 004,300,456 \| ---- \| M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf MOD - [2013/08/16 16:35:15 \| 001,218,560 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0f881bc8833c56ab7fcfef2bcc244441\System.Management.ni.dll MOD - [2013/08/15 20:39:35 \| 001,593,344 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll MOD - [2013/08/15 20:39:21 \| 005,464,064 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll MOD - [2013/08/15 20:39:10 \| 007,989,760 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll MOD - [2013/08/14 19:54:55 \| 005,628,928 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\0835155203a99b6a9bb540629920da0d\System.Xml.ni.dll MOD - [2013/08/14 19:54:53 \| 001,667,584 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\7e3570a0cc71998e14e7adb8e4ea0cbb\System.Drawing.ni.dll MOD - [2013/08/14 19:54:52 \| 009,099,776 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\fc16a5cafc433e6d942e9bd5b14fbeaf\System.ni.dll MOD - [2013/07/11 21:24:12 \| 011,499,520 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll MOD - [2013/07/11 11:09:55 \| 014,418,432 \| ---- \| M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c799474a067f07ef3a167d75029fa012\mscorlib.ni.dll MOD - [2012/08/17 21:38:56 \| 000,479,160 \| ---- \| M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll MOD - [2011/09/22 21:20:28 \| 011,233,136 \| ---- \| M] () -- C:\Program Files (x86)\Acronis\TrueImageHome\Common\ti_managers.dll MOD - [2011/06/24 21:56:36 \| 000,087,328 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011/06/24 21:56:14 \| 001,241,888 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011/01/31 11:17:32 \| 000,129,408 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\plugins\nps.dll MOD - [2011/01/31 11:15:08 \| 002,551,808 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtXmlPatterns4.dll MOD - [2011/01/31 11:15:08 \| 002,277,888 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtCore4.dll MOD - [2011/01/31 11:15:08 \| 000,912,384 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtNetwork4.dll MOD - [2011/01/31 11:15:08 \| 000,196,608 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\imageformats\qjpeg4.dll MOD - [2011/01/31 11:15:08 \| 000,026,624 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\imageformats\qgif4.dll MOD - [2011/01/31 11:15:06 \| 010,837,504 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtWebKit4.dll MOD - [2011/01/31 11:15:06 \| 008,151,040 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtGui4.dll MOD - [2011/01/31 11:15:06 \| 002,186,752 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtDeclarative4.dll MOD - [2011/01/31 11:15:06 \| 001,283,584 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtScript4.dll MOD - [2011/01/31 11:15:06 \| 000,675,840 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtOpenGL4.dll MOD - [2011/01/31 11:15:06 \| 000,339,456 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtXml4.dll MOD - [2011/01/31 11:15:06 \| 000,266,752 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\phonon4.dll MOD - [2011/01/31 11:15:06 \| 000,190,464 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\QtSql4.dll MOD - [2011/01/31 10:54:42 \| 000,790,016 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Maps Service API.dll MOD - [2011/01/31 10:52:56 \| 000,345,088 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\OviShareLib.dll MOD - [2011/01/31 10:52:56 \| 000,180,104 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\noaipcclient.dll MOD - [2011/01/31 10:52:56 \| 000,028,040 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\wrtserviceipcclient.dll MOD - [2011/01/31 10:52:00 \| 000,680,448 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\CommonUpdateChecker.dll MOD - [2010/11/15 13:41:18 \| 000,367,496 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\nokiaaserver.exe MOD - [2010/11/15 13:41:18 \| 000,034,184 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\wrtserviceipcserver.dll MOD - [2010/11/15 09:13:00 \| 000,016,384 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\qtsecurestorage.dll MOD - [2010/11/15 09:12:46 \| 000,015,360 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\cryptodll.dll MOD - [2010/11/15 09:12:46 \| 000,013,824 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\qtsecurestorageserver.dll MOD - [2010/11/13 00:26:08 \| 000,315,392 \| ---- \| M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010/09/23 17:34:40 \| 008,151,040 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\QtGui4.dll MOD - [2010/09/23 17:25:08 \| 000,912,384 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\QtNetwork4.dll MOD - [2010/09/23 17:24:02 \| 000,339,456 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\QtXml4.dll MOD - [2010/09/23 17:23:50 \| 002,277,888 \| ---- \| M] () -- C:\Program Files (x86)\Common Files\Nokia\NoA\QtCore4.dll MOD - [2010/06/30 14:03:14 \| 000,051,512 \| ---- \| M] () -- C:\Program Files\My Lockbox\fspflt.dll MOD - [2010/05/07 18:37:40 \| 000,126,808 \| ---- \| M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll MOD - [2010/05/07 18:37:40 \| 000,027,480 \| ---- \| M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll MOD - [2010/05/07 18:36:54 \| 000,340,824 \| ---- \| M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll MOD - [2010/05/07 18:35:56 \| 007,954,776 \| ---- \| M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll MOD - [2010/05/07 18:35:44 \| 002,143,576 \| ---- \| M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll MOD - [2005/07/20 09:48:10 \| 000,059,904 \| ---- \| M] () -- C:\Program Files (x86)\Nokia\Nokia Ovi Suite\zlib1.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV:64bit: - [2013/11/21 09:46:21 \| 000,111,616 \| ---- \| M] (Microsoft Corporation) [On_Demand \| Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService) SRV:64bit: - [2013/05/27 06:50:47 \| 001,011,712 \| ---- \| M] (Microsoft Corporation) [Auto \| Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2013/03/26 17:13:08 \| 000,230,416 \| ---- \| M] (Nitro PDF Software) [Auto \| Running] -- C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe -- (NitroReaderDriverReadSpool3) SRV - [2013/11/21 09:29:19 \| 000,257,416 \| ---- \| M] (Adobe Systems Incorporated) [On_Demand \| Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013/11/13 04:39:36 \| 000,119,408 \| ---- \| M] (Mozilla Foundation) [On_Demand \| Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013/10/11 07:56:41 \| 000,356,128 \| ---- \| M] (Kaspersky Lab ZAO) [Auto \| Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP) SRV - [2013/09/05 10:34:30 \| 000,171,680 \| R--- \| M] (Skype Technologies) [Auto \| Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2013/05/10 08:57:22 \| 000,065,640 \| ---- \| M] (Adobe Systems Incorporated) [Auto \| Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013/03/15 06:53:06 \| 001,266,464 \| ---- \| M] (NVIDIA Corporation) [Auto \| Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2013/03/14 21:07:46 \| 000,383,264 \| ---- \| M] (NVIDIA Corporation) [Auto \| Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2011/10/15 12:08:56 \| 003,246,040 \| ---- \| M] (Acronis) [Auto \| Running] -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv) SRV - [2011/08/19 09:26:50 \| 000,450,848 \| ---- \| M] (Logitech Inc.) [Auto \| Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv) SRV - [2011/01/10 15:24:20 \| 000,993,848 \| ---- \| M] (Secunia) [Auto \| Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent) SRV - [2011/01/10 15:24:20 \| 000,399,416 \| ---- \| M] (Secunia) [Auto \| Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent) SRV - [2010/12/23 11:41:36 \| 003,304,768 \| ---- \| M] (devolo AG) [Auto \| Running] -- C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe -- (DevoloNetworkService) SRV - [2010/12/08 14:31:06 \| 000,628,736 \| ---- \| M] (Nokia) [On_Demand \| Running] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2010/12/06 06:55:50 \| 001,112,744 \| ---- \| M] (Acronis) [Auto \| Running] -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2010/03/18 13:16:28 \| 000,130,384 \| ---- \| M] (Microsoft Corporation) [Auto \| Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/10/02 22:26:12 \| 000,013,336 \| ---- \| M] (Intel Corporation) [Auto \| Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2009/07/14 21:53:32 \| 000,211,232 \| ---- \| M] (Ralink Technology, Corp.) [Auto \| Running] -- C:\Program Files (x86)\ZyXEL\NWD2105\Common\RaRegistry64.exe -- (RalinkRegistryWriter64) SRV - [2009/07/14 21:53:00 \| 000,185,632 \| ---- \| M] (Ralink Technology, Corp.) [Auto \| Running] -- C:\Program Files (x86)\ZyXEL\NWD2105\Common\RaRegistry.exe -- (RalinkRegistryWriter) SRV - [2009/06/10 22:23:09 \| 000,066,384 \| ---- \| M] (Microsoft Corporation) [Disabled \| Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:64bit: - [2013/10/11 07:58:22 \| 000,626,272 \| ---- \| M] (Kaspersky Lab ZAO) [File_System \| System \| Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF) DRV:64bit: - [2013/10/11 07:58:22 \| 000,029,280 \| ---- \| M] (Kaspersky Lab ZAO) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt) DRV:64bit: - [2013/10/11 07:58:22 \| 000,029,280 \| ---- \| M] (Kaspersky Lab ZAO) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt) DRV:64bit: - [2013/10/11 07:58:19 \| 007,717,984 \| ---- \| M] (Kaspersky Lab ZAO) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (KL1) DRV:64bit: - [2013/06/19 18:59:20 \| 000,054,368 \| ---- \| M] (Kaspersky Lab ZAO) [Kernel \| System \| Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi) DRV:64bit: - [2013/04/24 20:11:54 \| 000,385,216 \| ---- \| M] (EldoS Corporation) [Kernel \| System \| Running] -- C:\Windows\SysNative\drivers\cbfs4.sys -- (cbfs4) DRV:64bit: - [2013/04/23 15:11:25 \| 000,178,448 \| ---- \| M] (Kaspersky Lab ZAO) [Kernel \| System \| Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps) DRV:64bit: - [2012/12/19 06:41:52 \| 000,194,488 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012/12/13 13:50:36 \| 000,054,784 \| ---- \| M] (Apple, Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012/09/21 20:04:22 \| 004,763,680 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\LVUVC64.sys -- (LVUVC64) DRV:64bit: - [2012/09/21 20:04:22 \| 000,351,520 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64) DRV:64bit: - [2012/08/23 15:10:20 \| 000,019,456 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012/08/23 15:07:35 \| 000,057,856 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012/08/21 12:01:20 \| 000,033,240 \| ---- \| M] (GEAR Software Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012/08/02 15:09:34 \| 000,028,504 \| ---- \| M] (Kaspersky Lab ZAO) [Kernel \| System \| Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6) DRV:64bit: - [2012/06/26 20:38:28 \| 000,046,176 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2012/03/19 08:18:46 \| 000,089,536 \| ---- \| M] (Citrix Systems, Inc.) [Kernel \| System \| Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm) DRV:64bit: - [2012/03/01 07:46:16 \| 000,023,408 \| ---- \| M] (Microsoft Corporation) [Recognizer \| Boot \| Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012/02/15 14:16:48 \| 000,011,576 \| ---- \| M] (Samsung Electronics) [Kernel \| Auto \| Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT) DRV:64bit: - [2011/10/15 12:08:58 \| 000,285,280 \| ---- \| M] (Acronis) [File_System \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\afcdp.sys -- (afcdp) DRV:64bit: - [2011/10/15 12:08:54 \| 001,263,200 \| ---- \| M] (Acronis) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\tdrpm273.sys -- (tdrpman273) DRV:64bit: - [2011/05/18 08:08:32 \| 000,047,616 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) DRV:64bit: - [2011/04/13 14:04:38 \| 000,023,960 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr) DRV:64bit: - [2011/03/11 07:41:12 \| 000,107,904 \| ---- \| M] (Advanced Micro Devices) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 07:41:12 \| 000,027,008 \| ---- \| M] (Advanced Micro Devices) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011/01/08 19:17:28 \| 000,970,336 \| ---- \| M] (Acronis) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter) DRV:64bit: - [2011/01/08 19:17:26 \| 000,277,088 \| ---- \| M] (Acronis) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman) DRV:64bit: - [2010/11/20 14:33:35 \| 000,078,720 \| ---- \| M] (Hewlett-Packard Company) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/09/01 09:30:58 \| 000,017,976 \| ---- \| M] (Secunia) [File_System \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI) DRV:64bit: - [2010/07/22 17:13:28 \| 000,054,848 \| ---- \| M] (FSPro Labs) [File_System \| Boot \| Running] -- C:\Windows\SysNative\drivers\FSPFltd.sys -- (FSProFilter) DRV:64bit: - [2010/05/14 23:00:28 \| 000,271,712 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lvpopf64.sys -- (lvpopf64) DRV:64bit: - [2010/04/27 16:57:20 \| 000,016,200 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid) DRV:64bit: - [2010/04/27 16:57:12 \| 000,026,440 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum) DRV:64bit: - [2010/04/27 14:03:12 \| 000,077,512 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore) DRV:64bit: - [2010/04/27 14:02:42 \| 000,043,976 \| ---- \| M] (Logitech Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter) DRV:64bit: - [2009/11/13 17:45:02 \| 001,085,952 \| ---- \| M] (Ralink Technology Corp.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux) DRV:64bit: - [2009/10/27 08:19:48 \| 000,176,640 \| ---- \| M] (NEC Electronics Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2009/10/27 08:19:46 \| 000,075,264 \| ---- \| M] (NEC Electronics Corporation) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2009/10/09 11:04:36 \| 000,291,368 \| ---- \| M] (Marvell Semiconductor, Inc.) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx) DRV:64bit: - [2009/10/02 21:58:58 \| 000,537,112 \| ---- \| M] (Intel Corporation) [Kernel \| Boot \| Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009/08/23 05:08:10 \| 000,056,320 \| ---- \| M] (Atheros Communications, Inc.) [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) DRV:64bit: - [2009/07/16 04:38:40 \| 000,015,416 \| ---- \| M] () [Kernel \| On_Demand \| Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009/07/14 02:52:20 \| 000,194,128 \| ---- \| M] (AMD Technologies Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/14 02:48:04 \| 000,065,600 \| ---- \| M] (LSI Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/14 02:45:55 \| 000,024,656 \| ---- \| M] (Promise Technology) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/07/14 01:35:32 \| 000,012,288 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009/06/10 21:34:33 \| 003,286,016 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 21:34:28 \| 000,468,480 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 21:34:23 \| 000,270,848 \| ---- \| M] (Broadcom Corporation) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 21:31:59 \| 000,031,232 \| ---- \| M] (Hauppauge Computer Works, Inc.) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008/08/28 11:44:42 \| 000,025,600 \| ---- \| M] (Nokia) [Kernel \| On_Demand \| Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV - [2010/06/10 12:32:14 \| 000,034,048 \| ---- \| M] (CACE Technologies) [Kernel \| Auto \| Running] -- C:\Windows\SysWOW64\drivers\npf_devolo.sys -- (NPF_devolo) DRV - [2009/07/14 02:19:10 \| 000,019,008 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand \| Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ch.msn.com/default.aspx?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-ch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2B DE C1 6E B2 EE CB 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus IE - HKCU\..\SearchScopes\{76238019-577C-440C-B503-DD0226300C80}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3317892&CUI=UN42398550852590931&UM=2 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = .local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.8 FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.7.2.1 FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21 FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4359 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0.1 FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.0.3 FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.48 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledItems: DeviceDetection@logitech.com:1.21.0.11 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3317892&SearchSource=2&CUI=UN35511063552561129&UM=2&sspv=TB_TNI&q=" FF - user.js - File not found FF:64bit:* - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files (x86)\Picasa2\npPicasa2.dll File not found FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@kaspersky.com/Password Manager: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager\npkpmAutofill.dll (Kaspersky Lab) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013/10/11 07:58:24 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013/10/11 07:58:25 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013/10/11 07:58:24 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013/10/11 07:58:24 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013/10/11 07:58:24 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/08/21 20:13:56 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/09/12 08:26:26 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011/05/14 11:08:34 \| 000,000,000 \| ---D \| M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{72CA2996-F580-47DF-98FF-0B853D09CEC8}: C:\Users\Admin\AppData\Roaming\Kaspersky Lab\Kaspersky Password Manager\kpmAutofill [2011/08/30 08:40:38 \| 000,000,000 \| ---D \| M] [2010/12/23 09:09:46 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions [2013/11/24 19:01:19 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\ip9f44uv.default\extensions [2013/11/24 19:02:37 \| 000,000,000 \| ---D \| M] (RadioTotal1) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\ip9f44uv.default\extensions\{422f7661-9403-4da4-b4ef-cc3e268817b5} [2012/03/18 17:01:16 \| 000,000,000 \| ---D \| M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\ip9f44uv.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2013/11/24 19:02:37 \| 000,000,000 \| ---D \| M] (DownloadHelper) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\ip9f44uv.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011/08/22 21:00:58 \| 000,000,000 \| ---D \| M] (Разпознаване на устройство Logitech) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\ip9f44uv.default\extensions\DeviceDetection@logitech.com [2013/11/24 19:01:14 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\ip9f44uv.default\extensions\staged [2013/06/02 07:57:05 \| 000,346,768 \| ---- \| M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\ip9f44uv.default\extensions\personas@christopher.beard.xpi [2013/11/21 09:34:11 \| 000,534,203 \| ---- \| M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\ip9f44uv.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013/09/02 16:54:46 \| 000,824,302 \| ---- \| M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\ip9f44uv.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013/11/24 15:18:10 \| 000,001,448 \| ---- \| M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\ip9f44uv.default\searchplugins\softonic.xml [2013/11/21 09:27:00 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013/11/21 09:27:00 \| 000,000,000 \| ---D \| M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013/10/11 07:58:24 \| 000,000,000 \| ---D \| M] (Anti-Banner) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM [2012/03/28 01:04:52 \| 000,124,864 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll [2012/03/28 01:06:54 \| 000,071,104 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2012/03/28 01:05:52 \| 000,092,096 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2012/03/28 01:05:28 \| 000,022,976 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2012/03/28 01:48:16 \| 000,489,384 \| ---- \| M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2012/03/28 01:06:48 \| 000,024,512 \| ---- \| M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{googleageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - homepage: about:blank CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\31.0.1650.57\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL CHR - plugin: NPCIG.dll (Enabled) = C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll CHR - plugin: Kaspersky Password Manager (Enabled) = C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager\npkpmAutofill.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Google Update (Enabled) = C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll CHR - Extension: YouTube = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Google-Suche = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\ CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_1\ CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_2\ CHR - Extension: Sicherer Zahlungsverkehr = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\ CHR - Extension: Virtuelle Tastatur = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0\ CHR - Extension: Virtuelle Tastatur = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_1\ CHR - Extension: Virtuelle Tastatur = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_2\ CHR - Extension: Google Wallet = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\ CHR - Extension: Google Wallet = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\ CHR - Extension: Google Mail = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ CHR - Extension: Anti-Banner = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\ O1 HOSTS File: ([2009/06/10 22:00:26 \| 000,000,824 \| ---- \| M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) O2:64bit: - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O2:64bit: - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) O4:64bit: - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis) O4:64bit: - HKLM..\Run: [CDAServer] C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe () O4:64bit: - HKLM..\Run: [Eraser] "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart File not found O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Device Center\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Device Center\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe (FSPro Labs) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe (Realtek Semiconductor Corp.) O4:64bit: - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO) O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKLM..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [SAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe (Acronis) O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) O4 - HKCU..\Run: [BoxCryptor] C:\Program Files (x86)\BoxCryptor\BoxCryptor.exe (Secomba GmbH) O4 - HKCU..\Run: [ConduitFloatingPlugin_cfigonhgidedenkkhlilmefgodjpefna] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\CT3317892\plugins\TBVerifier.dll",RunConduitFloatingPlugin cfigonhgidedenkkhlilmefgodjpefna File not found O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - HKCU..\Run: [iDailyDiary] "C:\PROGRA~2\IDAILY~1\iDD.exe" /LOGMIN File not found O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found O4 - HKCU..\Run: [NokiaOviSuite2] C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm () O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) O9:64bit: - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Geräteerkennung) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.45.2) O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.7.0_05) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.45.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B1C54F2-9611-4771-AAD4-53F159E77DFB}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E1A47B1-42E5-43B2-97CC-EB60C3F316C0}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=euc-jp - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=ISO-8859-1 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS936 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS949 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS950 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF8 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF-8 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=euc-jp - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=ISO-8859-1 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS936 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS949 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS950 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF8 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF-8 - No CLSID value found O18:64bit: - Protocol\Filter\ica - No CLSID value found O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: EldosMountNotificator-cbfs4 - {46D14A0C-5B25-49CE-AD29-439CD14C401C} - C:\Windows\SysNative\cbfsMntNtf4.dll (EldoS Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: EldosMountNotificator-cbfs4 - {46D14A0C-5B25-49CE-AD29-439CD14C401C} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {46D14A0C-5B25-49CE-AD29-439CD14C401C} - Virtual Storage Mount Notification - C:\Windows\SysNative\cbfsMntNtf4.dll (EldoS Corporation) O22 - SharedTaskScheduler: {46D14A0C-5B25-49CE-AD29-439CD14C401C} - Virtual Storage Mount Notification - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation) O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 0 O33 - MountPoints2\{6620e57d-0e6b-11e0-b35e-485b39a7f22e}\Shell - "" = AutoRun O33 - MountPoints2\{6620e57d-0e6b-11e0-b35e-485b39a7f22e}\Shell\AutoRun\command - "" = E:\Windows\CHECK\DriveNavigator.exe O34 - HKLM BootExecute: (autocheck autochk ) O34 - HKLM BootExecute: (auto_reactivate \\?\Volume{70D8E8B0-0AC7-11E0-9F6A-806E6F6E6963}\bootwiz\asrm.bin) O35:64bit:* - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -UserConfig ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1 ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013/11/24 18:00:50 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\Documents\OneNote-Notizbücher [2013/11/24 16:56:55 \| 000,000,000 \| ---D \| C] -- C:\Windows\uninstall [2013/11/24 16:56:49 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Roaming\Windows Net Data [2013/11/24 16:56:38 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Conduit [2013/11/24 16:56:22 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Local\NativeMessaging [2013/11/24 16:56:21 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Local\Conduit [2013/11/24 16:56:19 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Local\CRE [2013/11/24 16:56:18 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\Conduit [2013/11/24 16:54:58 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Local\DownloadGuide [2013/11/24 15:27:51 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Roaming\Nitro [2013/11/24 15:27:51 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Roaming\FileOpen [2013/11/24 15:08:45 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\AppData\Local\webkit [2013/11/24 15:08:41 \| 000,000,000 \| ---D \| C] -- C:\Users\Admin\.rednotebook [2013/11/06 18:12:56 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2013/11/06 18:12:24 \| 000,000,000 \| ---D \| C] -- C:\Program Files\iTunes [2013/11/06 18:12:24 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86)\iTunes [2013/11/06 18:12:24 \| 000,000,000 \| ---D \| C] -- C:\Program Files\iPod [2013/11/06 18:12:24 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 [2011/08/22 21:05:26 \| 005,628,288 \| ---- \| C] (book4you ) -- C:\Users\Admin\AppData\Local\Bookmaker_Update_2.6.0.277_all.exe [2 C:\Windows\SysWow64\.tmp files -> C:\Windows\SysWow64\.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013/11/24 19:32:00 \| 000,001,120 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059428042-1383174899-2735097611-1001UA.job [2013/11/24 19:21:00 \| 000,000,884 \| ---- \| M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013/11/24 19:12:36 \| 000,013,776 \| -H-- \| M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/11/24 19:12:36 \| 000,013,776 \| -H-- \| M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/11/24 19:10:35 \| 001,498,742 \| ---- \| M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013/11/24 19:10:35 \| 000,654,150 \| ---- \| M] () -- C:\Windows\SysNative\perfh007.dat [2013/11/24 19:10:35 \| 000,616,032 \| ---- \| M] () -- C:\Windows\SysNative\perfh009.dat [2013/11/24 19:10:35 \| 000,130,022 \| ---- \| M] () -- C:\Windows\SysNative\perfc007.dat [2013/11/24 19:10:35 \| 000,106,412 \| ---- \| M] () -- C:\Windows\SysNative\perfc009.dat [2013/11/24 19:04:19 \| 000,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2013/11/24 18:05:59 \| 000,001,344 \| ---- \| M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2013/11/24 17:55:10 \| 000,001,120 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059428042-1383174899-2735097611-1000UA.job [2013/11/24 16:56:46 \| 000,000,009 \| ---- \| M] () -- C:\END [2013/11/24 15:10:39 \| 000,000,218 \| ---- \| M] () -- C:\Users\Admin\AppData\Local\recently-used.xbel [2013/11/24 10:55:00 \| 000,001,068 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059428042-1383174899-2735097611-1000Core.job [2013/11/24 10:32:01 \| 000,001,068 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059428042-1383174899-2735097611-1001Core.job [2013/11/21 09:46:22 \| 000,016,284 \| ---- \| M] () -- C:\Windows\SysWow64\ieuinit.inf [2013/11/21 09:46:21 \| 000,016,284 \| ---- \| M] () -- C:\Windows\SysNative\ieuinit.inf [2013/11/06 18:12:56 \| 000,001,783 \| ---- \| M] () -- C:\Users\Public\Desktop\iTunes.lnk [2 C:\Windows\SysWow64\.tmp files -> C:\Windows\SysWow64\.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013/11/24 18:01:17 \| 000,001,344 \| ---- \| C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2013/11/24 16:55:32 \| 000,000,009 \| ---- \| C] () -- C:\END [2013/11/24 15:10:39 \| 000,000,218 \| ---- \| C] () -- C:\Users\Admin\AppData\Local\recently-used.xbel [2013/11/21 09:46:22 \| 000,016,284 \| ---- \| C] () -- C:\Windows\SysWow64\ieuinit.inf [2013/11/21 09:46:21 \| 000,016,284 \| ---- \| C] () -- C:\Windows\SysNative\ieuinit.inf [2013/11/06 18:12:56 \| 000,001,783 \| ---- \| C] () -- C:\Users\Public\Desktop\iTunes.lnk [2013/09/03 10:34:33 \| 001,554,336 \| ---- \| C] () -- C:\Windows\TotalUninstaller.exe [2013/09/02 14:30:28 \| 000,000,057 \| ---- \| C] () -- C:\ProgramData\Ament.ini [2012/09/21 20:08:36 \| 010,919,784 \| ---- \| C] () -- C:\Windows\SysWow64\LogiDPP.dll [2012/09/21 20:08:36 \| 000,338,136 \| ---- \| C] () -- C:\Windows\SysWow64\DevManagerCore.dll [2012/09/21 20:08:36 \| 000,103,272 \| ---- \| C] () -- C:\Windows\SysWow64\LogiDPPApp.exe [2012/04/24 08:28:21 \| 000,017,408 \| ---- \| C] () -- C:\Users\Admin\AppData\Local\WebpageIcons.db [2011/06/12 09:25:15 \| 000,003,584 \| ---- \| C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [color=#E56717]========== ZeroAccess Check ==========[/color] [2009/07/14 05:55:00 \| 000,000,227 \| RHS- \| M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013/07/26 03:24:57 \| 014,172,672 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013/07/26 02:55:59 \| 012,872,704 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 \| 000,909,312 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 \| 000,606,208 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 \| 000,505,856 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2011/03/16 18:18:51 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\.Kanton ZH [2011/01/08 19:17:34 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\649F504C-D1C5-4D0E-87DB-639849439361 [2011/01/06 22:09:09 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Acronis [2011/10/15 12:08:58 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\B468D4E2-2F3C-40CF-B524-B7364BDAD111 [2011/08/22 21:09:13 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\BookMaker [2011/12/02 19:41:35 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Canon [2011/08/18 19:20:53 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Dropbox [2013/04/22 22:11:22 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoft [2012/03/18 17:01:15 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers [2011/01/06 22:01:42 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\F0EDC31F-A123-4953-BF15-3EA601299E3F [2011/01/08 19:17:34 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\FCB62BE8-CB8F-4CA7-9E9D-095FFDDD75CE [2013/11/24 15:27:51 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\FileOpen [2011/03/21 11:20:42 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\ICAClient [2012/04/11 14:40:50 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Information Factory [2011/08/30 07:50:34 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\KeeperData [2010/12/19 21:24:22 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Leadertech [2013/11/24 15:27:51 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Nitro [2013/08/24 10:11:44 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Nitro PDF [2010/12/27 21:08:25 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Nokia [2010/12/27 21:08:25 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Nokia Ovi Suite [2010/12/27 21:07:30 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\PC Suite [2013/09/03 10:36:24 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Samsung [2013/11/24 19:02:37 \| 000,000,000 \| ---D \| M] -- C:\Users\Admin\AppData\Roaming\Windows Net Data [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %SYSTEMDRIVE%\. >[/color] [2012/02/06 10:42:17 \| 000,000,000 \| -HSD \| M] -- C:\$RECYCLE.BIN [2013/07/11 11:17:09 \| 000,000,000 \| ---D \| M] -- C:\9b5be5ecad80a122e7c08afb [2013/02/02 12:02:42 \| 000,000,000 \| -HSD \| M] -- C:\Boot [2011/01/08 19:24:53 \| 000,000,000 \| RHSD \| M] -- C:\bootwiz [2013/11/24 11:05:47 \| 000,000,000 \| -HSD \| M] -- C:\Config.Msi [2009/07/14 06:08:56 \| 000,000,000 \| -HSD \| M] -- C:\Documents and Settings [2010/11/24 05:08:08 \| 000,000,000 \| ---D \| M] -- C:\Intel [2010/12/23 21:34:28 \| 000,000,000 \| RH-D \| M] -- C:\MSOCache [2009/07/14 04:20:08 \| 000,000,000 \| ---D \| M] -- C:\PerfLogs [2013/11/24 19:01:01 \| 000,000,000 \| R--D \| M] -- C:\Program Files [2013/11/24 19:02:27 \| 000,000,000 \| R--D \| M] -- C:\Program Files (x86) [2013/11/24 19:01:04 \| 000,000,000 \| -H-D \| M] -- C:\ProgramData [2010/12/18 09:05:35 \| 000,000,000 \| -HSD \| M] -- C:\Recovery [2013/11/24 19:29:00 \| 000,000,000 \| -HSD \| M] -- C:\System Volume Information [2012/11/18 20:04:39 \| 000,000,000 \| R--D \| M] -- C:\Users [2013/11/24 19:21:58 \| 000,000,000 \| ---D \| M] -- C:\Windows [color=#A23BEC]< %PROGRAMFILES%\.exe >[/color] [color=#A23BEC]< %LOCALAPPDATA%\.exe >[/color] [2011/08/22 21:05:36 \| 005,628,288 \| ---- \| M] (book4you ) -- C:\Users\Admin\AppData\Local\Bookmaker_Update_2.6.0.277_all.exe [color=#A23BEC]< %systemroot%\. /mp /s >[/color] [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2011/02/26 07:23:14 \| 002,870,272 \| ---- \| M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011/02/26 06:19:21 \| 002,616,320 \| ---- \| M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009/07/14 02:14:20 \| 002,613,248 \| ---- \| M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011/02/26 06:51:13 \| 002,614,784 \| ---- \| M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2010/09/30 10:11:12 \| 002,614,272 \| ---- \| M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011/02/26 06:33:07 \| 002,614,784 \| ---- \| M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011/02/25 07:19:30 \| 002,871,808 \| ---- \| M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011/02/25 07:19:30 \| 002,871,808 \| ---- \| M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011/02/26 07:14:34 \| 002,871,808 \| ---- \| M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010/11/20 13:17:09 \| 002,616,320 \| ---- \| M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2010/09/30 10:08:28 \| 002,868,224 \| ---- \| M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011/02/25 06:30:54 \| 002,616,320 \| ---- \| M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011/02/25 06:30:54 \| 002,616,320 \| ---- \| M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2010/09/30 10:11:12 \| 002,870,272 \| ---- \| M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2010/09/30 10:08:28 \| 002,613,248 \| ---- \| M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010/11/20 14:24:45 \| 002,872,320 \| ---- \| M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2010/09/30 10:11:12 \| 002,870,272 \| ---- \| M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2010/09/30 10:08:28 \| 002,613,248 \| ---- \| M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009/07/14 02:39:10 \| 002,868,224 \| ---- \| M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2010/09/30 10:11:12 \| 002,614,272 \| ---- \| M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011/02/26 07:26:45 \| 002,870,784 \| ---- \| M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2010/09/30 10:08:28 \| 002,868,224 \| ---- \| M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe [color=#A23BEC]< MD5 for: REGEDIT.EXE >[/color] [2009/07/14 02:39:29 \| 000,427,008 \| ---- \| M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009/07/14 02:39:29 \| 000,427,008 \| ---- \| M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009/07/14 02:14:30 \| 000,398,336 \| ---- \| M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009/07/14 02:14:30 \| 000,398,336 \| ---- \| M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color] [2010/11/20 13:17:48 \| 000,026,624 \| ---- \| M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010/11/20 13:17:48 \| 000,026,624 \| ---- \| M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009/07/14 02:14:43 \| 000,026,112 \| ---- \| M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009/07/14 02:39:48 \| 000,030,208 \| ---- \| M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010/11/20 14:25:24 \| 000,030,720 \| ---- \| M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010/11/20 14:25:24 \| 000,030,720 \| ---- \| M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe [color=#A23BEC]< MD5 for: WININIT.EXE >[/color] [2009/07/14 02:39:52 \| 000,129,024 \| ---- \| M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009/07/14 02:39:52 \| 000,129,024 \| ---- \| M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009/07/14 02:14:45 \| 000,096,256 \| ---- \| M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009/07/14 02:14:45 \| 000,096,256 \| ---- \| M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2010/11/20 14:25:30 \| 000,390,656 \| ---- \| M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010/11/20 14:25:30 \| 000,390,656 \| ---- \| M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009/07/14 02:39:52 \| 000,389,120 \| ---- \| M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2010/09/30 10:11:12 \| 000,389,632 \| ---- \| M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2010/09/30 10:11:12 \| 000,389,632 \| ---- \| M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >[/color] "AUOptions" = 2 [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\|LastSuccessTime /rs >[/color] < End of report > --------------------------- OTL Extras logfile created on: 11/24/2013 7:26:48 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16428) Locale: 00000409 \| Country: Schweiz \| Language: DES \| Date Format: dd.MM.yyyy 3.99 Gb Total Physical Memory \| 2.14 Gb Available Physical Memory \| 53.67% Memory free 7.98 Gb Paging File \| 5.55 Gb Available in Paging File \| 69.55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files (x86) Drive C: \| 919.99 Gb Total Space \| 777.76 Gb Free Space \| 84.54% Space Free \| Partition Type: NTFS Drive E: \| 3.77 Gb Total Space \| 3.72 Gb Free Space \| 98.55% Space Free \| Partition Type: FAT32 Drive X: \| 919.99 Gb Total Space \| 777.76 Gb Free Space \| 84.54% Space Free \| Partition Type: FAT32 Computer Name: THARSIS \| User Name: Admin \| Logged in as Administrator. Boot Mode: Normal \| Scan Mode: Current user \| Quick Scan \| Include 64bit Scans Company Name Whitelist: On \| Skip Microsoft Files: On \| No Company Name Whitelist: On \| File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML.Admin] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. [color=#E56717]========== Security Center Settings ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0C1231B3-F1FD-4B83-AAF6-26DFD1B14365}" = lport=1900 \| protocol=17 \| dir=in \| svc=ssdpsrv \| app=%systemroot%\system32\svchost.exe \| "{15FDA9E9-09EA-4EFD-936A-922E5B808056}" = rport=10243 \| protocol=6 \| dir=out \| app=system \| "{1E685504-82A1-498A-B606-12B54FAD4F0E}" = rport=138 \| protocol=17 \| dir=out \| app=system \| "{243BD5B3-1B1F-4B8F-A30C-DD6BFFCBBBC8}" = lport=445 \| protocol=6 \| dir=in \| app=system \| "{34A5FEF3-DBDF-4C12-AA11-08F56CC22D58}" = rport=2177 \| protocol=6 \| dir=out \| svc=qwave \| app=%systemroot%\system32\svchost.exe \| "{372093C0-3C8A-4DB6-959C-7F99513E4902}" = lport=1900 \| protocol=17 \| dir=in \| name=windows live communications platform (ssdp) \| "{3BC718BD-EEC0-4EF6-B062-F57E230478D9}" = rport=5355 \| protocol=17 \| dir=out \| svc=dnscache \| app=%systemroot%\system32\svchost.exe \| "{40A80B09-55B6-4B7E-A5CD-8A879CE6807A}" = rport=5355 \| protocol=17 \| dir=out \| svc=dnscache \| app=%systemroot%\system32\svchost.exe \| "{4D531AA5-3BB3-4DAA-967E-BAD35416196E}" = lport=139 \| protocol=6 \| dir=in \| app=system \| "{576410AC-B493-4083-A2DC-4807632DB596}" = lport=2177 \| protocol=17 \| dir=in \| svc=qwave \| app=%systemroot%\system32\svchost.exe \| "{5E4EE5B8-1A01-4290-89EF-5A1A4C2EED85}" = lport=19375 \| protocol=17 \| dir=in \| app=c:\program files (x86)\devolo\dlan\devolonetsvc.exe \| "{5EB35D7A-CF86-48B1-9E57-B31C3C3E44FE}" = rport=2177 \| protocol=17 \| dir=out \| svc=qwave \| app=%systemroot%\system32\svchost.exe \| "{75608334-5E15-431C-A69D-ECA960ED0167}" = lport=137 \| protocol=17 \| dir=in \| app=system \| "{9AA99ECD-D43C-4311-84D1-2D0939273744}" = lport=5355 \| protocol=17 \| dir=in \| svc=dnscache \| app=%systemroot%\system32\svchost.exe \| "{A12A1044-581D-4949-A577-F9F43E427DE5}" = rport=445 \| protocol=6 \| dir=out \| app=system \| "{AAD7499D-5931-46F1-BABE-D1A0AE9A2104}" = lport=19376 \| protocol=6 \| dir=in \| app=c:\program files (x86)\devolo\dlan\devolonetsvc.exe \| "{B008948F-4D75-4417-AA5E-FE64D52EAFE7}" = lport=5355 \| protocol=17 \| dir=in \| svc=dnscache \| app=%systemroot%\system32\svchost.exe \| "{B0B3C2F8-3BDE-49CE-921E-BE25905CC33C}" = lport=2869 \| protocol=6 \| dir=in \| app=system \| "{BE9CEEED-3D9D-494F-AB40-984DB6D0296B}" = lport=2869 \| protocol=6 \| dir=in \| name=windows live communications platform (upnp) \| "{C1DF50EB-B2E2-4C89-AC00-A27E206B3F50}" = rport=137 \| protocol=17 \| dir=out \| app=system \| "{C7083F24-B460-4E6B-A76E-B61CEB22F4A3}" = rport=1900 \| protocol=17 \| dir=out \| svc=ssdpsrv \| app=%systemroot%\system32\svchost.exe \| "{CDD196BE-A7A2-4CA9-A928-10DBDC118B34}" = lport=6004 \| protocol=17 \| dir=in \| app=c:\program files (x86)\microsoft office\office14\outlook.exe \| "{D0D66796-576A-478D-9AF8-BF1500F0D079}" = lport=2177 \| protocol=6 \| dir=in \| svc=qwave \| app=%systemroot%\system32\svchost.exe \| "{DB58DDA2-0A51-4FB1-AE97-A5C6B4DEB7EF}" = lport=rpc-epmap \| protocol=6 \| dir=in \| svc=rpcss \| name=@firewallapi.dll,-28539 \| "{F1CFB2E1-5500-4107-A36A-FC18FB55B236}" = lport=138 \| protocol=17 \| dir=in \| app=system \| "{F4C0B44A-6352-4119-8DA6-475D8EDB8698}" = lport=rpc \| protocol=6 \| dir=in \| svc=spooler \| app=%systemroot%\system32\spoolsv.exe \| "{F6F338C4-C1F5-4087-81B7-2188BC1A806F}" = lport=10243 \| protocol=6 \| dir=in \| app=system \| "{FF86DB87-914D-4D11-B61B-3500E71ECD21}" = rport=139 \| protocol=6 \| dir=out \| app=system \| [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0DA45AC8-A6E9-4A54-8FF3-453D01A8F9CB}" = protocol=6 \| dir=in \| app=c:\program files\bonjour\mdnsresponder.exe \| "{18638176-3085-445D-98BB-052557D39021}" = protocol=6 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\ordersupplies.exe \| "{19F3A620-874F-4515-8498-85B11485FD76}" = protocol=6 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\ids.application.exe \| "{1A849FE9-BE3A-42E0-9632-42C7B97389D1}" = protocol=6 \| dir=in \| app=c:\program files (x86)\bonjour\mdnsresponder.exe \| "{1C2E5EC9-6F8E-4AFF-B76A-9D18DF076B4E}" = protocol=17 \| dir=in \| app=c:\program files (x86)\bonjour\mdnsresponder.exe \| "{1DF9EE8B-29B1-4837-A751-111669A65D24}" = protocol=17 \| dir=in \| app=%programfiles%\windows media player\wmplayer.exe \| "{24A73658-A0B1-43DF-8447-30E544C89ED2}" = protocol=58 \| dir=out \| name=@firewallapi.dll,-28546 \| "{2CC2034C-855A-45C7-9FFE-38CBE958F40B}" = protocol=17 \| dir=in \| app=c:\program files\bonjour\mdnsresponder.exe \| "{2D4624F9-B613-4A9E-A529-F9956339F2A5}" = protocol=17 \| dir=out \| app=%programfiles(x86)%\windows media player\wmplayer.exe \| "{2FD389EA-0EEF-4210-AF8E-47DCBA9ACA65}" = dir=in \| app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe \| "{30429AAB-D27F-462C-85C4-9BCBB446A532}" = dir=in \| app=c:\program files (x86)\windows live\contacts\wlcomm.exe \| "{3ADDE234-7F09-4885-B8ED-CF607166C9BE}" = protocol=17 \| dir=in \| app=%programfiles%\windows media player\wmpnetwk.exe \| "{3BA8C707-9E2F-4182-A034-6436C00577E4}" = protocol=17 \| dir=out \| app=%programfiles%\windows media player\wmplayer.exe \| "{47180E73-DBDC-492D-BF28-38C32E581AE8}" = protocol=17 \| dir=in \| app=c:\program files (x86)\microsoft office\office14\onenote.exe \| "{482AE693-9C9B-405F-8402-1360D1006409}" = protocol=17 \| dir=in \| app=%programfiles%\windows media player\wmplayer.exe \| "{558720A9-3A92-443C-B71F-CA1DDA3242B7}" = protocol=6 \| dir=in \| app=c:\program files (x86)\microsoft office\office14\groove.exe \| "{57E4A45D-B677-4037-8855-1B61DAFC550A}" = protocol=6 \| dir=out \| app=%programfiles%\windows media player\wmplayer.exe \| "{5F4BCED5-AE14-43CB-8D98-CA8D8568474B}" = protocol=6 \| dir=in \| app=c:\program files (x86)\microsoft office\office14\onenote.exe \| "{66351A16-FB50-4466-BEFC-024D55E20EF5}" = protocol=6 \| dir=out \| app=%programfiles%\windows media player\wmpnetwk.exe \| "{67D4BA24-DD12-436E-AC77-D9A4B3538E59}" = protocol=6 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\idsalert.exe \| "{76F6E721-FAE8-443C-A75B-39C184C0AC08}" = protocol=6 \| dir=out \| svc=upnphost \| app=%systemroot%\system32\svchost.exe \| "{7B2C4780-6A9E-4806-91A0-5D083B422F5A}" = dir=in \| app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe \| "{7ECA8201-C923-4A4B-A06B-04CF3468DAD3}" = protocol=17 \| dir=in \| app=c:\program files\common files\common desktop agent\cdasrv.exe \| "{82BEB9F2-0464-4AD1-87C0-53C530D6A3BF}" = protocol=6 \| dir=out \| app=system \| "{85DB5871-54E4-4B7D-A00B-120E6A1CFB16}" = protocol=17 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\ordersupplies.exe \| "{8CB63D0F-D086-4AB2-BA48-A8652D6FDA9C}" = protocol=17 \| dir=in \| app=c:\program files (x86)\microsoft office\office14\groove.exe \| "{926E3BCB-AA5C-43E8-B97A-BE76A7AE5E26}" = dir=in \| app=c:\program files (x86)\skype\phone\skype.exe \| "{92ED64FF-6BF8-427F-8C63-037D05CD5ED9}" = protocol=6 \| dir=out \| app=%programfiles(x86)%\windows media player\wmplayer.exe \| "{96F43ACC-7944-4F43-9016-5B19AEF0D893}" = protocol=6 \| dir=in \| app=c:\program files\common files\common desktop agent\cdasrv.exe \| "{A833C8B3-CD06-4A00-8E33-4ECE2F79FC75}" = protocol=17 \| dir=out \| app=%programfiles%\windows media player\wmplayer.exe \| "{B99281FA-7F3A-4489-9B1E-1EC5335DFB57}" = protocol=58 \| dir=in \| name=@firewallapi.dll,-28545 \| "{C0120D19-7503-43D3-9DFE-CA5162251CBF}" = protocol=6 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\cdas2pc\cdas2pc.exe \| "{C405CDF0-7111-4691-945C-2869EA7FD2E7}" = protocol=17 \| dir=in \| app=%programfiles(x86)%\windows media player\wmplayer.exe \| "{C69BA03D-898A-4C9E-9F29-F2FA9ECC4138}" = dir=in \| app=c:\program files (x86)\itunes\itunes.exe \| "{C7188684-A579-4E10-826D-CDB42238F669}" = protocol=6 \| dir=in \| app=c:\users\yuval\appdata\roaming\dropbox\bin\dropbox.exe \| "{CA14713B-0701-4027-BE6B-2CB5F30E2FB8}" = dir=in \| app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe \| "{D6124693-E34F-4A44-91D0-A85F976D7FD4}" = protocol=17 \| dir=out \| app=%programfiles%\windows media player\wmpnetwk.exe \| "{D877D745-DE6C-4CB5-89A0-186D15B31867}" = dir=in \| app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe \| "{DA2A73D9-7D3D-44FF-B46D-B7E6D84C3041}" = protocol=17 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\idsalert.exe \| "{DBF4D950-748E-413E-AD50-4F1E46F81789}" = protocol=17 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\cdas2pc\cdas2pc.exe \| "{E2D63FDE-030B-4664-9E06-607C3B0D1FDD}" = protocol=1 \| dir=out \| name=@firewallapi.dll,-28544 \| "{E7C06E23-84AF-4249-962D-8FB82091BE3E}" = protocol=1 \| dir=in \| name=@firewallapi.dll,-28543 \| "{E98C60FA-21A8-4AF2-A7FC-8F3C98D0954E}" = dir=in \| app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe \| "{F047E5D5-3811-4937-B75B-42766A67318F}" = protocol=17 \| dir=in \| app=c:\program files (x86)\samsung\easy printer manager\ids.application.exe \| "{F30D7172-37B5-4F8B-B29F-3EBCF7D79B2B}" = protocol=6 \| dir=in \| app=%programfiles%\windows media player\wmpnetwk.exe \| "{F7C8068F-9634-4F23-BBD6-4A67F87C067E}" = protocol=6 \| dir=out \| app=%programfiles%\windows media player\wmplayer.exe \| "{F8B21172-3AA7-4936-BE6A-B8B560BEF431}" = protocol=17 \| dir=in \| app=c:\users\yuval\appdata\roaming\dropbox\bin\dropbox.exe \| [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{031A0E14-0413-4C97-9772-2639B782F46F}" = Common Desktop Agent "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1444D2EE-C7AD-44A8-844F-2634B49353D1}" = Logitech Gaming Software 5.10 "{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant "{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}" = Apple Mobile Device Support "{4436B9BD-CA66-4D69-9091-2D2EB62F09AD}" = Nitro Reader 3 "{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2 "{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64) "{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010 "{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 "{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64 "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{AEF6C676-D7A2-4487-BD4B-1BED17B229B5}" = Microsoft-Maus- und Tastatur-Center "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 314.22 "{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 314.22 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 314.22 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 314.22 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.12.12 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{B821CDAA-34DE-46FD-87C9-E6EE7158DB5D}" = Microsoft Image Composite Editor "{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector "{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}" = iTunes "{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 "{EAFB2AD8-D92B-464C-8D97-B9CB94703C4A}" = iCloud "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "{FE041ADD-66F3-4B85-A0E2-9E85D0DCBB31}" = Eraser 6.0.6.1376 "CCleaner" = CCleaner "FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) "GIMP-2_is1" = GIMP 2.8.4 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft Mouse and Keyboard Center" = Microsoft-Maus- und Tastatur-Center "My Lockbox_is1" = My Lockbox 2.9.6 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0099B484-C24C-4D5F-8167-B0F6DF196E72}" = Adobe Shockwave Player 12.0 "{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = AcronisTrueImageHome 2011 "{08600005-5228-4BF6-845E-E9A957AFDCB4}" = OviMPlatform "{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video "{091B9E08-5E3E-43CE-B3BA-B9A9ACBE668F}" = Wireless N-lite USB Adapter Utility "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{0F7319A9-083D-40B3-8256-00A6F3C2AAA2}" = Citrix Online Plug-in (SSON) "{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1 "{133236FE-E2F7-4313-8BF8-A10ACAAA7CB9}" = Citrix Online Plug-in (USB) "{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi "{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main "{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter "{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser "{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin "{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 45 "{28191B83-1D60-44B6-9B08-E854EF6632D5}" = Ovi Desktop Sync Engine "{2FC7287D-39DD-4A84-9806-D27D3CCDC51B}" = Citrix Online Plug-in (Web) "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{3553E875-F00E-4031-BDEC-75FB1DFEB093}" = Nokia Ovi Suite Software Updater "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT "{3FC42713-B6E7-49AA-A553-A224FE9828A8}" = Nokia Ovi Suite "{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module "{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver "{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support "{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.10 "{52E225FC-FCB4-41F7-837B-6E37FB05BD7B}" = Adobe AIR "{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013 "{57287FDF-27E6-45BC-9DD2-A33545C46C1A}" = Citrix Online Plug-in (HDX) "{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM "{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 "{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2 "{6F2FDD50-E0F3-4117-B575-78E77F8D11EF}" = Citrix Online Plug-in (DV) "{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.3.0 "{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher "{846E4C72-DF45-43ED-1680-EDF5F87F279E}" = dLAN Cockpit "{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software "{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010 "{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010 "{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010 "{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010 "{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010 "{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010 "{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010 "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 "{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010 "{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010 "{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010 "{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010 "{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010 "{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010 "{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010 "{913778D3-E1D8-4B55-9246-3308C54D3162}" = Citrix Online Plug-in (PNA) "{91A605E2-0372-4198-B64D-FA4D7E9FC851}" = Adobe Flash Player 11 Plugin "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.8) - Deutsch "{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86 "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution "{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{EFC4BB62-CD01-4F63-9165-FC5DEB350469}" = Adobe Flash Player 11 ActiveX "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X "{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "{FBA4FF1B-14AB-4AEE-8C2A-0801ECFA0843}_is1" = Bookmaker "{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook "4095-7861-2728-4611" = Private Tax 2011 1.4 "6753-7911-9438-6061" = Private Tax 2012 2.3 "Adobe AIR" = Adobe AIR "BoxCryptor" = BoxCryptor 1.5 "CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX "Canon MOV Decoder" = Canon MOV Decoder "Canon MOV Encoder" = Canon MOV Encoder "CitrixOnlinePluginFull" = Citrix Online Plug-in "Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1" = dLAN Cockpit "dlancockpit" = devolo dLAN Cockpit "DPP" = Canon Utilities Digital Photo Professional 3.10 "EOS Sample Music" = Canon Utilities EOS Sample Music "EOS Utility" = Canon Utilities EOS Utility "EOS Video Snapshot Task" = Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX "Free Audio Converter_is1" = Free Audio Converter version 2.2.11 "Free MP4 Video Converter_is1" = Free MP4 Video Converter version 5.0.6.221 "Free Video Flip and Rotate_is1" = Free Video Flip and Rotate version 2.1.6.320 "Free YouTube Download_is1" = Free YouTube Download version 3.0.22.221 "ifolor-Designer" = ifolor Designer "InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver "InstallShield_{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X "InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013 "Kaspersky Password Manager_is1" = Kaspersky Password Manager 5.0.0.155 "MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX "MovieUploaderForYouTube" = Canon Utilities Movie Uploader for YouTube "Mozilla Firefox 25.0.1 (x86 en-US)" = Mozilla Firefox 25.0.1 (x86 en-US) "MozillaMaintenanceService" = Mozilla Maintenance Service "MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin "Nokia Ovi Suite" = Nokia Ovi Suite "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Office14.PROPLUSR" = Microsoft Office Professional Plus 2010 "PhotoStitch" = Canon Utilities PhotoStitch "Picasa 3" = Picasa 3 "Picture Style Editor" = Canon Utilities Picture Style Editor "Samsung Easy Printer Manager" = Samsung Easy Printer Manager "Samsung ML-2160 Series" = Samsung ML-2160 Series "Samsung Printer Live Update" = Samsung Printer Live Update "Secunia PSI" = Secunia PSI (2.0.0.3001) "VLC media player" = VLC media player 2.1.1 "WinLiveSuite" = Windows Live Essentials "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX "ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility [color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Google Chrome" = Google Chrome [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 11/24/2013 12:26:59 PM \| Computer Name = Tharsis \| Source = Windows Search Service \| ID = 3029 Description = Error - 11/24/2013 12:27:32 PM \| Computer Name = Tharsis \| Source = Windows Search Service \| ID = 3029 Description = Error - 11/24/2013 12:27:32 PM \| Computer Name = Tharsis \| Source = Windows Search Service \| ID = 3028 Description = Error - 11/24/2013 12:27:32 PM \| Computer Name = Tharsis \| Source = Windows Search Service \| ID = 3058 Description = Error - 11/24/2013 12:27:32 PM \| Computer Name = Tharsis \| Source = Windows Search Service \| ID = 7010 Description = Error - 11/24/2013 12:39:19 PM \| Computer Name = Tharsis \| Source = System Restore \| ID = 8210 Description = Error - 11/24/2013 1:11:41 PM \| Computer Name = Tharsis \| Source = Customer Experience Improvement Program \| ID = 1008 Description = Error - 11/24/2013 1:17:39 PM \| Computer Name = Tharsis \| Source = Application Hang \| ID = 1002 Description = Programm toolittleTagebuch.exe, Version 2.0.3.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 12ec Startzeit: 01cee9388611d7c2 Endzeit: 7 Anwendungspfad: E:\TooLittle Tagebuch\toolittleTagebuch.exe Berichts-ID: 31b32e86-552c-11e3-9efb-485b39a7f22e Error - 11/24/2013 1:24:01 PM \| Computer Name = Tharsis \| Source = Application Hang \| ID = 1002 Description = Programm toolittleTagebuch.exe, Version 2.0.3.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 23dc Startzeit: 01cee939568c3479 Endzeit: 10 Anwendungspfad: E:\TooLittle Tagebuch\toolittleTagebuch.exe Berichts-ID: 1eaba98b-552d-11e3-9efb-485b39a7f22e Error - 11/24/2013 1:56:49 PM \| Computer Name = Tharsis \| Source = System Restore \| ID = 8210 Description = [ Media Center Events ] Error - 2/12/2011 6:14:41 PM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 23:14:35 - Fehler beim Herstellen der Internetverbindung. 23:14:35 - Serververbindung konnte nicht hergestellt werden.. Error - 2/25/2011 10:26:45 PM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 03:26:44 - Fehler beim Herstellen der Internetverbindung. 03:26:44 - Serververbindung konnte nicht hergestellt werden.. Error - 2/25/2011 11:26:52 PM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 04:26:52 - Fehler beim Herstellen der Internetverbindung. 04:26:52 - Serververbindung konnte nicht hergestellt werden.. Error - 2/26/2011 12:27:00 AM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 05:27:00 - Fehler beim Herstellen der Internetverbindung. 05:27:00 - Serververbindung konnte nicht hergestellt werden.. Error - 2/26/2011 1:27:09 AM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 06:27:08 - Fehler beim Herstellen der Internetverbindung. 06:27:08 - Serververbindung konnte nicht hergestellt werden.. Error - 6/8/2011 12:24:06 AM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 06:24:05 - Fehler beim Herstellen der Internetverbindung. 06:24:05 - Serververbindung konnte nicht hergestellt werden.. Error - 6/13/2011 2:50:13 AM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 08:50:13 - Fehler beim Herstellen der Internetverbindung. 08:50:13 - Serververbindung konnte nicht hergestellt werden.. Error - 6/18/2011 12:36:06 AM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 06:36:06 - Fehler beim Herstellen der Internetverbindung. 06:36:06 - Serververbindung konnte nicht hergestellt werden.. Error - 6/23/2011 12:32:07 AM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 06:32:07 - Fehler beim Herstellen der Internetverbindung. 06:32:07 - Serververbindung konnte nicht hergestellt werden.. Error - 7/7/2011 9:34:11 PM \| Computer Name = Tharsis \| Source = MCUpdate \| ID = 0 Description = 03:34:11 - Fehler beim Herstellen der Internetverbindung. 03:34:11 - Serververbindung konnte nicht hergestellt werden.. [ System Events ] Error - 11/24/2013 1:58:39 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866321 Description = Error - 11/24/2013 1:58:39 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866317 Description = Error - 11/24/2013 1:58:39 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866321 Description = Error - 11/24/2013 1:58:39 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866317 Description = Error - 11/24/2013 2:07:10 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866321 Description = Error - 11/24/2013 2:07:10 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866317 Description = Error - 11/24/2013 2:07:10 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866321 Description = Error - 11/24/2013 2:07:10 PM \| Computer Name = Tharsis \| Source = WMPNetworkSvc \| ID = 866317 Description = Error - 11/24/2013 2:07:10 PM \| Computer Name = Tharsis \| Source = Service Control Manager \| ID = 7038 Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error - 11/24/2013 2:07:10 PM \| Computer Name = Tharsis \| Source = Service Control Manager \| ID = 7000 Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 < End of report >

24.11.2013, 22:36 maravilha Member Themenstarter Beiträge: 32	#2 Zudem kommt beim Starten des PC immer die Meldung: Problem beim Starten von C:\Users\Admin\AppData\Local\Temp\CT3317892\TBVerifier.dll Das angegebene Modul wurde nicht gefunden.

25.11.2013, 08:48 Gool Member Beiträge: 4730	#3 Punkt 1: Malware hast Du keine Punkt 2: Softonic verbindet die Downloads (leider) immer mit der Installation dieser grässlichen Toolbar Die Toolbar loszuwerden und auch alle anderen Einstellungen wieder zurück zu setzen, ist ätzend. http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/conduit-search-hijacker/72989166-1645-4338-965e-2990991a4f57 Um die Meldung bzgl. der fehlenden DLL loszuwerden, lösche den Eintrag "ConduitFloatingPlugin" aus dem Registry-Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run: O4 - HKCU..\Run: [ConduitFloatingPlugin_cfigonhgidedenkkhlilmefgodjpefna] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\CT3317892\plugins\TBVerifier.dll",RunConduitFloatingPlugin cfigonhgidedenkkhlilmefgodjpefna File not found Du kannst dazu auch HijackThis verwenden. Ansonsten gibt es auch unzählige Anleitungen im Netz dazu: https://www.google.de/search?q=conduit+search+entfernen&oq=conduit+&aqs=chrome.4.69i57j0l5.4902j0j4&sourceid=chrome&espv=210&es_sm=122&ie=UTF-8 __________ Dies ist eine Signatur! Persönlicher Service: Du kommst aus Berlin? Dann melde Dich per PN bei mir, evtl. können wir einen Termin vereinbaren. Der Grabsteinschubser

25.11.2013, 08:51 Xeper Member Beiträge: 5291	#4 Kleine Anmerkung zum Thema, desweiteren kann man alle freien Downloads vergessen die einem erstmal den SuperDuperDownloader.exe unterjubeln wollen. Finger weg von sowas. __________ E-Mail: therion at ninth-art dot de IRC: megatherion @ Freenode

27.11.2013, 19:17 maravilha Member Themenstarter Beiträge: 32	#5 Besten Dank für eure Tipps / Rückmeldungen!

Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!

Folgende Themen könnten Dich auch interessieren:

Seite(n): 1

Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten