Ergebnis 1 bis 8 von 8
  1. #1
    Einsteiger
    Registriert seit
    17.04.2012
    Beiträge
    4

    BKA Trojaner 1.03 Windows Vista

    Hallo,

    habe mir heute leider den BKA Trojaner eingefangen. Der Gallerie nach müsste es sich um Version 1.03 handeln.

    Nach befolgen der ersten 6 Schritte eurer Anleitung zum entfernen, kann ich nun als Administrator wieder auf den Desktop zugreifen. Allerdings komme ich nun bei Schritt 7 nicht weiter, da "DisableTaskmgr" nicht in der Registry gefunden werden kann.

    Habe jetzt OTL und Malwarebytes durchlaufen lassen. Hier sind die Logfiles:


    Malwarebytes:
    Code:
    Malwarebytes Anti-Malware (Test) 1.61.0.1400
    www.malwarebytes.org
    
    Datenbank Version: v2012.04.17.04
    
    Windows Vista Service Pack 2 x86 NTFS
    Internet Explorer 9.0.8112.16421
    Administrator :: HP-PC [Administrator]
    
    Schutz: Aktiviert
    
    17.04.2012 18:29:56
    mbam-log-2012-04-17 (21-32-52).txt
    
    Art des Suchlaufs: Vollständiger Suchlauf
    Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
    Deaktivierte Suchlaufeinstellungen: P2P
    Durchsuchte Objekte: 398814
    Laufzeit: 2 Stunde(n), 19 Minute(n), 29 Sekunde(n)
    
    Infizierte Speicherprozesse: 0
    (Keine bösartigen Objekte gefunden)
    
    Infizierte Speichermodule: 0
    (Keine bösartigen Objekte gefunden)
    
    Infizierte Registrierungsschlüssel: 12
    HKCR\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKCR\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    
    Infizierte Registrierungswerte: 2
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: VShareTB -> Keine Aktion durchgeführt.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Keine Aktion durchgeführt.
    
    Infizierte Dateiobjekte der Registrierung: 1
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (http://startsear.ch/?aff=1&cf=2f849b4b-12d2-11e1-9c3c-001f16512cc6) Gut: (http://www.google.com) -> Keine Aktion durchgeführt.
    
    Infizierte Verzeichnisse: 0
    (Keine bösartigen Objekte gefunden)
    
    Infizierte Dateien: 1
    C:\Program Files\vShare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Keine Aktion durchgeführt.
    
    (Ende)

    OTL:
    Code:
    OTL logfile created on: 17.04.2012 18:38:40 - Run 1
    OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Administrator\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
     
    3,00 Gb Total Physical Memory | 1,70 Gb Available Physical Memory | 56,68% Memory free
    6,22 Gb Paging File | 4,77 Gb Available in Paging File | 76,72% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]
     
    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 223,90 Gb Total Space | 125,78 Gb Free Space | 56,18% Space Free | Partition Type: NTFS
    Drive D: | 8,98 Gb Total Space | 1,66 Gb Free Space | 18,47% Space Free | Partition Type: NTFS
     
    Computer Name: HP-PC | User Name: Administrator | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
     
    ========== Processes (SafeList) ==========
     
    PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
    PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
    PRC - C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
    PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
    PRC - C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe (Memeo)
    PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
    PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    PRC - C:\WINDOWS\SMINST\BLService.exe ()
    PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
     
     
    ========== Modules (No Company Name) ==========
     
    MOD - C:\WINDOWS\System32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
    MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
    MOD - C:\Program Files\WinRAR\RarExt.dll ()
    MOD - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSchMgr.dll ()
    MOD - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll ()
    MOD - C:\Program Files\HP\QuickPlay\Kernel\TV\CLTinyDB.dll ()
    MOD - C:\Program Files\Common Files\LightScribe\QtGui4.dll ()
    MOD - C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()
    MOD - C:\Program Files\Common Files\LightScribe\QtCore4.dll ()
     
     
    ========== Win32 Services (SafeList) ==========
     
    SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
    SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
    SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
    SRV - (SeagateDashboardService) -- C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe (Memeo)
    SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
    SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
    SRV - (Recovery Service for Windows) -- C:\WINDOWS\SMINST\BLService.exe ()
    SRV - (ezSharedSvc) -- C:\WINDOWS\System32\ezsvc7.dll (EasyBits Sofware AS)
    SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
     
     
    ========== Driver Services (SafeList) ==========
     
    DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
    DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
    DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
    DRV - (MBAMSwissArmy) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
    DRV - (MBAMProtector) -- C:\WINDOWS\System32\drivers\mbam.sys (Malwarebytes Corporation)
    DRV - (nmwcd) -- C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
    DRV - (UsbserFilt) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
    DRV - (upperdev) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
    DRV - (nmwcdnsu) -- C:\WINDOWS\System32\drivers\nmwcdnsu.sys (Nokia)
    DRV - (nmwcdc) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
    DRV - (nmwcdnsuc) -- C:\WINDOWS\System32\drivers\nmwcdnsuc.sys (Nokia)
    DRV - (LGSHidFilt) -- C:\WINDOWS\System32\drivers\LGSHidFilt.Sys (Logitech Inc.)
    DRV - (cpuz135) -- C:\WINDOWS\System32\drivers\cpuz135_x32.sys (CPUID)
    DRV - (dtsoftbus01) -- C:\WINDOWS\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
    DRV - (avipbb) -- C:\WINDOWS\System32\drivers\avipbb.sys (Avira GmbH)
    DRV - (avgntflt) -- C:\WINDOWS\System32\drivers\avgntflt.sys (Avira GmbH)
    DRV - (NPF) -- C:\WINDOWS\System32\drivers\npf.sys (CACE Technologies, Inc.)
    DRV - (ssmdrv) -- C:\WINDOWS\System32\drivers\ssmdrv.sys (Avira GmbH)
    DRV - (FsUsbExDisk) -- C:\WINDOWS\System32\FsUsbExDisk.Sys ()
    DRV - (LGVirHid) -- C:\WINDOWS\System32\drivers\LGVirHid.sys (Logitech Inc.)
    DRV - (LGBusEnum) -- C:\WINDOWS\System32\drivers\LGBusEnum.sys (Logitech Inc.)
    DRV - (nvlddmkm) -- C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
    DRV - (athr) -- C:\WINDOWS\System32\drivers\athr.sys (Atheros Communications, Inc.)
    DRV - (pccsmcfd) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
    DRV - (RTL8169) -- C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
    DRV - (NVHDA) -- C:\WINDOWS\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
    DRV - (CnxtHdAudService) -- C:\WINDOWS\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
    DRV - (XAudio) -- C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
    DRV - (HpqKbFiltr) -- C:\WINDOWS\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
    DRV - (NVENETFD) -- C:\WINDOWS\System32\drivers\nvm60x32.sys (NVIDIA Corporation)
    DRV - (speedfan) -- C:\WINDOWS\System32\speedfan.sys (Windows (R) 2000 DDK provider)
    DRV - (giveio) -- C:\WINDOWS\System32\giveio.sys ()
     
     
    ========== Standard Registry (SafeList) ==========
     
     
    ========== Internet Explorer ==========
     
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Presario&pf=cnnb
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=2f849b4b-12d2-11e1-9c3c-001f16512cc6
    IE - HKLM\..\SearchScopes,DefaultScope = {9612C83E-DEB3-4FAD-9ECA-4981A6FFD065}
    IE - HKLM\..\SearchScopes\{14A734C6-F2F9-442F-961B-BB03E74D0775}: "URL" = http://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
    IE - HKLM\..\SearchScopes\{AA5EB92A-B272-4BF9-B275-AB47FF798B14}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
     
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Presario&pf=cnnb
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Presario&pf=cnnb
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
     
    ========== FireFox ==========
     
    FF - user.js - File not found
     
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files\TVUPlayer\npTVUAx.dll (TVU networks)
    FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
    FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
    FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
     
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.02.12 11:34:38 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fe_9.0@nokia.com: C:\Program Files\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_9.0 [2012.01.26 09:32:52 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.09 20:10:43 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.20 08:37:08 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.31 23:33:59 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.09.02 23:05:00 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012.01.26 09:32:59 | 000,000,000 | ---D | M]
     
    [2012.04.17 18:25:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions
    [2012.02.12 23:08:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2012.03.20 08:37:08 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
    [2012.01.23 12:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
    [2011.10.03 11:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll
    [2011.03.17 21:57:30 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
    [2012.01.10 11:27:13 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
    [2012.01.10 11:27:13 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2012.01.10 11:27:13 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
    [2012.01.10 11:27:13 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
    [2012.01.10 11:27:13 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
    [2012.01.10 11:27:13 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
     
    O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1       localhost
    O1 - Hosts: ::1             localhost
    O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll (www.flashget.com)
    O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.)
    O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll (www.flashget.com)
    O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.)
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
    O4 - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [NPSStartup]  File not found
    O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
    O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
    O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
    O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (FlashGet.com)
    O13 - gopher Prefix: missing
    O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
    O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{257E2743-7221-41CB-B1B9-0E05F389EBD7}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8115C900-C183-4B85-B0B2-7D103BC5B897}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Dots.jpg
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Dots.jpg
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
     
    ========== Files/Folders - Created Within 30 Days ==========
     
    [2012.04.17 18:29:02 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2012.04.17 18:29:01 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
    [2012.04.17 18:28:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2012.04.17 18:28:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2012.04.17 18:28:36 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2012.04.17 18:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2012.04.17 18:27:52 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
    [2012.04.17 18:26:55 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Macromedia
    [2012.04.17 18:26:55 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Adobe
    [2012.04.17 18:25:48 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Mozilla
    [2012.04.17 18:25:48 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Mozilla
    [2012.04.17 18:06:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Logitech
    [2012.04.17 18:05:27 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    [2012.04.17 18:05:27 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Searches
    [2012.04.17 18:05:27 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    [2012.04.17 18:05:14 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Identities
    [2012.04.17 18:05:11 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Contacts
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Vorlagen
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Verlauf
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Temporary Internet Files
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Startmenü
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\SendTo
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Recent
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Netzwerkumgebung
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Lokale Einstellungen
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Videos
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Musik
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Eigene Dateien
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Bilder
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Druckumgebung
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Cookies
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Anwendungsdaten
    [2012.04.17 18:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Anwendungsdaten
    [2012.04.17 18:05:02 | 000,000,000 | --SD | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Videos
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Saved Games
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Pictures
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Music
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Links
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Favorites
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Downloads
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Documents
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Desktop
    [2012.04.17 18:05:02 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    [2012.04.17 18:05:02 | 000,000,000 | -H-D | C] -- C:\Users\Administrator\AppData
    [2012.04.17 18:05:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Temp
    [2012.04.17 18:05:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Microsoft
    [2012.04.17 18:05:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Media Center Programs
    [2012.04.17 18:05:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam
    [2012.04.17 18:05:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
    [2012.04.14 09:25:24 | 004,139,680 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerInstaller.exe
    [2012.04.11 22:55:45 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
    [2012.04.11 22:55:43 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
    [2012.04.11 22:55:43 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
    [2012.04.11 22:55:42 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
    [2012.04.11 22:55:42 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
    [2012.04.11 22:55:41 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
    [2012.04.11 22:55:06 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
    [2012.04.11 22:55:06 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
    [2012.04.10 07:44:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
    [2012.04.10 07:44:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
    [2012.04.10 07:44:08 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
    [2012.04.04 06:39:46 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
     
    ========== Files - Modified Within 30 Days ==========
     
    [2012.04.17 18:29:26 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2012.04.17 18:28:38 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012.04.17 18:27:55 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
    [2012.04.17 18:25:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
    [2012.04.17 18:09:14 | 000,048,695 | ---- | M] () -- C:\ProgramData\nvModes.dat
    [2012.04.17 18:09:13 | 000,048,695 | ---- | M] () -- C:\ProgramData\nvModes.001
    [2012.04.17 18:08:02 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
    [2012.04.17 18:08:02 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2012.04.17 18:08:02 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
    [2012.04.17 18:08:02 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2012.04.17 18:05:44 | 000,000,249 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
    [2012.04.17 18:05:38 | 000,007,808 | ---- | M] () -- C:\Users\Administrator\AppData\Local\d3d9caps.dat
    [2012.04.17 18:00:34 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2012.04.17 18:00:34 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2012.04.17 18:00:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012.04.17 18:00:24 | 3218,280,448 | -HS- | M] () -- C:\hiberfil.sys
    [2012.04.17 17:51:11 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
    [2012.04.17 17:46:00 | 000,002,774 | ---- | M] () -- C:\Users\Public\Documents\DME-SETTINGS.xml
    [2012.04.17 17:46:00 | 000,000,294 | ---- | M] () -- C:\Windows\tasks\DMEPeriodicTask.job
    [2012.04.14 09:25:26 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
    [2012.04.14 09:25:26 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
    [2012.04.14 09:25:24 | 004,139,680 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerInstaller.exe
    [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2012.04.01 10:11:12 | 000,000,310 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForHP.job
    [2012.03.19 08:40:18 | 000,001,845 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Suite.lnk
     
    ========== Files Created - No Company Name ==========
     
    [2012.04.17 18:28:38 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012.04.17 18:05:38 | 000,007,808 | ---- | C] () -- C:\Users\Administrator\AppData\Local\d3d9caps.dat
    [2012.04.17 18:05:28 | 000,000,909 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    [2012.04.17 18:05:25 | 000,000,904 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
    [2012.04.17 18:05:11 | 000,000,875 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
    [2012.04.04 06:39:47 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
    [2012.01.03 09:28:06 | 002,570,286 | ---- | C] () -- C:\Windows\System32\abgx360.exe
    [2011.06.23 20:11:52 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
    [2011.06.23 20:11:51 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
    [2011.06.12 19:29:24 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
    [2011.06.10 15:46:36 | 000,000,046 | ---- | C] () -- C:\Windows\System32\DonationCoder_urlsnooper_InstallInfo.dat
    [2011.02.12 11:22:31 | 000,179,490 | ---- | C] () -- C:\Windows\hpoins38.dat
    [2011.02.06 16:08:38 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
    [2011.02.04 09:00:35 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
    [2011.01.28 19:47:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2011.01.28 19:47:54 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2011.01.27 21:42:57 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2011.01.13 12:58:57 | 000,048,695 | ---- | C] () -- C:\ProgramData\nvModes.001
    [2011.01.13 12:58:37 | 000,048,695 | ---- | C] () -- C:\ProgramData\nvModes.dat
    [2010.06.25 19:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
    
    < End of report >
    Extra
    Code:
    OTL Extras logfile created on: 17.04.2012 18:38:40 - Run 1
    OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Administrator\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
     
    3,00 Gb Total Physical Memory | 1,70 Gb Available Physical Memory | 56,68% Memory free
    6,22 Gb Paging File | 4,77 Gb Available in Paging File | 76,72% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]
     
    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 223,90 Gb Total Space | 125,78 Gb Free Space | 56,18% Space Free | Partition Type: NTFS
    Drive D: | 8,98 Gb Total Space | 1,66 Gb Free Space | 18,47% Space Free | Partition Type: NTFS
     
    Computer Name: HP-PC | User Name: Administrator | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
     
    ========== Extra Registry (SafeList) ==========
     
     
    ========== File Associations ==========
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
     
    ========== Shell Spawning ==========
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
    Directory [cmd] -- cmd.exe /s /k pushd "%V"
    Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
    Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
    Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
     
    ========== Security Center Settings ==========
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "UacDisableNotify" = 0
    "InternetSettingsDisableNotify" = 0
    "AutoUpdateDisableNotify" = 0
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 1
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 1
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 1
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
     
    ========== Firewall Settings ==========
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
     
    ========== Authorized Applications List ==========
     
     
    ========== Vista Active Open Ports Exception List ==========
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{7FD1C920-8721-4747-B5C8-7A470E0E0A72}" = lport=2869 | protocol=6 | dir=in | app=system | 
    "{DA04B34E-9E32-4807-9A18-354E9760B21C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
    "{DB19B263-23AA-4C44-99DD-8A3B07C6DE0B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
     
    ========== Vista Active Application Exception List ==========
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{05A44B42-B0CF-494A-BA1C-E8A862906D7A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
    "{0871324A-07AA-4294-A961-2BF38A9DB4D3}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 
    "{1214A389-7CEA-40BE-8EE4-16B380743A55}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
    "{2B23B81A-83A1-4C97-B154-16B67B2573BD}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
    "{2F1CB3EA-E314-4DEE-972F-859A3AC3DADD}" = protocol=6 | dir=in | app=c:\program files\veetle\player\veetlenet.exe | 
    "{471CC324-3203-4A69-BA51-4D6A4ACD32F8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
    "{4A98AFDE-F754-4B87-A2CB-6E31C7B35BD4}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
    "{4D1AF291-1511-4277-8182-08D75D2D93A4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
    "{5D762E25-0495-4462-8BCE-86E0E25B21C2}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
    "{60F671F9-489E-46D2-87EB-BF2E6B5FB04A}" = protocol=6 | dir=in | app=c:\program files\pplive\pplive.exe | 
    "{6E801DEC-57EE-4FC7-BE2B-F3B85F3225A2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
    "{778305F3-3BA5-47D5-B7FB-50EDE1158D60}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
    "{91760CA6-46BB-49D4-8B05-D02DF5F85C20}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
    "{96D2C063-04EF-4EBA-8466-9D19B34E9F8F}" = protocol=17 | dir=in | app=c:\program files\pplive\pplive.exe | 
    "{96F9C7BC-54C6-4448-B7C7-33F3CDCA8272}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
    "{A6C07479-5CED-4D0C-89DE-8D9A1D296D68}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
    "{AAA92D6B-C633-48BF-AE76-92F379CB11E2}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 
    "{AC011C9B-F913-472D-9918-1465CDB93988}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
    "{B53EA66E-6473-44FC-BC96-8E3A82BD57F1}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
    "{BC3BE50D-3E88-424B-B097-7EBCF60C886F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
    "{C9B090FB-EE64-49BC-B96D-4212998E7C52}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
    "{D26CBDFB-63BD-48A8-B2B8-D439472B9831}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
    "{D331611B-8CD0-4CCB-9289-D8260D7EFBA4}" = dir=in | app=c:\program files\seagate\seagate dashboard\hipservagent\hipservagent.exe | 
    "{DCF0E75E-D281-49BF-B4AA-405EDBED62B4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
    "{EE9C65C5-B741-4025-8E0F-733BD230EED5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
    "TCP Query User{0E114D59-7DF9-4C85-8EAC-54583798CA26}C:\program files\java\jre1.6.0_05\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_05\bin\javaw.exe | 
    "TCP Query User{100A6A87-293B-4C59-87BE-14C0346F9A84}C:\program files\java\jre1.6.0_05\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_05\bin\java.exe | 
    "TCP Query User{212969BD-12B6-473E-9E16-844AFFD7C526}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
    "TCP Query User{21A41E17-6B18-4B7C-AB1E-0020DA20CCBB}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
    "TCP Query User{24242F4B-FFDB-4306-B4F7-10BBB420B5C9}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
    "TCP Query User{2F69F833-BD32-432E-8203-E09268C57F2B}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
    "TCP Query User{2FFFE5E7-7B5F-4262-99FF-1077E4FB53ED}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
    "TCP Query User{3F6C9781-4B0D-44D7-B6EA-2E15850941C2}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
    "TCP Query User{4F6BD91C-DCEC-4F49-B8F7-E64963FB3451}C:\program files\flashget\flashget.exe" = protocol=6 | dir=in | app=c:\program files\flashget\flashget.exe | 
    "TCP Query User{5087A69D-AC75-40F4-8ED4-5B9F4636806C}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 
    "TCP Query User{68574056-52E0-4EAE-A329-14DF64F4E911}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
    "TCP Query User{6E6E1EDC-97B4-4C8B-AF05-BCF803645748}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
    "TCP Query User{A4F8002C-9142-4037-AB5E-FCB48B2387AC}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
    "TCP Query User{A6839171-7F7E-4192-A095-2A2E571FF6AD}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
    "TCP Query User{BD4ED13A-4489-4529-90CF-0DC5E669C5A5}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
    "TCP Query User{D499A352-5AD6-4F27-A7E5-980A2EAA04CB}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
    "TCP Query User{D7E905E6-63E5-43E8-A7A3-959C96E22688}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
    "TCP Query User{E1391F0F-C189-4226-BACC-BAA8B6D9D760}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
    "TCP Query User{F6140CAF-23A2-4FE8-9111-E455A9D5F3FA}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 
    "UDP Query User{05F0F202-CCF3-47D9-A47B-F3019CFB131F}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
    "UDP Query User{06000375-BDB6-4069-B4EB-620CFF26ECA3}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
    "UDP Query User{333CC4A0-24E6-4031-9C60-044A1AD160F5}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
    "UDP Query User{3A8EE0D2-8D9A-47CD-A5F2-82BE0429678C}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
    "UDP Query User{408EDE54-C0EF-4A13-BBEA-8D6C2A3F0D81}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
    "UDP Query User{4DC97AFC-7CC7-49CD-AB25-8CF3C6870ECB}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
    "UDP Query User{63CE77EB-E588-418F-9A47-50FAF5862FFD}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
    "UDP Query User{78BF7428-3C07-49C7-8732-8645EEBEB27A}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
    "UDP Query User{819B84A5-1B87-40FC-91B2-8473DB2B8290}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
    "UDP Query User{8602C3A2-3E49-437F-B878-B63ED575FFF2}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
    "UDP Query User{9E59725D-95A9-423A-A09B-11073F5BD15E}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 
    "UDP Query User{A8B69660-4650-4D6F-9439-82B4303C58DE}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
    "UDP Query User{C7D266EB-D41E-4CCC-992E-4A0E4822FA55}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
    "UDP Query User{D4A39E26-7712-4010-BEA0-7CC6DD5FE738}C:\program files\flashget\flashget.exe" = protocol=17 | dir=in | app=c:\program files\flashget\flashget.exe | 
    "UDP Query User{D83B6D55-1D51-4FC2-B3BC-8692594290B4}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
    "UDP Query User{E58A6EC3-01B8-4C58-92F9-E88B55038C5E}C:\program files\java\jre1.6.0_05\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_05\bin\javaw.exe | 
    "UDP Query User{F27E7B34-B56E-442F-AD1D-7D33F2DA724F}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
    "UDP Query User{F8340B8C-BC48-4DB0-9142-1CCB242379B0}C:\program files\java\jre1.6.0_05\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_05\bin\java.exe | 
    "UDP Query User{F889A938-FE53-4C38-A700-DCA119AB7DDA}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 
     
    ========== HKEY_LOCAL_MACHINE Uninstall List ==========
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
    "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
    "{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
    "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
    "{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
    "{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
    "{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
    "{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
    "{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
    "{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
    "{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 30
    "{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
    "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
    "{340F521E-3576-4E1A-B75C-EB0ACF751379}" = HP Wireless Assistant
    "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 F1
    "{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
    "{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
    "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
    "{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
    "{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
    "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.7
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
    "{4AA68A73-DB9C-439D-9481-981C82BD008B}" = Nokia Connectivity Cable Driver
    "{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}" = HP Easy Setup - Frontend
    "{582287DA-0806-4AC0-BF19-C15E3A466034}" = LightScribe System Software  1.12.33.2
    "{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
    "{61CF2C86-8E46-4210-A115-E4D6C65AF369}" = HP Photosmart B109a-m All-In-One Driver Software 13.0 Rel .6
    "{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
    "{656FDFA4-C7C6-40D9-99F7-F6F331412AEF}" = WarrantyExtension
    "{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
    "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
    "{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
    "{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
    "{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
    "{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
    "{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{80FE5490-E9DD-4AE9-8537-3EB5EFB606FC}" = PS_AIO_06_B109a-m_SW_Min
    "{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
    "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
    "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
    "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
    "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
    "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
    "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
    "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
    "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
    "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
    "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
    "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
    "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
    "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
    "{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
    "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
    "{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
    "{92D1CEBC-7C72-4ECF-BFC6-C131EF3FE6A7}" = Nokia Suite
    "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
    "{93FF055C-7E0B-4E26-AAFB-2C4333E2D7D0}" = Logitech Gaming Software
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9E2CCD5E-1990-4EF2-9B61-32F0BBACC29B}" = HP Active Support Library
    "{A2AA4204-C05A-4013-888A-AD153139297F}" = PC Connectivity Solution
    "{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
    "{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
    "{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
    "{AF20390E-5ADD-4CB0-BF9D-EDF6E7891AD9}" = B109a-m
    "{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}" = HP Customer Experience Enhancements
    "{B3276CB1-20B6-4AF9-AAEC-E72C83816495}" = IKEA Home Planner
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B6D0B141-B2BE-4DD0-B08F-B9186F3E36B3}" = HP User Guides 0118
    "{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
    "{C3A11907-930D-41AC-A135-CC3B12F92011}" = Seagate Dashboard
    "{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
    "{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
    "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
    "{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
    "{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
    "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
    "{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
    "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
    "{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update
    "{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}" = HP Help and Support
    "{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
    "{ec4b6105-e039-42fb-8e18-c8aa393f0018}_is1" = VshareComplete
    "{f32502b5-5b64-4882-bf61-77f23edcac4f}" = HP Total Care Advisor
    "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
    "{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
    "{FDA3AF83-4C36-4D9C-89C4-A5C71E2CF997}_is1" = ComunioCalci 1.5.1
    "504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
    "abgx360" = abgx360 v1.0.6
    "AC3Filter_is1" = AC3Filter 1.63b
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
    "ANSTOSS 2" = ANSTOSS 2
    "ANSTOSS 3_is1" = ANSTOSS 3
    "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
    "Blobby Volley 2.0 Version 0.9c_is1" = Blobby Volley 2.0 Version 0.9c
    "CCleaner" = CCleaner
    "CNXT_AUDIO_HDA" = Conexant HD Audio
    "CNXT_MODEM_HDAUDIO_HERMOSA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
    "CPUID CPU-Z_is1" = CPUID CPU-Z 1.59
    "DAEMON Tools Lite" = DAEMON Tools Lite
    "DivX Setup.divx.com" = DivX-Setup
    "dm-Fotowelt" = dm-Fotowelt
    "ENTERPRISE" = Microsoft Office Enterprise 2007
    "FlashGet" = FlashGet 1.9.0.1012
    "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8
    "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206
    "HP Imaging Device Functions" = HP Imaging Device Functions 13.0
    "HP Print Projects" = HP Print Projects 1.0
    "HP Smart Web Printing" = HP Smart Web Printing 4.5
    "HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
    "HPExtendedCapabilities" = HP Customer Participation Program 13.0
    "ImgBurn" = ImgBurn
    "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
    "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
    "IrfanView" = IrfanView (remove only)
    "JDownloader" = JDownloader
    "Logitech Gaming Software" = Logitech Gaming Software 8.20
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
    "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
    "Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
    "Mozilla Thunderbird 11.0.1 (x86 de)" = Mozilla Thunderbird 11.0.1 (x86 de)
    "Mp3tag" = Mp3tag v2.49a
    "Nokia Suite" = Nokia Suite
    "NVIDIA Drivers" = NVIDIA Drivers
    "Passbild-Generator_is1" = Bewerbungsfoto-/Passbild-Generator v3.5a
    "PPLive" = PPLive 1.9
    "Shop for HP Supplies" = Shop for HP Supplies
    "SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.6
    "SopCast" = SopCast 3.3.2
    "SpeedFan" = SpeedFan (remove only)
    "Sweet Home 3D_is1" = Sweet Home 3D version 3.2
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "TIPP10_is1" = TIPP10 Version 2.1.0
    "Trillian" = Trillian
    "TVUPlayer" = TVUPlayer 2.5.3.1
    "Uninstall_is1" = Uninstall 1.0.0.1
    "URLSnooper 2_is1" = URL Snooper v2.29.01
    "Veetle TV" = Veetle TV
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "VLC media player" = VLC media player 1.1.7
    "vShare.tv plugin" = vShare.tv plugin 1.3
    "Winamp" = Winamp
    "WinPcapInst" = WinPcap 4.1.2
    "WinRAR archiver" = WinRAR
     
    ========== Last 10 Event Log Errors ==========
     
    [ Application Events ]
    Error - 12.04.2012 01:37:57 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 12.04.2012 10:28:46 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 13.04.2012 00:25:14 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 13.04.2012 07:16:01 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 14.04.2012 03:21:09 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 14.04.2012 12:30:27 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 15.04.2012 03:11:35 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 16.04.2012 01:16:06 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 17.04.2012 00:26:09 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    Error - 17.04.2012 07:11:26 | Computer Name = HP-PC | Source = WinMgmt | ID = 10
    Description = 
     
    [ OSession Events ]
    Error - 18.10.2011 02:50:05 | Computer Name = HP-PC | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
     12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 913
     seconds with 300 seconds of active time.  This session ended with a crash.
     
    [ System Events ]
    Error - 12.04.2012 10:28:47 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 13.04.2012 00:25:14 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 13.04.2012 07:16:01 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 14.04.2012 03:21:09 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 14.04.2012 12:30:28 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 15.04.2012 03:11:35 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 16.04.2012 01:16:06 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 17.04.2012 00:26:10 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 17.04.2012 07:11:26 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
    Error - 17.04.2012 12:00:56 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000
    Description = 
     
     
    < End of report >

    Vielen Dank schonmal für eure Hilfe

    MfG

    Jan

  2. #2
    Moped 2000 Avatar von MG
    Registriert seit
    24.08.2011
    Beiträge
    2.216
    Hallo Larry1847,

    herzlich willkommen in unserem Forum

    Bitte die Funde bei Malwarebytes löschen lassen.
    Die Logfiles von OTL schaue ich mir an und melde mich gleich.

  3. #3
    Einsteiger
    Registriert seit
    17.04.2012
    Beiträge
    4
    Habe die Funde gelöscht.

    Danke für die schnelle Hilfe! Echt super!

  4. #4
    Moped 2000 Avatar von MG
    Registriert seit
    24.08.2011
    Beiträge
    2.216
    Die OTL Logs sind soweit ungefährlich. Läuft dein PC ? Gibt es noch Probleme?

  5. #5
    Einsteiger
    Registriert seit
    17.04.2012
    Beiträge
    4
    Hatte mich nach dem Suchlauf mit Malwarebytes bisher nicht getraut den Rechner wieder mit meinem normalen Benutzerkonto anzumelden. Bin heute Vormittag erstmal auf der Arbeit, aber werde es heute am frühen Nachmittag ausprobieren.

  6. #6
    Einsteiger
    Registriert seit
    17.04.2012
    Beiträge
    4
    So, ich kann mich jetzt wieder ganz normal mit meinem normalen Benutzer Konto anmelden. Vom BKA Trojaner ist keine Spur mehr.

    Gibt es etwas, dass ich jetzt zur Sicherheit noch tun sollte?

  7. #7
    Moped 2000 Avatar von MG
    Registriert seit
    24.08.2011
    Beiträge
    2.216
    Ja, bitte hier deine Plugins auf Aktualität prüfen und ggf. updaten.

  8. #8
    Generation C64 Avatar von CG
    Registriert seit
    31.08.2011
    Ort
    Kölle
    Beiträge
    3.879
    Dann schliesse ich den Thread an dieser Stelle mit unseren Tipps:

    Lesenswerte Blogbeiträge zur Absicherung des Rechners

    Ausgewählte Blogbeiträge:
    Grüße
    CG (ABBZ)
    .
    .
    .

    ABBZ | Botfrei-Blog | facebook | twitter | Google+
    Kein Support über PN oder Mail!

Ähnliche Themen

  1. GVU 2.07 Windows Vista
    Von BausA im Forum Archiv
    Antworten: 1
    Letzter Beitrag: 08.10.2012, 22:52
  2. bka 1.13, windows vista 32 bit
    Von felifix83 im Forum Archiv
    Antworten: 1
    Letzter Beitrag: 30.09.2012, 23:35
  3. Windows Vista GVU 2.07
    Von renizzle im Forum Archiv
    Antworten: 13
    Letzter Beitrag: 23.09.2012, 18:56
  4. Windows Vista GVU 2.07
    Von cuckoo im Forum Unvollständig / Fehlendes Feedback
    Antworten: 2
    Letzter Beitrag: 14.09.2012, 08:57
  5. Antworten: 1
    Letzter Beitrag: 16.01.2012, 22:02

Lesezeichen

Berechtigungen

  • Neue Themen erstellen: Nein
  • Themen beantworten: Nein
  • Anhänge hochladen: Nein
  • Beiträge bearbeiten: Nein
  •  
G Data
forum.botfrei.de wird überprüft von der Initiative-S