Hallo,
habe Avira, Bezahlversion.
Vista 32 bit
vorhin den OTL scan gemacht, poste im Anschluß.
Defogger hat keine Meldung gebracht, habe ungeschickter Weise 2 x laufen lassen.
Die Windows- Firewall ist nach jedem Hochfahren/ Bereitschaftsstart seit einiger Zeit ausgeschaltet.
Der tmp.edb wurde schon 6 x in Quarantäne verschoben, wird jedesmal wieder gefunden.

PS: Schönen Gruß an ARNE, der mir das letzte Mal sehr geholfen hat.
Donation hatte ich nicht vergessen, auch diesmal gerne wieder.
Ihr seid jeden Cent wert!!

von Stefan

OTL Extras logfile created on: 08.03.2012 07:56:21 - Run 4
OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\stefan\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,87 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 42,22% Memory free
3,98 Gb Paging File | 2,57 Gb Available in Paging File | 64,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,21 Gb Total Space | 30,20 Gb Free Space | 25,98% Space Free | Partition Type: NTFS
Drive E: | 115,21 Gb Total Space | 55,74 Gb Free Space | 48,39% Space Free | Partition Type: NTFS

Computer Name: STEFANS-PC | User Name: stefan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C8D1522-7E32-4BC0-BE14-D90FB4825D3C}" = rport=139 | protocol=6 | dir=out | app=system |
"{144A587B-9B81-410D-8273-00DBD342F077}" = lport=139 | protocol=6 | dir=in | app=system |
"{15E8C7F0-1F48-4F97-94A4-5D1AFA70070A}" = rport=445 | protocol=6 | dir=out | app=system |
"{1932CA5D-3CA1-4DB4-B302-A6EEF8554BEC}" = rport=137 | protocol=17 | dir=out | app=system |
"{2C88C1E2-BC5D-47B2-9F47-1A946A8E38F5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2F928AA8-8801-42A7-AA89-28B122243FFA}" = lport=138 | protocol=17 | dir=in | app=system |
"{4001BB15-D4FD-4FD8-A357-0F3B7106D3E1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{580834CE-2A4F-4316-A2CA-A3C095E416DF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{65D5C019-7B04-49AA-B130-EDCA2C0EEE5C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6B6A5499-D5A3-48F4-9126-9715B34DD59C}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8A90567F-4AE3-42FE-B5AE-89F912CCC731}" = lport=445 | protocol=6 | dir=in | app=system |
"{8DD54E4E-767F-47B8-A79A-AA0C8EBD83C1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{905A52E1-2634-4A7B-9A83-8119D3B2B28B}" = rport=138 | protocol=17 | dir=out | app=system |
"{9975C84E-BCB3-4EC0-B2EF-AD4E3A6AE4AA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9B867489-881B-433B-95DA-1B94D2E11C36}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A10545C0-5E04-4098-84C2-3677BDD2D91B}" = lport=137 | protocol=17 | dir=in | app=system |
"{D1C5570F-FFAD-41BB-918F-32153DCE5FDA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{D3B68AC1-F456-46C6-91CA-328C53962859}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01E5080F-98CB-430A-A700-4866A7116DB1}" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{13DD5DD0-242D-4BD0-AD59-EB167D755AB0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1249422293\ee\aolsoftware.exe |
"{3ABB71A2-B77E-4862-BD45-6CBDF152890E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{3B4D169D-816A-4853-9AEA-E87082F3E7F6}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3D253078-0B37-493F-B867-E84686DDB605}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{4FD33549-8904-4FEB-B1AC-0E898D60945D}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{57CAB3DC-7D38-480F-8185-99F6D1BAC92B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5E0AAAA4-47E7-4B69-97CE-ECEB650BB37E}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{614C1272-D968-4E00-9A09-1ADA4EDCD6E8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6577F43D-5FAF-498F-9B1B-6E103D88CBD4}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{6A5FF6A2-3CB1-4508-8407-1BD472886E93}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6EE9B36D-A153-411F-A127-454CA12D5EB1}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{946B46CB-D380-4AD6-BA51-8AB8E5286164}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{95620E1D-8F8E-40B7-B156-0324ECBC5C16}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{97D38C72-E4C0-4CE3-A241-676749934343}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AAC9DA1C-CDC9-4444-83A0-30A736C2A00D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{B6368EF1-F57A-412F-B0CB-70951CBF0685}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{BFBA3987-05FD-4532-8978-5C2160C4F028}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{C58721FE-FB8D-486D-AB3A-C835BA267A93}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{C638E927-AD9D-4C8B-8407-DD3384F539F9}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{CDCCC0EA-DF3A-4935-8610-D870BE4F20F0}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{D243E28D-554C-41DF-8F51-950416EDBF04}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{DB2C8F83-719E-4246-B239-E199E638F5B6}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{DB88F476-CEC9-4DCC-9ADA-F721C0E8A02D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{E50FBE1F-CEFA-4DF3-A152-63A4EA064B56}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1249422293\ee\aolsoftware.exe |
"{ECC293F9-732B-4CBF-80E3-D6599AC591AE}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{F42E7EF1-35A8-4EEE-9760-64EAC5232840}" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{02CA24DD-C8B0-4280-BE53-7862869C2EB1}" = Realtek WiFi Protected Setup Library
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree
"{0D8E81A5-B61C-4360-910C-A738FD1B220A}" = Toshiba TEMPRO
"{0FB630AB-7BD8-40AE-B223-60397D57C3C9}" = Realtek WLAN Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{22DD005D-0EF1-4E3E-92F8-49D89E31479A}" = 1400
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 29
"{2883F6F5-0509-43F3-868C-D50330DD9DD3}" = TOSHIBA Hardware Setup
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{46C4591A-C135-482B-B653-06D67A94DA8B}_is1" = Videograbber5.3
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B1E87C3-00DE-4898-8E39-E390AAEF2391}" = TOSHIBA Supervisor Password
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A3C2391-BCE2-4D28-A336-73B953B4502F}" = 1400Trb
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6FBE200D-1F00-40B7-BF48-FEB265AADE94}" = 1400_Help
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{895722FE-25FE-4854-95AC-B0C42F9DBEDA}" = REALTEK RTL8187B Wireless LAN Driver
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}" = Vodafone Mobile Connect Lite
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Music Transfer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.14
"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AOL Toolbar 4.0" =
"Avira AntiVir Desktop" = Avira Internet Security 2012
"Browser Defender_is1" = Browser Defender 3.0
"DivX Setup.divx.com" = DivX-Setup
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.0.1
"GOM Player" = GOM Player
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"o2DE" = Mobile Connection Manager
"Picasa 3" = Picasa 3
"RealPlayer 12.0" = RealPlayer
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"SumatraPDF" = SumatraPDF
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"TUGZip_is1" = TUGZip 3.5
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.1.10
"ZTE USB Driver" = ZTE USB Driver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 23.02.2012 03:50:12 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4805

Error - 23.02.2012 03:50:12 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4805

Error - 24.02.2012 13:56:56 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 24.02.2012 13:56:57 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 766121

Error - 24.02.2012 13:56:57 | Computer Name = stefans-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 766121

Error - 24.02.2012 22:23:49 | Computer Name = stefans-PC | Source = WinMgmt | ID = 10
Description =

Error - 25.02.2012 06:12:17 | Computer Name = stefans-PC | Source = WinMgmt | ID = 10
Description =

Error - 27.02.2012 09:18:22 | Computer Name = stefans-PC | Source = WinMgmt | ID = 10
Description =

Error - 27.02.2012 13:03:50 | Computer Name = stefans-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung avcenter.exe, Version 12.1.0.18, Zeitstempel
0x4e7bab7a, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
Ausnahmecode 0xc0150014, Fehleroffset 0x00075e2f, Prozess-ID 0xc6c, Anwendungsstartzeit
01ccf566b34bd18a.

Error - 27.02.2012 14:03:31 | Computer Name = stefans-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung avcenter.exe, Version 12.1.0.18, Zeitstempel
0x4e7bab7a, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
Ausnahmecode 0xc0150014, Fehleroffset 0x00075e2f, Prozess-ID 0x16fc, Anwendungsstartzeit
01ccf57500561b3a.

[ System Events ]
Error - 06.03.2012 07:16:44 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 06.03.2012 07:18:00 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 07.03.2012 07:10:24 | Computer Name = stefans-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.31 für die Netzwerkkarte mit der Netzwerkadresse
001A7342FFF6 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).

Error - 07.03.2012 08:44:31 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 07.03.2012 08:46:01 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 07.03.2012 08:50:15 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 07.03.2012 08:51:25 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 07.03.2012 23:51:59 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 08.03.2012 02:37:31 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 08.03.2012 02:38:55 | Computer Name = stefans-PC | Source = Service Control Manager | ID = 7034
Description =


< End of report >


OTL logfile created on: 08.03.2012 07:56:21 - Run 4
OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\stefan\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,87 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 42,22% Memory free
3,98 Gb Paging File | 2,57 Gb Available in Paging File | 64,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,21 Gb Total Space | 30,20 Gb Free Space | 25,98% Space Free | Partition Type: NTFS
Drive E: | 115,21 Gb Total Space | 55,74 Gb Free Space | 48,39% Space Free | Partition Type: NTFS

Computer Name: STEFANS-PC | User Name: stefan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days

========== Processes (SafeList) ==========

PRC - File not found
PRC - C:\Users\stefan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)A
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
PRC - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D)
PRC - C:\Program Files\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe (TOSHIBA)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)


========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6310a2050033b0b567428ca55bda4a1b\Microsoft.VisualBasic.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\d0cf808e33a5123b33010b933d3b1597\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3951e0a359c004cd6ba268ff78ac62aa\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
MOD - C:\Program Files\TUGZip\Plugins\TzArchive10.tgp ()
MOD - C:\Windows\System32\ztvunrar36.dll ()
MOD - C:\Program Files\TUGZip\TzShell.dll ()
MOD - C:\Program Files\TUGZip\Plugins\TzImage10.tgp ()


========== Win32 Services (SafeList) ==========

SRV - (Freemake Improver) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
SRV - (AntiVirFirewallService) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Browser Defender Update Service) -- C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (TGCM_ImportWiFiSvc) -- C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D)
SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH)
SRV - (SmartFaceVWatchSrv) -- C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
SRV - (TNaviSrv) -- C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) -- File not found
DRV - (NwlnkFlt) -- File not found
DRV - (IpInIp) -- File not found
DRV - (esgiguard) -- File not found
DRV - (catchme) -- File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (avfwot) -- C:\Windows\System32\drivers\avfwot.sys (Avira GmbH)
DRV - (avfwim) -- C:\Windows\System32\drivers\avfwim.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (massfilter_hs) -- C:\Windows\System32\drivers\massfilter_hs.sys (ZTE Incorporated)
DRV - (RTL8187B) -- C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (RtlProt) -- C:\Windows\System32\drivers\RtlProt.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (FwLnk) -- C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{9A284460-6B83-4FC5-9B1D-B3C625C48887}: "URL" = hxxp://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEA;
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {BA778FA4-2DDB-4814-9662-D91BA0D516E1}
IE - HKCU\..\SearchScopes\{9A284460-6B83-4FC5-9B1D-B3C625C48887}: "URL" = hxxp://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7GPEA_de
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\..\SearchScopes\{BA778FA4-2DDB-4814-9662-D91BA0D516E1}: "URL" = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms}
IE - HKCU\..\SearchScopes\{C64A81FB-0C89-4787-BA3B-CF8909B4FAF7}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.funmoods.com"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.2
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.2b
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\stefan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.04.30 23:40:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011.07.08 23:14:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012.02.05 07:42:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.11.14 22:58:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.02.02 17:23:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.17 17:52:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.07 19:35:48 | 000,000,000 | ---D | M]

[2009.08.04 20:29:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\stefan\AppData\Roaming\mozilla\Extensions
[2012.03.06 15:50:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions
[2012.02.11 19:04:02 | 000,000,000 | ---D | M] ("Winamp Toolbar") -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2012.02.14 11:59:13 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.04.30 23:40:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.08 10:29:10 | 000,000,927 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\conduit.xml
[2012.02.02 17:24:05 | 000,001,798 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\funmoods.xml
[2010.09.16 14:21:14 | 000,002,689 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\search-defender.xml
[2009.12.14 05:19:41 | 000,001,246 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\winamp-search.xml
[2012.01.25 18:17:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.02.02 17:23:38 | 000,000,000 | ---D | M] (Freemake Video Converter Plugin) -- C:\PROGRAM FILES\FREEMAKE\FREEMAKE VIDEO CONVERTER\BROWSERPLUGIN\FIREFOX
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\CANITBECHEAPER@TRAFFICBROKER.CO.UK.XPI
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\ISREADITLATER@IDEASHOWER.COM.XPI
[2012.02.17 17:52:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.19 19:03:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.19 19:03:23 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.19 19:03:23 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.19 19:03:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.27 19:40:39 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2011.10.19 19:03:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.19 19:03:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\pdf.dll
CHR - plugin: Chrome NaCl (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\ppGoogleNaClPluginChrome.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\gears.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.53\npGoogleUpdate3.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\stefan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: YouTube = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: Google-Suche = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: SiteAdvisor = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.122.1_0\
CHR - Extension: Freemake Video Converter = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.1_0\
CHR - Extension: Mehr Leistung und Videoformate fr dein HTML5 video = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
CHR - Extension: Google Mail = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [cfFncEnabler.exe] cfFncEnabler.exe File not found
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKCU..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 110.164.252.222 110.164.252.223
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{162DD6C4-76E2-4D27-BAE8-43FB03178D96}: DhcpNameServer = 110.164.252.222 110.164.252.223
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2D479C68-92B0-4157-B684-8C5176B9A625}: DhcpNameServer = 192.168.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FC486A3-58D8-41E1-AD9B-EBBD52601BB9}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9432ACA8-31E7-41F3-A91F-B334FC66FF5C}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\stefan\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\stefan\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 60 Days ==========

[2012.03.08 07:52:05 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\stefan\Desktop\OTL.exe
[2012.03.08 07:45:55 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.03.07 17:48:28 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\VIDEO_TS
[2012.03.07 15:24:10 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\iTunes Freemake redsn0w
[2012.03.07 15:11:16 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\salt
[2012.03.07 15:10:57 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\outländer
[2012.03.07 15:10:31 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\knight and day
[2012.03.07 12:31:39 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2012.03.07 12:31:39 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.02.18 15:26:57 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\spongebob
[2012.02.18 03:06:55 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.02.18 03:06:52 | 001,798,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.02.18 03:06:51 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.02.18 03:06:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.02.18 03:06:51 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.02.18 03:06:46 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.02.16 07:32:53 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.02.15 17:33:34 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\redsn0w
[2012.02.06 15:38:56 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\Techno - House - Trance - Elektro mp4 & wma
[2012.02.02 17:23:41 | 000,000,000 | ---D | C] -- C:\Users\stefan\Documents\Documents\Freemake
[2012.02.02 17:23:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
[2012.02.02 17:23:09 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
[2012.02.02 17:23:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
[2012.02.02 17:23:08 | 000,000,000 | ---D | C] -- C:\Program Files\Freemake
[2012.02.02 16:26:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.02.02 16:25:18 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.02.02 16:25:14 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.01.26 11:18:56 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\i- cloud
[2012.01.14 12:44:49 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll
[2012.01.14 12:44:36 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.01.14 12:44:32 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012.01.14 12:44:18 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.01.14 12:44:18 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 60 Days ==========

[2012.03.08 07:52:20 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\stefan\Desktop\OTL.exe
[2012.03.08 07:52:09 | 000,073,728 | ---- | M] () -- C:\Users\stefan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.08 07:49:04 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.08 07:43:25 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.08 07:43:24 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.08 07:43:24 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.08 07:43:24 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.08 07:37:39 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.08 07:36:06 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.08 07:36:06 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.08 07:35:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.07 15:27:37 | 000,001,194 | ---- | M] () -- C:\Users\stefan\Desktop\stefan - Verknüpfung.lnk
[2012.03.07 13:46:05 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.07 12:10:27 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.02.24 18:58:09 | 000,000,680 | ---- | M] () -- C:\Users\stefan\AppData\Local\d3d9caps.dat
[2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012.02.18 03:31:26 | 000,371,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.02.17 03:01:33 | 000,137,416 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012.02.14 13:59:07 | 000,002,565 | ---- | M] () -- C:\Users\stefan\Desktop\Microsoft Word.lnk
[2012.02.14 12:23:53 | 002,988,767 | ---- | M] () -- C:\Users\stefan\Muddy2.mp3
[2012.02.14 12:19:17 | 003,367,403 | ---- | M] () -- C:\Users\stefan\Muddy1.mp3
[2012.02.02 17:24:29 | 000,000,050 | ---- | M] () -- C:\user.js
[2012.01.17 18:30:43 | 216,364,819 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.01.12 20:52:56 | 002,044,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.01.08 21:03:37 | 000,000,379 | ---- | M] () -- C:\Users\stefan\Desktop\Fotoos.lnk
[2012.01.08 08:20:04 | 000,000,406 | ---- | M] () -- C:\Users\stefan\Desktop\i 1raffetti - Verknüpfung.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.02.14 12:23:52 | 002,988,767 | ---- | C] () -- C:\Users\stefan\Muddy2.mp3
[2012.02.14 12:19:13 | 003,367,403 | ---- | C] () -- C:\Users\stefan\Muddy1.mp3
[2012.02.02 18:37:10 | 000,001,194 | ---- | C] () -- C:\Users\stefan\Desktop\stefan - Verknüpfung.lnk
[2012.02.02 17:24:29 | 000,000,050 | ---- | C] () -- C:\user.js
[2012.01.16 20:04:18 | 216,364,819 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.01.08 21:03:44 | 000,000,379 | ---- | C] () -- C:\Users\stefan\Desktop\Fotoos.lnk
[2012.01.08 08:20:11 | 000,000,406 | ---- | C] () -- C:\Users\stefan\Desktop\i 1raffetti - Verknüpfung.lnk
[2011.07.08 23:14:21 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2011.06.26 21:29:43 | 000,000,002 | ---- | C] () -- C:\Windows\msoffice.ini
[2011.05.08 00:51:39 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011.05.08 00:51:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.05.08 00:51:39 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011.05.08 00:51:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.05.08 00:51:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.11.01 12:26:47 | 000,000,680 | ---- | C] () -- C:\Users\stefan\AppData\Local\d3d9caps.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >

Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

Hallo Arne,

schön von Dir zu hören.
Leider kriege ich die Protokolle von Malwarebytes und ESET nicht kopiert und eingefügt.
Und das mit CODE- Tags schnall´ ich nicht. Drag & drop geht auch nicht.

Schönen Gruß

vonStefan

Leider kriege ich die Protokolle von Malwarebytes und ESET nicht kopiert und eingefügt.

Ja und wie soll ich da was zu schreiben? "Bekomms nicht kopiert" ist keine hilfreiche Aussage, was bekommt man da nicht kopiert? Alles markieren, kopieren und hier einfügen, das sind doch die geläufigsten Alltagsaufgaben in Windows überhaupt

Und das mit CODE- Tags schnall´ ich nicht.

Einfach kann man es nun wirklich nicht erklären
CODE-Tags wurde übrigens extra verlinkt

Hallo Arne,
das ging vorhin nicht! Erst nach Neustart. Der Text hatte sich nicht markieren lassen, mir drag/ drop ging es auch nicht. Ich dachte schon, der Virus ist so schlau, daß er das verhindert.

Bei Malwarebytes sind 24 Logdateien aus 2011 und 1 aus 2012.
Soll ich diese öffnen, kopieren und posten?


Hier das ESET- Protokoll.

C:\Program Files\Videograbber\eBay_shortcuts_1024_Videograbber.exe	Win32/Adware.ADON application
C:\Program Files\Videograbber\Videograbber.EXE	Win32/Adware.ADON application
C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000015	Win32/RegistryBooster application
C:\Users\stefan\Desktop\EBAY 02.05.2010\download\registrybooster.exe	Win32/RegistryBooster application
C:\Users\stefan\Desktop\EBAY 02.05.2010\download\SoftonicDownloader_fuer_tuneup-utilities-2011(1).exe	a variant of Win32/SoftonicDownloader.A application
C:\Users\stefan\Desktop\EBAY 02.05.2010\download\SoftonicDownloader_fuer_tuneup-utilities-2011.exe	a variant of Win32/SoftonicDownloader.A application
C:\Users\stefan\Desktop\EBAY 02.05.2010\download\Downloads\registrybooster.exe	Win32/RegistryBooster application
C:\Users\stefan\Desktop\EBAY 02.05.2010\download\Downloads\SoftonicDownloader_fuer_tuneup-utilities-2011(1).exe	a variant of Win32/SoftonicDownloader.A application
C:\Users\stefan\Desktop\EBAY 02.05.2010\download\Downloads\SoftonicDownloader_fuer_tuneup-utilities-2011.exe	a variant of Win32/SoftonicDownloader.A application
G:\Vista\Program Files\Videograbber\eBay_shortcuts_1024_Videograbber.exe	Win32/Adware.ADON application
G:\Vista\Program Files\Videograbber\Videograbber.EXE	Win32/Adware.ADON application
G:\Vista\Users\stefan\AppData\Local\Temp\MyBabylonTB.exe	a variant of Win32/Toolbar.Babylon application
G:\Vista\Users\stefan\Desktop\EBAY 02.05.2010\download\Downloads\SoftonicDownloader_fuer_tuneup-utilities-2011(1).exe	a variant of Win32/SoftonicDownloader.A application
G:\Vista\Users\stefan\Desktop\EBAY 02.05.2010\download\Downloads\SoftonicDownloader_fuer_tuneup-utilities-2011.exe	a variant of Win32/SoftonicDownloader.A application
         

vonStefan

Bitte in CODE-Tags! Das kann doch nicht so schwierig sein! CODE in eckigen Klammern posten, dann das Log und abgeschlossen wird es mit /CODE in eckigen Klammern!!

Die 24-Log von MBAM alle zusammen in EINE ZIP packen und hier anhängen. Falls zu groß da abladen => File-Upload.net - Ihr kostenloser File Hoster!

<CODE>
ein kurzer hinweis: nachlesen bei wiki
hätts auch getan.
ich dachte, in tag posten heißt, auf die site "tag" posten.
ich denke manchmal kompliziert.
so soll das aussehen, oder?
<CODE/>

ECKIGE und keine SPITZEN Klammer!

Das sind eckige Klammer => [ ]
Das sind spotze Klammern => < >

<CODE/>

Das ist schonmal ganz falsch - ich hab es doch oben haarklein erklärt

Hallo Arne,
ich bekomme den Ordner nicht hochgeladen. Auch nicht mit dem upload- tool. Ich hoffe, ich darf das hier posten, soviel ist´s nicht.
In der Quarantäne habe ich 6 Eintragungen. copy/ paste geht nicht.
Dann schreibe ich sie am Besten ab?

<CODE>
Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6502

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

04.05.2011 01:07:57
mbam-log-2011-05-04 (01-07-57).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 179130
Laufzeit: 4 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\program files\free registry cleaner for vista (Rogue.FreeRegistryCleanerForVista) -> Quarantined and deleted successfully.

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6502

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

06.05.2011 08:31:11
mbam-log-2011-05-06 (08-31-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 341072
Laufzeit: 1 Stunde(n), 18 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\stefan\AppData\Roaming\desktopicon\ebayshortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.


Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6502

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

08.05.2011 08:42:19
mbam-log-2011-05-08 (08-42-19).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 0
Laufzeit: 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6502

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

10.05.2011 15:45:46
mbam-log-2011-05-10 (15-45-46).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 179697
Laufzeit: 4 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6548

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

11.05.2011 00:21:22
mbam-log-2011-05-11 (00-21-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 312882
Laufzeit: 1 Stunde(n), 0 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 53955, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 53973, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 53997, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54003, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54009, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54011, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54014, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54015, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54018, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54021, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54029, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54036, Process: avwebgrd.exe)
01:16:15 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 54039, Process: avwebgrd.exe)
02:22:58 stefan MESSAGE Scheduled update executed successfully
02:23:00 stefan MESSAGE IP Protection stopped
02:23:09 stefan MESSAGE Database updated successfully
02:23:11 stefan MESSAGE IP Protection started successfully
21:36:05 stefan MESSAGE Protection started successfully
21:36:11 stefan MESSAGE IP Protection started successfully



Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6940

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

25.06.2011 01:04:48
mbam-log-2011-06-25 (01-04-48).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 333464
Laufzeit: 1 Stunde(n), 35 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Toshiba\Webshops\addamazontoolbarbutton.exe (Rogue.SystemSmartSecurity) -> Quarantined and deleted successfully.


Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 7006

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

04.07.2011 03:06:52
mbam-log-2011-07-04 (03-06-52).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 332761
Laufzeit: 1 Stunde(n), 34 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 7014

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

06.07.2011 13:58:47
mbam-log-2011-07-06 (13-58-47).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 312010
Laufzeit: 1 Stunde(n), 12 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Malwarebytes Anti-Malware 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.03.08.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
stefan :: STEFANS-PC [Administrator]

08.03.2012 15:11:22
mbam-log-2012-03-08 (15-11-22).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 465051
Laufzeit: 3 Stunde(n), 51 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
G:\Vista\Users\stefan\AppData\Roaming\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Erfolgreich gelöscht und in Quarantäne gestellt.
G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003\10000001a00002i\OfficeLiveSignIn.exe (Trojan.IRCBot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003\1000000b00002i\rundll32.exe (Trojan.IRCBot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003\4000003900002i\MultiKill.exe (Trojan.IRCBot) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55110, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55112, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55114, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55124, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55133, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55137, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55140, Process: avwebgrd.exe)
11:46:00 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55158, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55161, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55165, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55168, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55173, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55174, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55176, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55185, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55186, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55188, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55191, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55195, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55196, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55198, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55200, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55204, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55205, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55206, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55209, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55210, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55213, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55214, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55217, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55218, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55221, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55222, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55228, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55230, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55237, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55243, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55244, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55249, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55250, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55252, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55254, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55256, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55268, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55269, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55270, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55273, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55274, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55276, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55279, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 55280, Process: avwebgrd.exe)
11:46:17 stefan IP-BLOCK 94.198.240.136 (Type: outgoing, Port: 55282, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55497, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55498, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55499, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55501, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55504, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55505, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55508, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55509, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55518, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55521, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 55529, Process: avwebgrd.exe)
11:49:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55533, Process: avwebgrd.exe)
11:50:41 stefan IP-BLOCK 94.198.240.235 (Type: outgoing, Port: 55541, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55545, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55549, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55550, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55551, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55554, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55555, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55566, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55568, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55573, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 55578, Process: avwebgrd.exe)
11:50:58 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 55583, Process: avwebgrd.exe)
20:10:58 stefan MESSAGE Protection started successfully
20:11:05 stefan MESSAGE IP Protection started successfully



10:06:09 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 50827, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51161, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51163, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51175, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51180, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51182, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51196, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51200, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51213, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51216, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51220, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51221, Process: avwebgrd.exe)
15:32:39 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 51235, Process: avwebgrd.exe)


23:32:44 stefan MESSAGE Protection started successfully
23:32:51 stefan MESSAGE IP Protection started successfully


23:29:17 stefan MESSAGE Protection started successfully
23:29:23 stefan MESSAGE IP Protection started successfully


01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49698, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49700, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49714, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49720, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49721, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49724, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49739, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49740, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49745, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49748, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49750, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49758, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 49765, Process: avwebgrd.exe)
01:27:45 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49767, Process: avwebgrd.exe)
01:27:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49775, Process: avwebgrd.exe)
01:27:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49777, Process: avwebgrd.exe)
01:27:53 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 49779, Process: avwebgrd.exe)
01:28:09 stefan IP-BLOCK 78.108.182.90 (Type: outgoing, Port: 49781, Process: avwebgrd.exe)
01:52:53 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 51767, Process: avwebgrd.exe)
02:22:57 stefan MESSAGE Scheduled update executed successfully
02:22:59 stefan MESSAGE IP Protection stopped
02:23:08 stefan MESSAGE Database updated successfully
02:23:11 stefan MESSAGE IP Protection started successfully



02:22:58 stefan MESSAGE Scheduled update executed successfully
02:23:01 stefan MESSAGE IP Protection stopped
02:23:12 stefan MESSAGE Database updated successfully
02:23:15 stefan MESSAGE IP Protection started successfully


00:55:50 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57083, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57084, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57086, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57091, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57094, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57096, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57100, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57101, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57104, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57112, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57113, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57114, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57116, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57117, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57118, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57119, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57124, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57125, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57128, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57130, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57136, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57148, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57149, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57154, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57159, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57161, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57163, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57167, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57170, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57172, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57190, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57192, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57193, Process: avwebgrd.exe)
00:55:51 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 57197, Process: avwebgrd.exe)
00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57229, Process: avwebgrd.exe)
00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57240, Process: avwebgrd.exe)
00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57244, Process: avwebgrd.exe)
00:55:59 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57246, Process: avwebgrd.exe)
00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57251, Process: avwebgrd.exe)
00:55:59 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57253, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57329, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57330, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57337, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57338, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57340, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57341, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57343, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57344, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57347, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57349, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57350, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57354, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57355, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57356, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57357, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57359, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57367, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57369, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57375, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57376, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57380, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57382, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57383, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57389, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57390, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57391, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57392, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57396, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57398, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57399, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57400, Process: avwebgrd.exe)
00:57:28 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57408, Process: avwebgrd.exe)
00:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57419, Process: avwebgrd.exe)
00:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 57421, Process: avwebgrd.exe)
00:57:36 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57423, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57896, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57897, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57899, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57900, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57902, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57904, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57906, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57912, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57914, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.183.129 (Type: outgoing, Port: 57916, Process: avwebgrd.exe)
01:09:30 stefan IP-BLOCK 78.108.179.67 (Type: outgoing, Port: 57927, Process: avwebgrd.exe)
01:23:32 stefan IP-BLOCK 92.241.168.67 (Type: outgoing, Port: 58953, Process: avwebgrd.exe)
02:23:00 stefan MESSAGE Scheduled update executed successfully
02:23:01 stefan MESSAGE IP Protection stopped
02:23:19 stefan MESSAGE Database updated successfully
02:23:23 stefan MESSAGE IP Protection started successfully
22:23:55 stefan MESSAGE Protection started successfully
22:24:02 stefan MESSAGE IP Protection started successfully
22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49538, Process: avwebgrd.exe)
22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49550, Process: avwebgrd.exe)
22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49551, Process: avwebgrd.exe)
22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49558, Process: avwebgrd.exe)
22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49565, Process: avwebgrd.exe)
22:37:47 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49566, Process: avwebgrd.exe)
22:37:55 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 49583, Process: avwebgrd.exe)
22:38:04 stefan IP-BLOCK 94.198.240.62 (Type: outgoing, Port: 49585, Process: avwebgrd.exe)


02:22:58 stefan MESSAGE Scheduled update executed successfully
02:23:04 stefan MESSAGE IP Protection stopped
02:23:27 stefan MESSAGE Database updated successfully
02:23:31 stefan MESSAGE IP Protection started successfully
16:03:22 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 51206, Process: avwebgrd.exe)



12:44:20 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 54591, Process: avwebgrd.exe)
13:12:48 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 56044, Process: avwebgrd.exe)



20:44:30 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 62636, Process: avwebgrd.exe)
20:51:51 stefan IP-BLOCK 78.108.183.130 (Type: outgoing, Port: 63216, Process: avwebgrd.exe)
20:52:16 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 63328, Process: avwebgrd.exe)
20:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63872, Process: avwebgrd.exe)
20:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63874, Process: avwebgrd.exe)
20:57:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63880, Process: avwebgrd.exe)
20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63891, Process: avwebgrd.exe)
20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63899, Process: avwebgrd.exe)
20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63900, Process: avwebgrd.exe)
20:57:36 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 63902, Process: avwebgrd.exe)
21:02:01 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 64244, Process: avwebgrd.exe)
21:04:01 stefan IP-BLOCK 78.108.181.20 (Type: outgoing, Port: 64317, Process: avwebgrd.exe)
21:04:01 stefan IP-BLOCK 78.108.181.20 (Type: outgoing, Port: 64319, Process: avwebgrd.exe)



12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52023, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52040, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52041, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52042, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52056, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52057, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52061, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52062, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52063, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52073, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52076, Process: avwebgrd.exe)
12:58:03 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52092, Process: avwebgrd.exe)
12:58:11 stefan IP-BLOCK 94.198.240.202 (Type: outgoing, Port: 52097, Process: avwebgrd.exe)
12:58:19 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 52099, Process: avwebgrd.exe)
13:19:20 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53023, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53056, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53062, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53075, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53077, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53097, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53098, Process: avwebgrd.exe)
13:19:28 stefan IP-BLOCK 78.108.179.68 (Type: outgoing, Port: 53099, Process: avwebgrd.exe)
13:54:05 stefan IP-BLOCK 208.91.207.65 (Type: outgoing, Port: 55249, Process: avwebgrd.exe)


00:23:41 stefan MESSAGE IP Protection stopped
21:19:16 stefan MESSAGE Protection started successfully
21:19:30 stefan MESSAGE IP Protection started successfully
21:19:34 stefan MESSAGE IP Protection stopped
21:46:47 stefan MESSAGE Protection started successfully
21:46:54 stefan MESSAGE IP Protection started successfully
21:46:57 stefan MESSAGE IP Protection stopped
<CODE/>

Hoffentlich ist das ok so. Fürchte fast, daß nicht. Hätte nach jedem Absatz ein </> Endezeichen gehört?

Grüße
vonStefan

Hi Arna (hatten wir vor 1 Jahr schonmal
Hier die abgetippte Liste der Quarantäne vom Malwarebytes.
G ist die externe Festplatte.
Jetzt ist mir die CODE/ Tag Bedeutung auch klar geworden. Legt Anfang und Ende fest.
Hätt´ ich auch selber.. bin ich aber nicht. Bin über 55, das merkt man bei sowas.
Gruß
vonStefan

<CODE>
Adware.ADON 08.03.2012, 14:14 File G:\Vista\User\stefan\AppData\Roaming\Desktopicon\eB...
Trojan.IRCBot 08.03.2012, 14:11 File G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Exce...
Trojan.IRCBot 08.03.2012, 14:11 File G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Exce...
Trojan.IRCBot 08.03.2012, 14:11 File G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Exce...
Rogue.SystemS... File c:\Toshiba\Webshops\addamazontoolbarbutton.exe
Aadware.ADON File c:\User\stefan\AppData\Roaming\desktopicon\ebayshor...
<CODE/>

Habe das mit den eckigen Klammern zu spät gelesen. Tut mir echt leid.

G:\vonGG Rafet\Rafet\_office\MS Office 2003 Word-Excel\Thinstall\Office 2003

Wo hast du dieses Zeugs her?

Urlaubsbekanntschaft. Dem hats ein Arbeitskollege auf die mobile Festplatte gespielt. Die habe ich auf G kopiert und immer wieder einen Film zum Anschauen auf meinen PC gezogen.
Großartige Idee, wie mir scheint..
Gruß
Stefan

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hallo Arne,
ich hatte den Firefox offen. Soll ich nochmal?

OTL Logfile:

OTL logfile created on: 10.03.2012 17:11:38 - Run 5
OTL by OldTimer - Version 3.2.35.1     Folder = C:\Users\stefan\Desktop\Trojanerjäger
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 49,49% Memory free
3,98 Gb Paging File | 2,68 Gb Available in Paging File | 67,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,21 Gb Total Space | 19,38 Gb Free Space | 16,67% Space Free | Partition Type: NTFS
Drive E: | 115,21 Gb Total Space | 55,26 Gb Free Space | 47,96% Space Free | Partition Type: NTFS
Drive G: | 465,65 Gb Total Space | 179,61 Gb Free Space | 38,57% Space Free | Partition Type: FAT32
 
Computer Name: STEFANS-PC | User Name: stefan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\stefan\Desktop\Trojanerjäger\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
PRC - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D)
PRC - C:\Program Files\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe (TOSHIBA)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6310a2050033b0b567428ca55bda4a1b\Microsoft.VisualBasic.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\d0cf808e33a5123b33010b933d3b1597\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3951e0a359c004cd6ba268ff78ac62aa\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
MOD - C:\Program Files\TUGZip\Plugins\TzArchive10.tgp ()
MOD - C:\Windows\System32\ztvunrar36.dll ()
MOD - C:\Program Files\TUGZip\TzShell.dll ()
MOD - C:\Program Files\TUGZip\Plugins\TzImage10.tgp ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Freemake Improver) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
SRV - (AntiVirFirewallService) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Browser Defender Update Service) -- C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (TGCM_ImportWiFiSvc) -- C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D)
SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH)
SRV - (SmartFaceVWatchSrv) -- C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
SRV - (TNaviSrv) -- C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) --  File not found
DRV - (NwlnkFlt) --  File not found
DRV - (IpInIp) --  File not found
DRV - (esgiguard) --  File not found
DRV - (catchme) --  File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (avfwot) -- C:\Windows\System32\drivers\avfwot.sys (Avira GmbH)
DRV - (avfwim) -- C:\Windows\System32\drivers\avfwim.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (massfilter_hs) -- C:\Windows\System32\drivers\massfilter_hs.sys (ZTE Incorporated)
DRV - (RTL8187B) -- C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation                           )
DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (RtlProt) -- C:\Windows\System32\drivers\RtlProt.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (FwLnk) -- C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{9A284460-6B83-4FC5-9B1D-B3C625C48887}: "URL" = hxxp://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEA;
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {BA778FA4-2DDB-4814-9662-D91BA0D516E1}
IE - HKCU\..\SearchScopes\{9A284460-6B83-4FC5-9B1D-B3C625C48887}: "URL" = hxxp://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7GPEA_de
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\..\SearchScopes\{BA778FA4-2DDB-4814-9662-D91BA0D516E1}: "URL" = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms}
IE - HKCU\..\SearchScopes\{C64A81FB-0C89-4787-BA3B-CF8909B4FAF7}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.funmoods.com"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.2
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.2b
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\stefan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.04.30 23:40:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011.07.08 23:14:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012.03.09 12:46:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.11.14 22:58:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.02.02 17:23:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.17 17:52:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.07 19:35:48 | 000,000,000 | ---D | M]
 
[2009.08.04 20:29:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\stefan\AppData\Roaming\mozilla\Extensions
[2012.03.06 15:50:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions
[2012.02.11 19:04:02 | 000,000,000 | ---D | M] ("Winamp Toolbar") -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2012.02.14 11:59:13 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.04.30 23:40:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\stefan\AppData\Roaming\mozilla\Firefox\Profiles\afsd7hfq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.08 10:29:10 | 000,000,927 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\conduit.xml
[2012.02.02 17:24:05 | 000,001,798 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\funmoods.xml
[2010.09.16 14:21:14 | 000,002,689 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\search-defender.xml
[2009.12.14 05:19:41 | 000,001,246 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\searchplugins\winamp-search.xml
[2012.01.25 18:17:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.02.02 17:23:38 | 000,000,000 | ---D | M] (Freemake Video Converter Plugin) -- C:\PROGRAM FILES\FREEMAKE\FREEMAKE VIDEO CONVERTER\BROWSERPLUGIN\FIREFOX
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\CANITBECHEAPER@TRAFFICBROKER.CO.UK.XPI
() (No name found) -- C:\USERS\STEFAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AFSD7HFQ.DEFAULT\EXTENSIONS\ISREADITLATER@IDEASHOWER.COM.XPI
[2012.02.17 17:52:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.19 19:03:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.19 19:03:23 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.19 19:03:23 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.19 19:03:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.27 19:40:39 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2011.10.19 19:03:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.19 19:03:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)  (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\pdf.dll
CHR - plugin: Chrome NaCl (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\ppGoogleNaClPluginChrome.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.66\gears.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.53\npGoogleUpdate3.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\stefan\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: SiteAdvisor = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.122.1_0\
CHR - Extension: Freemake Video Converter = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.1_0\
CHR - Extension: Mehr Leistung und Videoformate fr dein HTML5 video = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [cfFncEnabler.exe] cfFncEnabler.exe File not found
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKCU..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 110.164.252.222 110.164.252.223
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{162DD6C4-76E2-4D27-BAE8-43FB03178D96}: DhcpNameServer = 110.164.252.222 110.164.252.223
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2D479C68-92B0-4157-B684-8C5176B9A625}: DhcpNameServer = 192.168.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FC486A3-58D8-41E1-AD9B-EBBD52601BB9}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9432ACA8-31E7-41F3-A91F-B334FC66FF5C}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\stefan\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\stefan\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation)
MsConfig - StartUpFolder: C:^Users^stefan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PMB Medien-Prüfung.lnk - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe - (Sony Corporation)
MsConfig - StartUpReg: 00TCrdMain - hkey= - key= -  File not found
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig - StartUpReg: Google EULA Launcher - hkey= - key= - c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
MsConfig - StartUpReg: HSON - hkey= - key= -  File not found
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: SmoothView - hkey= - key= -  File not found
MsConfig - StartUpReg: swg - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: Toshiba Registration - hkey= - key= - C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe (Toshiba)
MsConfig - StartUpReg: TPwrMain - hkey= - key= -  File not found
MsConfig - StartUpReg: WinampAgent - hkey= - key= -  File not found
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.divxa32 - C:\Windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.09 17:00:03 | 000,000,000 | R--D | C] -- C:\Users\stefan\Desktop\Trojanerjäger
[2012.03.09 15:43:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File-Upload.net
[2012.03.09 15:43:36 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File-Upload.net
[2012.03.09 15:43:36 | 000,000,000 | ---D | C] -- C:\Program Files\File-Upload.net
[2012.03.09 04:04:47 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.03.08 15:07:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.08 15:07:07 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.08 15:07:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.08 14:34:11 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\Filmää
[2012.03.08 13:43:30 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\dvdcss
[2012.03.08 08:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.03.08 08:29:56 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.03.08 07:45:55 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.03.07 15:24:10 | 000,000,000 | ---D | C] -- C:\Users\stefan\Desktop\iTunes Freemake redsn0w
[2012.03.07 12:31:39 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2012.03.07 12:31:39 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.02.15 17:33:34 | 000,000,000 | ---D | C] -- C:\Users\stefan\AppData\Roaming\redsn0w
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.10 17:10:41 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.10 17:10:41 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.10 17:10:41 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.10 17:10:41 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.10 16:49:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.10 16:01:03 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.10 15:59:05 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.10 15:59:05 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.10 15:58:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.10 12:18:54 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.03.09 16:13:24 | 000,002,565 | ---- | M] () -- C:\Users\stefan\Desktop\Microsoft Word.lnk
[2012.03.08 13:42:20 | 000,076,288 | ---- | M] () -- C:\Users\stefan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.08 08:17:54 | 000,000,000 | ---- | M] () -- C:\Users\stefan\defogger_reenable
[2012.03.07 15:27:37 | 000,001,194 | ---- | M] () -- C:\Users\stefan\Desktop\stefan - Verknüpfung.lnk
[2012.02.24 18:58:09 | 000,000,680 | ---- | M] () -- C:\Users\stefan\AppData\Local\d3d9caps.dat
[2012.02.18 03:31:26 | 000,371,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.02.17 03:01:33 | 000,137,416 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012.02.14 12:23:53 | 002,988,767 | ---- | M] () -- C:\Users\stefan\Muddy2.mp3
[2012.02.14 12:19:17 | 003,367,403 | ---- | M] () -- C:\Users\stefan\Muddy1.mp3
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.08 08:17:54 | 000,000,000 | ---- | C] () -- C:\Users\stefan\defogger_reenable
[2012.02.14 12:23:52 | 002,988,767 | ---- | C] () -- C:\Users\stefan\Muddy2.mp3
[2012.02.14 12:19:13 | 003,367,403 | ---- | C] () -- C:\Users\stefan\Muddy1.mp3
[2011.07.08 23:14:21 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2011.06.26 21:29:43 | 000,000,002 | ---- | C] () -- C:\Windows\msoffice.ini
[2011.05.08 00:51:39 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011.05.08 00:51:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.05.08 00:51:39 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011.05.08 00:51:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.05.08 00:51:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.11.01 12:26:47 | 000,000,680 | ---- | C] () -- C:\Users\stefan\AppData\Local\d3d9caps.dat
 
========== LOP Check ==========
 
[2011.05.06 07:31:11 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Desktopicon
[2011.04.30 23:40:43 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Facebook
[2011.04.30 23:40:43 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\gtk-2.0
[2011.08.09 22:16:09 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Image Zone Express
[2011.05.09 22:12:03 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Modpad
[2011.04.26 21:38:31 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\PeerNetworking
[2009.08.14 15:47:54 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Printer Info Cache
[2012.02.15 17:53:59 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\redsn0w
[2011.05.12 16:03:26 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\SumatraPDF
[2011.09.01 18:46:14 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Telefónica
[2009.10.01 06:47:06 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Toshiba
[2011.04.26 21:47:03 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\TuneUp Software
[2010.11.14 19:39:02 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Uniblue
[2009.12.08 12:21:46 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Vodafone
[2009.09.02 12:50:46 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\WinBatch
[2012.03.10 12:38:37 | 000,032,626 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009.12.21 23:24:22 | 000,000,434 | ---- | M] () -- C:\Windows\Tasks\SLOW-PCfighter.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.06.03 22:18:55 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Adobe
[2011.06.26 21:29:45 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\AOL
[2012.01.26 11:09:36 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Apple Computer
[2011.11.13 20:03:44 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Avira
[2011.05.06 07:31:11 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Desktopicon
[2011.05.04 00:13:36 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\DivX
[2012.03.08 13:43:30 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\dvdcss
[2011.04.30 23:40:43 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Facebook
[2009.08.04 12:14:21 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Google
[2011.12.29 06:26:29 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\GRETECH
[2011.04.30 23:40:43 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\gtk-2.0
[2009.08.14 15:31:06 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\HP
[2009.10.13 09:53:09 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\HpUpdate
[2009.08.04 00:35:28 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Identities
[2011.08.09 22:16:09 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Image Zone Express
[2009.08.04 00:33:08 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\InstallShield
[2009.08.04 21:07:07 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Macromedia
[2011.05.04 00:00:21 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Malwarebytes
[2011.06.03 22:18:55 | 000,000,000 | --SD | M] -- C:\Users\stefan\AppData\Roaming\Microsoft
[2009.08.04 01:56:05 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Microsoft Web Folders
[2011.05.09 22:12:03 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Modpad
[2009.08.04 22:44:43 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Mozilla
[2011.04.26 21:38:31 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\PeerNetworking
[2009.08.14 15:47:54 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Printer Info Cache
[2010.03.12 12:09:31 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Real
[2012.02.15 17:53:59 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\redsn0w
[2010.02.15 11:39:51 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Sony Corporation
[2011.05.12 16:03:26 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\SumatraPDF
[2011.09.01 18:46:14 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Telefónica
[2009.10.01 06:47:06 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Toshiba
[2011.04.26 21:47:03 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\TuneUp Software
[2010.11.14 19:39:02 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Uniblue
[2011.12.26 15:44:59 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\vlc
[2009.12.08 12:21:46 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\Vodafone
[2009.09.02 12:50:46 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\WinBatch
[2010.05.01 23:28:14 | 000,000,000 | ---D | M] -- C:\Users\stefan\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.06.21 04:38:34 | 000,050,354 | ---- | M] (Facebook, Inc.) -- C:\Users\stefan\AppData\Roaming\Facebook\uninstall.exe
[2007.03.22 11:46:40 | 000,126,976 | ---- | M] () -- C:\Users\stefan\AppData\Roaming\GRETECH\GomPlayer\GrLauncher.exe
[2010.02.15 10:11:04 | 000,010,134 | R--- | M] () -- C:\Users\stefan\AppData\Roaming\Microsoft\Installer\{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}\ARPPRODUCTICON.exe
[2010.03.11 22:44:21 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\stefan\AppData\Roaming\Real\Update\setup3.10\setup.exe
[2010.03.11 13:12:41 | 000,079,368 | ---- | M] (RealNetworks, Inc.) -- C:\Users\stefan\AppData\Roaming\Real\Update\setup3.10\RUP\vista.exe
[2010.05.25 10:52:20 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\stefan\AppData\Roaming\Real\Update\setup3.11\setup.exe
[2011.11.14 10:05:27 | 000,317,048 | ---- | M] (RealNetworks, Inc.) -- C:\Users\stefan\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\rnupgagent.exe
[2011.11.14 13:07:54 | 026,533,840 | ---- | M] (RealNetworks, Inc.) -- C:\Users\stefan\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\stub_data\RealPlayer_de.exe
[2011.11.14 13:05:42 | 000,676,624 | ---- | M] (RealNetworks, Inc.) -- C:\Users\stefan\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\stub_exe\RealPlayer_de.exe
[2010.10.21 00:16:36 | 005,401,680 | ---- | M] (Uniblue Systems Ltd                                         ) -- C:\Users\stefan\AppData\Roaming\Uniblue\DriverScanner\_temp\driverscanner.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2008.03.25 04:22:22 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=2D77788D0B7FE269044F58C86AE099CE -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_3e1ecd89\AGP440.sys
[2008.03.25 04:22:22 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=2D77788D0B7FE269044F58C86AE099CE -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.22142_none_ba734aead7ed1bb6\AGP440.sys
[2008.03.26 04:38:23 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=ED91751834103DB2A74470CD763A49FE -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_e4087235\AGP440.sys
[2008.03.26 04:38:23 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=ED91751834103DB2A74470CD763A49FE -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20800_none_b8b64d46daa7e57a\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.03.12 07:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.03.12 07:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.03.12 07:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2008.04.15 16:54:16 | 000,388,120 | ---- | M] (Intel Corporation) MD5=8D58627FEF3F8767665D9F4DC91CBD97 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.04.15 16:53:44 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.04.15 16:53:44 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\drivers\iaStor.sys
[2008.04.15 16:53:44 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_77c04a30\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
         

--- --- ---
[CustomScan mit OTL]

Gruß
vonStefan