Hallo ihr Lieben,
kenne mich leider nicht so gut mit Trojanern/Viren und Co aus und deshalb wende ich mich an euch.

Vor ein paar Tagen hat mich ein Bundespolizei-Trojaner erwischt, da noch nicht mal der Task-Manager über STRG + ALT + Entf geöffnet werden konnte, habe ich den Pc im abgesichtern Modus gestartet und eine Systemwiederherstellung vom Vortag durchgeführt. Daraufhin hat wieder alles funktioniert. Ich habe dann
Avast und Microsoft Security Essentials komplett durchlaufen lassen im vollständigen Scan und MSE hat etwas gefunden und ich habe es gelöscht , hab jetzt gelesen, dass das nicht so gut war und ich es besser unter Quarantäne gestellt hätte.
Da ich mir unsicher war, ob ich wirklich nicht noch etwas auf meinem Pc habe, habe ich Malwarebytes Anti Malware als Testversion herunter geladen und 6 infizierte Registrierungsschlüssel im vollständigen Scan gefunden (keine Aktion durchgeführt) und eine infizierte Datei (keine Aktion durchgeführt). Leider habe ich da auch alles gelöscht . Aber ich habe noch die 3 Logdatein.

Malwarebytes Anti-Malware (Test)
Schutz: Aktiviert

24.07.2012 18:38:47
mbam-log-2012-07-24 (18-38-47).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 406202
Laufzeit: 3 Stunde(n), 2 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKCR\CLSID\{815A7C14-BFD5-42E3-AF91-464085E0EEA4} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{815A7C14-BFD5-42E3-AF91-464085E0EEA4} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{815A7C14-BFD5-42E3-AF91-464085E0EEA4} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{815A7C14-BFD5-42E3-AF91-464085E0EEA4} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.
HKCR\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} (PUP.DownloadnSave) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\ProgramData\Codecv\bhoclass.dll (PUP.DownloadnSave) -> Keine Aktion durchgeführt.

(Ende)

Betriebssystem: Windows 7
x86 basierter- PC = 32bit System

Was mache ich denn jetzt am besten? Bin komplett überfragt. Normalerweise hätte ich gedacht, dass es schon ausreicht die infizierten Datein etc. zu löschen; jedoch habe ich jetzt des öfteren gelesen, dass das nicht ausreicht. Hoffe ja meinen Pc nicht platt machen zu müssen .

Wäre für eure Hilfe sehr dankbar .
Ganz liebe Grüße
FraHi

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

Hallo John,
danke für deine Antwort um die Uhrzeit war ich auch noch wach und habe das --> http://www.trojaner-board.de/69886-a...-beachten.html alles durchgeführt .

Schritt 2
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
#Schliesse bitte nun alle Programme. (Wichtig)
#Starte bitte die OTL.exe.
#Klicke nun bitte auf den Quick Scan Button.
#Wenn der Scan beendet wurde, werden 2 Textdokumente erstellt.
#Kopiere nun den Inhalt aus OTL.txt und Extra.txt in deinen Thread

War das auch richtig? Deine Erklärung hört sich etwas anders an. Kann das aber auch nochmal anders durchführen.

Gespeichert vorliegen habe ich die OTL EXTRAS und GMER Datei. Bin mir nur nicht sicher was ich davon hier rein kopieren soll, an sich stand in der Hilfe ja alle Datein. Was muss ich aus Datenschutzgründen löschen?

Malwarebytes Anti-Malware Vollscan habe ich schon durchgeführt und nur leider alles gelöscht anstatt es nur in Quarantäne zu lassen. Jedoch habe ich dort noch die Logdatein, im ersten Thread habe ich eine von 3en rein kopiert.

Hier schonmal die OTL Logdatei
OTL EXTRAS Logfile:

OTL logfile created on: 25.07.2012 00:25:00 - Run 1
OTL by OldTimer - Version 3.2.54.1     Folder = C:\Users\Hilde\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,07 Mb Total Physical Memory | 290,67 Mb Available Physical Memory | 28,44% Memory free
2,00 Gb Paging File | 0,82 Gb Available in Paging File | 40,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 39,20 Gb Free Space | 26,32% Space Free | Partition Type: NTFS
 
Computer Name: HILDE-PC | User Name: Hilde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.25 00:22:01 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Hilde\Downloads\OTL.exe
PRC - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe
PRC - [2012.07.23 16:14:01 | 001,147,488 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.05.04 15:43:20 | 001,561,768 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.28 20:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastUI.exe
PRC - [2011.11.28 20:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.05.18 16:13:58 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008.09.26 00:43:58 | 001,115,528 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\drivers\w32x86\3\CNAC8SWK.EXE
PRC - [2008.09.25 12:07:58 | 000,181,624 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\drivers\w32x86\3\CNAP2RPK.EXE
PRC - [2007.10.09 07:23:32 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPStart.exe
PRC - [2007.09.05 23:48:00 | 000,406,944 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.23 16:14:18 | 000,132,704 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\SiteSafetyInstaller\12.1.5\SiteSafety.dll
MOD - [2012.07.23 16:14:01 | 001,147,488 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe -- (vToolbarUpdater12.1.5)
SRV - [2012.07.19 08:58:45 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.12 17:11:34 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.03.26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.28 20:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.05.18 16:13:58 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2010.04.28 07:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.04.17 18:53:33 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.04.29 03:21:04 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Hilde\AppData\Local\Temp\ugloipob.sys -- (ugloipob)
DRV - [2012.07.24 23:56:21 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2012.07.24 22:39:23 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{485C2084-5D22-4D16-ACD2-60034E353515}\MpKsl14b22b64.sys -- (MpKsl14b22b64)
DRV - [2012.07.23 16:14:21 | 000,027,496 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.03.20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011.11.28 19:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.11.28 19:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.11.28 19:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.11.28 19:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.11.28 19:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011.11.28 19:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.11.20 14:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010.11.20 14:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010.11.20 12:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.27 14:02:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.09.27 14:02:14 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32)
DRV - [2009.04.29 03:20:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2007.03.07 16:28:42 | 000,167,424 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\aver7700.sys -- (aver7700)
DRV - [2006.11.30 15:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2006.11.24 21:46:38 | 002,085,888 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2005.11.14 13:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A5 0E B4 C0 D2 AC CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=111378&babsrc=SP_ss&mntrId=40517db30000000000000040d0a474c6
IE - HKCU\..\SearchScopes\{86BED112-CFE1-4D22-BE45-637C306DD91A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_ptnrs=&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43&apn_dtid=OSJ000&&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.1.5\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.1.0.21\ [2012.07.23 16:15:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 08:58:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.13 02:12:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.07.24 18:34:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 08:58:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.13 02:12:30 | 000,000,000 | ---D | M]
 
[2010.04.11 22:22:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hilde\AppData\Roaming\mozilla\Extensions
[2010.04.11 22:22:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hilde\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.07.13 10:14:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hilde\AppData\Roaming\mozilla\Firefox\Profiles\l7lb6j5r.default\extensions
[2012.03.30 12:01:46 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Hilde\AppData\Roaming\mozilla\Firefox\Profiles\l7lb6j5r.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.07.24 18:11:15 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.13 02:12:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.07.19 08:58:47 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.19 14:58:10 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.23 16:13:54 | 000,003,752 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.04.02 00:22:52 | 000,002,313 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.03.19 14:58:10 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.03.19 14:58:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.19 14:58:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.19 14:58:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.19 14:58:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Hilde\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.2.5_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Codecv Class) - {815A7C14-BFD5-42E3-AF91-464085E0EEA4} - C:\ProgramData\Codecv\bhoclass.dll ()
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\12.1.0.21\AVG Secure Search_toolbar.dll ()
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\12.1.0.21\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CNAP2 Launcher] C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - Startup: C:\Users\Hilde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Hilde\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab (DynaGeoX Element)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3530269C-7AD8-424E-8C18-4CFA33FECDF5}: DhcpNameServer = 192.168.100.130
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5B76002-FDDE-4FF1-8BEB-1F46BAF14A25}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\12.1.5\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell - "" = AutoRun
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell\AutoRun\command - "" = D:\XA.EXE redirect.htm
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell - "" = AutoRun
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.24 23:55:14 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.07.23 17:53:40 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Roaming\Malwarebytes
[2012.07.23 17:53:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.23 17:52:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.23 17:52:45 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.23 17:52:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.23 16:15:45 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Local\AVG Secure Search
[2012.07.23 16:15:17 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012.07.23 16:14:20 | 000,027,496 | ---- | C] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.07.23 16:14:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012.07.23 16:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012.07.23 16:10:26 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Roaming\TuneUp Software
[2012.07.23 16:06:44 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.07.23 16:06:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.07.23 16:06:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.07.22 08:03:17 | 000,000,000 | -HSD | C] -- C:\found.025
[2012.07.13 10:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2012.07.13 02:13:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask
[2012.07.13 02:12:30 | 000,476,976 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\npdeployJava1.dll
[2012.07.13 02:12:30 | 000,157,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.07.13 02:12:30 | 000,149,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.07.13 02:12:30 | 000,149,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.07.13 01:34:12 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.12 20:35:47 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.12 20:35:12 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2012.07.12 20:35:02 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll
[2012.07.12 13:17:00 | 000,000,000 | ---D | C] -- C:\ProgramData\ywbcinzvddorazu
[2012.07.10 07:32:11 | 000,000,000 | -HSD | C] -- C:\found.024
[2012.07.08 18:06:12 | 000,000,000 | ---D | C] -- C:\Users\Hilde\Desktop\Hochzeitsvorbereitungen Jule und Thorsten
[2012.07.05 23:43:07 | 000,000,000 | -HSD | C] -- C:\found.023
[2012.06.30 22:42:57 | 000,000,000 | -HSD | C] -- C:\found.022
[2012.06.27 20:55:13 | 000,000,000 | -HSD | C] -- C:\found.021
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.25 00:20:11 | 000,000,000 | ---- | M] () -- C:\Users\Hilde\defogger_reenable
[2012.07.25 00:10:35 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.24 23:56:21 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.07.24 18:53:51 | 000,017,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.24 18:53:51 | 000,017,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.24 18:35:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.24 18:35:32 | 803,786,752 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.23 17:53:18 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.23 16:14:21 | 000,027,496 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.07.17 21:13:28 | 000,274,579 | ---- | M] () -- C:\Users\Hilde\Desktop\wohngeld_mietzuschuss.pdf
[2012.07.13 02:12:11 | 000,157,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.07.13 02:12:10 | 000,149,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.07.13 02:12:10 | 000,149,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.07.13 02:12:08 | 000,476,976 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\npdeployJava1.dll
[2012.07.13 02:12:07 | 000,472,880 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2012.07.13 01:45:47 | 000,347,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.12 17:11:16 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.07.12 17:11:15 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.07.12 13:17:04 | 000,000,051 | ---- | M] () -- C:\ProgramData\boxtbsxavutwzwc
[2012.07.09 18:02:57 | 000,658,186 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.09 18:02:57 | 000,618,692 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.09 18:02:57 | 000,131,686 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.09 18:02:57 | 000,107,972 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.07.25 00:20:11 | 000,000,000 | ---- | C] () -- C:\Users\Hilde\defogger_reenable
[2012.07.23 17:53:18 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.17 21:13:28 | 000,274,579 | ---- | C] () -- C:\Users\Hilde\Desktop\wohngeld_mietzuschuss.pdf
[2012.07.12 13:16:48 | 000,000,051 | ---- | C] () -- C:\ProgramData\boxtbsxavutwzwc
[2011.06.21 08:00:08 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.06.13 17:02:00 | 000,009,071 | ---- | C] () -- C:\Users\Hilde\.recently-used.xbel
[2010.12.11 18:13:53 | 000,001,459 | ---- | C] () -- C:\Users\Hilde\gsview32.ini
[2010.11.12 18:23:07 | 000,000,337 | ---- | C] () -- C:\Users\Hilde\AppData\Local\Perfmon.PerfmonCfg
[2010.09.27 14:02:16 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.09.27 14:02:14 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.09.21 00:17:17 | 000,034,693 | ---- | C] () -- C:\Windows\scunin.dat
[2010.08.22 13:27:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.03 01:37:11 | 000,001,604 | ---- | C] () -- C:\Users\Hilde\AppData\Roaming\gnuplot_history

< End of report >
         

--- --- ---


Extras Logdatei:
OTL EXTRAS Logfile:

OTL Extras logfile created on: 25.07.2012 00:25:00 - Run 1
OTL by OldTimer - Version 3.2.54.1     Folder = C:\Users\Hilde\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,07 Mb Total Physical Memory | 290,67 Mb Available Physical Memory | 28,44% Memory free
2,00 Gb Paging File | 0,82 Gb Available in Paging File | 40,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 39,20 Gb Free Space | 26,32% Space Free | Partition Type: NTFS
 
Computer Name: HILDE-PC | User Name: Hilde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MIF5BA~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0196821C-041E-49A4-8C39-F68D1AF8B427}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{066EA5B6-DC48-4C3F-926E-9250DA118826}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{140F6214-B532-436B-991A-6F08ACABD7F0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{379DEABE-198A-411F-9A3E-5A66F3E1D4AE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{37FC2601-2520-4103-8765-E402C2C96F16}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3D82A9A7-BF6B-44D2-AF9C-A2D664D885B6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3FB99EE1-7F36-4754-844F-DC7E7BFEF847}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{4C91A9D9-CCFF-4910-A26C-C763C81CBF33}" = lport=445 | protocol=6 | dir=in | app=system | 
"{51BD68F5-E064-49A6-9C5C-5B6D5FCF835C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{6BABF63A-483A-4F6B-A0E2-AAD7F504D319}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{76FE1753-326A-48F5-AAFF-7CE54FC10DCE}" = lport=139 | protocol=6 | dir=in | app=system | 
"{803CB2A3-EBED-46C6-8697-883EC359E814}" = rport=138 | protocol=17 | dir=out | app=system | 
"{806826AC-CCF2-4470-834D-5C7769AD1574}" = rport=139 | protocol=6 | dir=out | app=system | 
"{85086318-05CB-4A72-B7D3-67AC34D3F428}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{8645DF6F-4C44-4D09-9F8E-416DD16E0F03}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8AEA1DD3-C384-49D5-A564-E6483D587C27}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A93A8F1E-4602-412D-AAAE-89E4FBF3274F}" = lport=137 | protocol=17 | dir=in | app=system | 
"{B6D345AA-EEC2-4DF5-BDC5-153595F3C782}" = lport=138 | protocol=17 | dir=in | app=system | 
"{D2EE1E6A-9390-479B-87B6-87C69B5B4BF4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DB213867-0BBA-4D2A-97EE-150BB2290A79}" = rport=445 | protocol=6 | dir=out | app=system | 
"{E0EA9CA3-F907-4355-AD60-3B9E6981BE07}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{E27CD295-E3D1-4851-AA01-2A9FFDF370D9}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{EF4BB1E3-A8B7-4485-9C80-992D56148C2F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02BDED9D-4778-4874-A7E9-B6BEFF946C5E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{09AC9F74-BD7D-4790-A474-88E2D70B49C6}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{0D4D7000-6DF6-43CC-96C9-68019D95AE17}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{119A45F0-A807-49C5-9785-F8436BB3BF5E}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe | 
"{13041106-1C47-4595-B182-77EC74438F05}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathkernel.exe | 
"{1C8A86F5-7AE0-4D40-A617-B4DD5B739291}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{1F095D43-AA78-47CE-B04E-82FD4B2E03C6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{23D0486F-A0BC-4976-9450-D97AEF90B064}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\math.exe | 
"{251BD3D3-17BF-48E0-9838-2FBAD17CAB8F}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{30E2A8B9-EACC-4BD2-97B2-937536986EFF}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe | 
"{3AC10B5E-EE05-4921-B413-30B0C874BB82}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{41BD4A83-57F9-4F2A-A778-B00B6E760673}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{41E56610-50C1-4291-855A-D9E89D07FAFF}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathematica.exe | 
"{54E6C753-F84B-4CE7-884C-FD615E1C22DC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5548227E-4457-45FE-9545-EB1A3505D96C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{6939ED2D-8518-4354-B60A-B724D22EFE10}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{6BBACA5B-9776-412A-AF27-CF2E819E0AB0}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8E5FC1DA-9880-463E-8B4A-BABF59C13E3A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8E914D33-3FE5-48A4-953F-66157A2F105E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9E88CA67-8709-481C-9FDB-975838468D7B}" = protocol=6 | dir=out | app=system | 
"{A8C58EDA-9DF1-47B4-A4E8-CEC060DBAA0B}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathematica.exe | 
"{B139BB4B-F723-4B2D-A415-7C866BB881CD}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{C3B70F67-8BB1-4320-ADF7-9A0FFB1641EC}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathkernel.exe | 
"{C793AFA1-7D89-42A6-B632-745731911711}" = protocol=1 | dir=in | name=uni | 
"{CD19F73A-C428-4B0E-AC3D-8969BDCABF48}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{D582C332-3CFC-430B-A3DE-C6D74A38DE33}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe | 
"{D762AD5F-E28B-4466-9F68-123A97C4EC24}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\math.exe | 
"{D9C3BFE3-6ED3-4986-A222-EB368074B07D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{E19E3F43-72FA-434D-9689-9F48C117EF40}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E37C222C-A5E7-4A2E-BE84-7E098A2EF3B4}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe | 
"{FF3DA461-B149-46FC-8623-6FDEA93A5CBA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{56804A55-35D0-4F57-9298-10747F9B6DA2}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{67F76C2F-C19E-40D3-ADCF-7725F5D286D6}C:\program files\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\miranda im\miranda32.exe | 
"TCP Query User{6EBFC9A2-4EE2-4FB4-A328-93C2B6370E57}C:\program files\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\miranda im\miranda32.exe | 
"TCP Query User{8497EA94-4033-4825-8676-641231FA8B89}C:\users\hilde\desktop\aoe2\empires2.exe" = protocol=6 | dir=in | app=c:\users\hilde\desktop\aoe2\empires2.exe | 
"TCP Query User{BE38A094-2A4F-43F3-B6B1-87D10319E487}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{0D252A57-7935-45FC-9DD0-DFF3A14C02C0}C:\program files\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\miranda im\miranda32.exe | 
"UDP Query User{213A74AB-4D48-4785-9F1D-99A0FD9D5623}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{321D835B-31D7-4073-9BAE-99FD2AAD27F8}C:\users\hilde\desktop\aoe2\empires2.exe" = protocol=17 | dir=in | app=c:\users\hilde\desktop\aoe2\empires2.exe | 
"UDP Query User{3A8F7BBD-4A0E-49A1-989B-261AEDC91FF6}C:\program files\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\miranda im\miranda32.exe | 
"UDP Query User{DB958838-2896-4D98-8FEB-F9E1DBC7561E}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{09CF6AF5-9206-4FD7-9B08-BA6819FB47E3}" = Anno 1404
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{26A24AE4-039D-4CA4-87B4-2F83216018F0}" = Java(TM) 6 Update 18
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{2EF17083-57D4-4D64-AE4F-55F32A2C4571}" = Codecv
"{3315B802-84C6-47BC-907A-9B77A4646197}_is1" = SWF to AVI 1.7.1
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{5D9BE3C1-8BA4-4E7E-82FD-9F74FA6815D1}" = Nero Vision Help
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{B1FDCD51-DCC5-403A-810A-CC5A746588D1}" = WinFunktion Mathematik plus 14
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{e3017c9e-4638-4f56-adfd-a1874aa4ef83}" = Nero 9 Essentials
"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{ECE12161-B445-48FA-9056-FD54D8A72459}" = OriginPro 7.5
"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FB9607C0-17B8-42B8-BB99-A1C9F7038363}" = Wolfram Notebook Indexer 2.0
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Anno 1404 Bonus_is1" = Anno 1404 Bonus
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.13 (Unicode)
"avast" = avast! Free Antivirus
"AVG Secure Search" = AVG Security Toolbar
"Canon LBP5050" = Canon LBP5050
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"conduitEngine" = Conduit Engine
"Digital Editions" = Adobe Digital Editions
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"GeoGebra" = GeoGebra
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ImgBurn" = ImgBurn
"Inkscape" = Inkscape 0.48.1 
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"MiKTeX 2.8" = MiKTeX 2.8
"Miranda IM" = Miranda IM 0.9.38
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird (3.0.6)" = Mozilla Thunderbird (3.0.6)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"M-WIN-L 7.0.1 1213965_is1" = Wolfram Mathematica 7 (M-WIN-L 7.0.1 1213965)
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"Starcraft" = Starcraft
"SumatraPDF" = SumatraPDF
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 16.10.2011 18:56:19 | Computer Name = Hilde-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.1.7601.17514 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 70c    Startzeit: 01cc8bef1794b78b    Endzeit: 0    Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID:
   
 
Error - 17.10.2011 07:37:26 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842824
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 17.10.2011 07:40:24 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 17.10.2011 07:42:29 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft\search
 enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei
 "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll"
 in Zeile 2.  Ungültige XML-Syntax.
 
Error - 18.10.2011 17:03:28 | Computer Name = Hilde-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 7.0.1.4288 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 6d4    Startzeit: 
01cc8d7e9150be8f    Endzeit: 909    Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe

Berichts-ID:
   
 
Error - 19.10.2011 06:55:22 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842824
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 19.10.2011 06:58:01 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.10.2011 07:52:34 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842824
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 19.10.2011 07:53:22 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.10.2011 07:54:15 | Computer Name = Hilde-PC | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft\search
 enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei
 "c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll"
 in Zeile 2.  Ungültige XML-Syntax.
 
[ OSession Events ]
Error - 14.10.2010 13:25:29 | Computer Name = Hilde-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 9735
 seconds with 1080 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 23.07.2012 11:57:12 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "MBAMSwissArmy" wurde aufgrund folgenden Fehlers nicht 
gestartet:   %%2
 
Error - 23.07.2012 13:11:52 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst wuauserv erreicht.
 
Error - 23.07.2012 15:44:45 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 23.07.2012 16:05:38 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 24.07.2012 03:19:49 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 24.07.2012 04:01:16 | Computer Name = Hilde-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 24.07.2012 08:13:50 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 24.07.2012 11:17:04 | Computer Name = Hilde-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?24.?07.?2012 um 17:15:07 unerwartet heruntergefahren.
 
Error - 24.07.2012 11:18:28 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
Error - 24.07.2012 12:36:50 | Computer Name = Hilde-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   cdrom
 
 
< End of report >
         

--- --- ---

[/CODE]

GMER Logdatei

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-07-25 01:43:17
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD1600BEVS-22RST0 rev.04.01G04
Running: yif6qzl3.exe; Driver: C:\Users\Hilde\AppData\Local\Temp\ugloipob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwAddBootEntry [0x88717FC4]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                             ZwAllocateVirtualMemory [0x8F1F6510]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateEvent [0x8871A456]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateEventPair [0x8871A4AE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateIoCompletion [0x8871A5C4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateMutant [0x8871A3AC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateSection [0x8871A4FE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateSemaphore [0x8871A400]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwCreateTimer [0x8871A572]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwDeleteBootEntry [0x88717FE8]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                             ZwFreeVirtualMemory [0x8F1F65C0]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwLoadDriver [0x88717DB2]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwModifyBootEntry [0x8871800C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwNotifyChangeKey [0x8871A9BC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwNotifyChangeMultipleKeys [0x88718AA4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenEvent [0x8871A486]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenEventPair [0x8871A4D6]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenIoCompletion [0x8871A5EE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenMutant [0x8871A3D8]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenSection [0x8871A53E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenSemaphore [0x8871A42E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwOpenTimer [0x8871A59C]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                             ZwProtectVirtualMemory [0x8F1F6658]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwQueryObject [0x8871896A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwSetBootEntryOrder [0x88718030]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwSetBootOptions [0x88718054]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwSetSystemInformation [0x88717E0C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwSetSystemPowerState [0x88717F48]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwShutdownSystem [0x88717F24]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwSystemDebugControl [0x88717F6C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                             ZwVdmControl [0x88718078]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!ZwRollbackEnlistment + 1409                                                                                          83087989 1 Byte  [06]
.text           ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                                            830A74E2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntoskrnl.exe!KeRemoveQueueEx + 1393                                                                                               830AE750 4 Bytes  [C4, 7F, 71, 88]
.text           ntoskrnl.exe!KeRemoveQueueEx + 13BB                                                                                               830AE778 4 Bytes  [10, 65, 1F, 8F]
.text           ntoskrnl.exe!KeRemoveQueueEx + 146F                                                                                               830AE82C 8 Bytes  [56, A4, 71, 88, AE, A4, 71, ...] {PUSH ESI; MOVSB ; JNO 0xffffffffffffff8c; SCASB ; MOVSB ; JNO 0xffffffffffffff90}
.text           ntoskrnl.exe!KeRemoveQueueEx + 147B                                                                                               830AE838 4 Bytes  [C4, A5, 71, 88]
.text           ntoskrnl.exe!KeRemoveQueueEx + 1497                                                                                               830AE854 4 Bytes  [AC, A3, 71, 88]
.text           ...                                                                                                                               
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                                                            section is writeable [0x8F3AA300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                                                            section is writeable [0x8201B300, 0x1BEE, 0xE8000020]
PAGE            spsys.sys!?SPRevision@@3PADA + 4F90                                                                                               A0DA5000 290 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 50B3                                                                                               A0DA5123 629 Bytes  [05, DA, A0, FE, 05, 34, 05, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 5329                                                                                               A0DA5399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 538F                                                                                               A0DA53FF 148 Bytes  [18, 5D, C2, 14, 00, 8B, FF, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 543B                                                                                               A0DA54AB 2228 Bytes  [8B, FF, 55, 8B, EC, FF, 75, ...]
PAGE            ...                                                                                                                               

---- User code sections - GMER 1.0.15 ----

.text           C:\Windows\system32\svchost.exe[360] ntdll.dll!LdrUnloadDll                                                                       779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[360] ntdll.dll!LdrLoadDll                                                                         779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[360] kernel32.dll!GetBinaryTypeW + 70                                                             779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[360] USER32.dll!UnhookWindowsHookEx                                                               7735ADF9 5 Bytes  JMP 00500A08 
.text           C:\Windows\system32\svchost.exe[360] USER32.dll!UnhookWinEvent                                                                    7735B750 5 Bytes  JMP 005003FC 
.text           C:\Windows\system32\svchost.exe[360] USER32.dll!SetWindowsHookExW                                                                 7735E30C 5 Bytes  JMP 00500804 
.text           C:\Windows\system32\svchost.exe[360] USER32.dll!SetWinEventHook                                                                   773624DC 5 Bytes  JMP 005001F8 
.text           C:\Windows\system32\svchost.exe[360] USER32.dll!SetWindowsHookExA                                                                 77386D0C 5 Bytes  JMP 00500600 
.text           C:\Windows\system32\csrss.exe[400] kernel32.dll!GetBinaryTypeW + 70                                                               779169F4 1 Byte  [62]
.text           C:\Windows\system32\wininit.exe[460] ntdll.dll!LdrUnloadDll                                                                       779EC86E 5 Bytes  JMP 000303FC 
.text           C:\Windows\system32\wininit.exe[460] ntdll.dll!LdrLoadDll                                                                         779F223E 5 Bytes  JMP 000301F8 
.text           C:\Windows\system32\wininit.exe[460] kernel32.dll!GetBinaryTypeW + 70                                                             779169F4 1 Byte  [62]
.text           C:\Windows\system32\wininit.exe[460] USER32.dll!UnhookWindowsHookEx                                                               7735ADF9 5 Bytes  JMP 00050A08 
.text           C:\Windows\system32\wininit.exe[460] USER32.dll!UnhookWinEvent                                                                    7735B750 5 Bytes  JMP 000503FC 
.text           C:\Windows\system32\wininit.exe[460] USER32.dll!SetWindowsHookExW                                                                 7735E30C 5 Bytes  JMP 00050804 
.text           C:\Windows\system32\wininit.exe[460] USER32.dll!SetWinEventHook                                                                   773624DC 5 Bytes  JMP 000501F8 
.text           C:\Windows\system32\wininit.exe[460] USER32.dll!SetWindowsHookExA                                                                 77386D0C 5 Bytes  JMP 00050600 
.text           C:\Windows\system32\csrss.exe[472] kernel32.dll!GetBinaryTypeW + 70                                                               779169F4 1 Byte  [62]
.text           C:\Windows\system32\winlogon.exe[520] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000303FC 
.text           C:\Windows\system32\winlogon.exe[520] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000301F8 
.text           C:\Windows\system32\winlogon.exe[520] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\winlogon.exe[520] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 00100A08 
.text           C:\Windows\system32\winlogon.exe[520] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 001003FC 
.text           C:\Windows\system32\winlogon.exe[520] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 00100804 
.text           C:\Windows\system32\winlogon.exe[520] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 001001F8 
.text           C:\Windows\system32\winlogon.exe[520] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 00100600 
.text           C:\Windows\system32\services.exe[564] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\services.exe[564] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\services.exe[564] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\lsass.exe[592] ntdll.dll!LdrUnloadDll                                                                         779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\lsass.exe[592] ntdll.dll!LdrLoadDll                                                                           779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\lsass.exe[592] kernel32.dll!GetBinaryTypeW + 70                                                               779169F4 1 Byte  [62]
.text           C:\Windows\system32\lsm.exe[600] ntdll.dll!LdrUnloadDll                                                                           779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\lsm.exe[600] ntdll.dll!LdrLoadDll                                                                             779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\lsm.exe[600] kernel32.dll!GetBinaryTypeW + 70                                                                 779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[712] ntdll.dll!LdrUnloadDll                                                                       779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[712] ntdll.dll!LdrLoadDll                                                                         779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[712] kernel32.dll!GetBinaryTypeW + 70                                                             779169F4 1 Byte  [62]
.text           C:\Windows\system32\taskhost.exe[728] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000503FC 
.text           C:\Windows\system32\taskhost.exe[728] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000501F8 
.text           C:\Windows\system32\taskhost.exe[728] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\taskhost.exe[728] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 000E0A08 
.text           C:\Windows\system32\taskhost.exe[728] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 000E03FC 
.text           C:\Windows\system32\taskhost.exe[728] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 000E0804 
.text           C:\Windows\system32\taskhost.exe[728] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 000E01F8 
.text           C:\Windows\system32\taskhost.exe[728] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 000E0600 
.text           C:\Windows\system32\svchost.exe[800] ntdll.dll!LdrUnloadDll                                                                       779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[800] ntdll.dll!LdrLoadDll                                                                         779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[800] kernel32.dll!GetBinaryTypeW + 70                                                             779169F4 1 Byte  [62]
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] ntdll.dll!LdrUnloadDll                                                779EC86E 5 Bytes  JMP 000603FC 
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] ntdll.dll!LdrLoadDll                                                  779F223E 5 Bytes  JMP 000601F8 
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] kernel32.dll!GetBinaryTypeW + 70                                      779169F4 1 Byte  [62]
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] USER32.dll!UnhookWindowsHookEx                                        7735ADF9 5 Bytes  JMP 000F0A08 
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] USER32.dll!UnhookWinEvent                                             7735B750 5 Bytes  JMP 000F03FC 
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] USER32.dll!SetWindowsHookExW                                          7735E30C 5 Bytes  JMP 000F0804 
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] USER32.dll!SetWinEventHook                                            773624DC 5 Bytes  JMP 000F01F8 
.text           c:\Program Files\Microsoft Security Client\MsMpEng.exe[856] USER32.dll!SetWindowsHookExA                                          77386D0C 5 Bytes  JMP 000F0600 
.text           C:\Windows\system32\Ati2evxx.exe[948] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 001503FC 
.text           C:\Windows\system32\Ati2evxx.exe[948] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 001501F8 
.text           C:\Windows\system32\Ati2evxx.exe[948] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\Ati2evxx.exe[948] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 001E0A08 
.text           C:\Windows\system32\Ati2evxx.exe[948] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 001E03FC 
.text           C:\Windows\system32\Ati2evxx.exe[948] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 001E0804 
.text           C:\Windows\system32\Ati2evxx.exe[948] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 001E01F8 
.text           C:\Windows\system32\Ati2evxx.exe[948] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 001E0600 
.text           C:\Windows\System32\svchost.exe[1016] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\System32\svchost.exe[1016] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\System32\svchost.exe[1016] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\System32\svchost.exe[1016] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 00510A08 
.text           C:\Windows\System32\svchost.exe[1016] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 005103FC 
.text           C:\Windows\System32\svchost.exe[1016] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 00510804 
.text           C:\Windows\System32\svchost.exe[1016] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 005101F8 
.text           C:\Windows\System32\svchost.exe[1016] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 00510600 
.text           C:\Windows\System32\svchost.exe[1052] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\System32\svchost.exe[1052] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\System32\svchost.exe[1052] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\System32\svchost.exe[1052] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 008A0A08 
.text           C:\Windows\System32\svchost.exe[1052] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 008A03FC 
.text           C:\Windows\System32\svchost.exe[1052] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 008A0804 
.text           C:\Windows\System32\svchost.exe[1052] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 008A01F8 
.text           C:\Windows\System32\svchost.exe[1052] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 008A0600 
.text           C:\Windows\system32\svchost.exe[1084] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[1084] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[1084] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[1084] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 00F00A08 
.text           C:\Windows\system32\svchost.exe[1084] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 00F003FC 
.text           C:\Windows\system32\svchost.exe[1084] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 00F00804 
.text           C:\Windows\system32\svchost.exe[1084] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 00F001F8 
.text           C:\Windows\system32\svchost.exe[1084] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 00F00600 
.text           C:\Windows\system32\AUDIODG.EXE[1144] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] ntdll.dll!LdrUnloadDll                                               779EC86E 5 Bytes  JMP 000703FC 
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] ntdll.dll!LdrLoadDll                                                 779F223E 5 Bytes  JMP 000701F8 
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] kernel32.dll!GetBinaryTypeW + 70                                     779169F4 1 Byte  [62]
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] USER32.dll!UnhookWindowsHookEx                                       7735ADF9 5 Bytes  JMP 00200A08 
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] USER32.dll!UnhookWinEvent                                            7735B750 5 Bytes  JMP 002003FC 
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] USER32.dll!SetWindowsHookExW                                         7735E30C 5 Bytes  JMP 00200804 
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] USER32.dll!SetWinEventHook                                           773624DC 5 Bytes  JMP 002001F8 
.text           C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[1172] USER32.dll!SetWindowsHookExA                                         77386D0C 5 Bytes  JMP 00200600 
.text           C:\Windows\system32\svchost.exe[1208] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[1208] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[1208] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[1208] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 00500A08 
.text           C:\Windows\system32\svchost.exe[1208] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 005003FC 
.text           C:\Windows\system32\svchost.exe[1208] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 00500804 
.text           C:\Windows\system32\svchost.exe[1208] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 005001F8 
.text           C:\Windows\system32\svchost.exe[1208] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 00500600 
.text           C:\Windows\system32\Ati2evxx.exe[1372] ntdll.dll!LdrUnloadDll                                                                     779EC86E 5 Bytes  JMP 001503FC 
.text           C:\Windows\system32\Ati2evxx.exe[1372] ntdll.dll!LdrLoadDll                                                                       779F223E 5 Bytes  JMP 001501F8 
.text           C:\Windows\system32\Ati2evxx.exe[1372] kernel32.dll!GetBinaryTypeW + 70                                                           779169F4 1 Byte  [62]
.text           C:\Windows\system32\Ati2evxx.exe[1372] USER32.dll!UnhookWindowsHookEx                                                             7735ADF9 5 Bytes  JMP 001E0A08 
.text           C:\Windows\system32\Ati2evxx.exe[1372] USER32.dll!UnhookWinEvent                                                                  7735B750 5 Bytes  JMP 001E03FC 
.text           C:\Windows\system32\Ati2evxx.exe[1372] USER32.dll!SetWindowsHookExW                                                               7735E30C 5 Bytes  JMP 001E0804 
.text           C:\Windows\system32\Ati2evxx.exe[1372] USER32.dll!SetWinEventHook                                                                 773624DC 5 Bytes  JMP 001E01F8 
.text           C:\Windows\system32\Ati2evxx.exe[1372] USER32.dll!SetWindowsHookExA                                                               77386D0C 5 Bytes  JMP 001E0600 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] ntdll.dll!LdrUnloadDll                                                       779EC86E 5 Bytes  JMP 000A03FC 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] ntdll.dll!LdrLoadDll                                                         779F223E 5 Bytes  JMP 000A01F8 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] kernel32.dll!GetBinaryTypeW + 70                                             779169F4 1 Byte  [62]
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] USER32.dll!UnhookWindowsHookEx                                               7735ADF9 5 Bytes  JMP 000D0A08 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] USER32.dll!UnhookWinEvent                                                    7735B750 5 Bytes  JMP 000D03FC 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] USER32.dll!SetWindowsHookExW                                                 7735E30C 5 Bytes  JMP 000D0804 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] USER32.dll!SetWinEventHook                                                   773624DC 5 Bytes  JMP 000D01F8 
.text           C:\Program Files\Microsoft\BingBar\SeaPort.EXE[1408] USER32.dll!SetWindowsHookExA                                                 77386D0C 5 Bytes  JMP 000D0600 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] ntdll.dll!LdrUnloadDll                                                         779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] ntdll.dll!LdrLoadDll                                                           779F223E 5 Bytes  JMP 000601F8 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] kernel32.dll!GetBinaryTypeW + 70                                               779169F4 1 Byte  [62]
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] USER32.dll!UnhookWindowsHookEx                                                 7735ADF9 5 Bytes  JMP 00090A08 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] USER32.dll!UnhookWinEvent                                                      7735B750 5 Bytes  JMP 000903FC 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] USER32.dll!SetWindowsHookExW                                                   7735E30C 5 Bytes  JMP 00090804 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] USER32.dll!SetWinEventHook                                                     773624DC 5 Bytes  JMP 000901F8 
.text           C:\Program Files\Microsoft\BingBar\BBSvc.EXE[1424] USER32.dll!SetWindowsHookExA                                                   77386D0C 5 Bytes  JMP 00090600 
.text           C:\Windows\system32\sppsvc.exe[1508] ntdll.dll!LdrUnloadDll                                                                       779EC86E 5 Bytes  JMP 000703FC 
.text           C:\Windows\system32\sppsvc.exe[1508] ntdll.dll!LdrLoadDll                                                                         779F223E 5 Bytes  JMP 000701F8 
.text           C:\Windows\system32\sppsvc.exe[1508] kernel32.dll!GetBinaryTypeW + 70                                                             779169F4 1 Byte  [62]
.text           C:\Windows\system32\sppsvc.exe[1508] USER32.dll!UnhookWindowsHookEx                                                               7735ADF9 5 Bytes  JMP 00120A08 
.text           C:\Windows\system32\sppsvc.exe[1508] USER32.dll!UnhookWinEvent                                                                    7735B750 5 Bytes  JMP 001203FC 
.text           C:\Windows\system32\sppsvc.exe[1508] USER32.dll!SetWindowsHookExW                                                                 7735E30C 5 Bytes  JMP 00120804 
.text           C:\Windows\system32\sppsvc.exe[1508] USER32.dll!SetWinEventHook                                                                   773624DC 5 Bytes  JMP 001201F8 
.text           C:\Windows\system32\sppsvc.exe[1508] USER32.dll!SetWindowsHookExA                                                                 77386D0C 5 Bytes  JMP 00120600 
.text           C:\Windows\system32\svchost.exe[1544] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[1544] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[1544] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[1628] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[1628] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[1628] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\SearchFilterHost.exe[1644] ntdll.dll!LdrUnloadDll                                                             779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\SearchFilterHost.exe[1644] ntdll.dll!LdrLoadDll                                                               779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\SearchFilterHost.exe[1644] kernel32.dll!GetBinaryTypeW + 70                                                   779169F4 1 Byte  [62]
.text           C:\Windows\system32\SearchFilterHost.exe[1644] USER32.dll!UnhookWindowsHookEx                                                     7735ADF9 5 Bytes  JMP 00100A08 
.text           C:\Windows\system32\SearchFilterHost.exe[1644] USER32.dll!UnhookWinEvent                                                          7735B750 5 Bytes  JMP 001003FC 
.text           C:\Windows\system32\SearchFilterHost.exe[1644] USER32.dll!SetWindowsHookExW                                                       7735E30C 5 Bytes  JMP 00100804 
.text           C:\Windows\system32\SearchFilterHost.exe[1644] USER32.dll!SetWinEventHook                                                         773624DC 5 Bytes  JMP 001001F8 
.text           C:\Windows\system32\SearchFilterHost.exe[1644] USER32.dll!SetWindowsHookExA                                                       77386D0C 5 Bytes  JMP 00100600 
.text           C:\Windows\Explorer.EXE[1708] ntdll.dll!LdrUnloadDll                                                                              779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\Explorer.EXE[1708] ntdll.dll!LdrLoadDll                                                                                779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\Explorer.EXE[1708] kernel32.dll!GetBinaryTypeW + 70                                                                    779169F4 1 Byte  [62]
.text           C:\Windows\Explorer.EXE[1708] USER32.dll!UnhookWindowsHookEx                                                                      7735ADF9 5 Bytes  JMP 000A0A08 
.text           C:\Windows\Explorer.EXE[1708] USER32.dll!UnhookWinEvent                                                                           7735B750 5 Bytes  JMP 000A03FC 
.text           C:\Windows\Explorer.EXE[1708] USER32.dll!SetWindowsHookExW                                                                        7735E30C 5 Bytes  JMP 000A0804 
.text           C:\Windows\Explorer.EXE[1708] USER32.dll!SetWinEventHook                                                                          773624DC 5 Bytes  JMP 000A01F8 
.text           C:\Windows\Explorer.EXE[1708] USER32.dll!SetWindowsHookExA                                                                        77386D0C 5 Bytes  JMP 000A0600 
.text           C:\Windows\system32\Dwm.exe[1732] ntdll.dll!LdrUnloadDll                                                                          779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\Dwm.exe[1732] ntdll.dll!LdrLoadDll                                                                            779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\Dwm.exe[1732] kernel32.dll!GetBinaryTypeW + 70                                                                779169F4 1 Byte  [62]
.text           C:\Windows\system32\Dwm.exe[1732] USER32.dll!UnhookWindowsHookEx                                                                  7735ADF9 5 Bytes  JMP 00080A08 
.text           C:\Windows\system32\Dwm.exe[1732] USER32.dll!UnhookWinEvent                                                                       7735B750 5 Bytes  JMP 000803FC 
.text           C:\Windows\system32\Dwm.exe[1732] USER32.dll!SetWindowsHookExW                                                                    7735E30C 5 Bytes  JMP 00080804 
.text           C:\Windows\system32\Dwm.exe[1732] USER32.dll!SetWinEventHook                                                                      773624DC 5 Bytes  JMP 000801F8 
.text           C:\Windows\system32\Dwm.exe[1732] USER32.dll!SetWindowsHookExA                                                                    77386D0C 5 Bytes  JMP 00080600 
.text           C:\Windows\system32\svchost.exe[1744] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[1744] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[1744] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[1744] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 005B0A08 
.text           C:\Windows\system32\svchost.exe[1744] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 005B03FC 
.text           C:\Windows\system32\svchost.exe[1744] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 005B0804 
.text           C:\Windows\system32\svchost.exe[1744] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 005B01F8 
.text           C:\Windows\system32\svchost.exe[1744] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 005B0600 
.text           C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1780] kernel32.dll!SetUnhandledExceptionFilter                                778FF4FB 4 Bytes  [C2, 04, 00, 90] {RET 0x4; NOP }
.text           C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1780] kernel32.dll!GetBinaryTypeW + 70                                        779169F4 1 Byte  [62]
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] ntdll.dll!LdrUnloadDll                                     779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] ntdll.dll!LdrLoadDll                                       779F223E 5 Bytes  JMP 001601F8 
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] kernel32.dll!GetBinaryTypeW + 70                           779169F4 1 Byte  [62]
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] USER32.dll!UnhookWindowsHookEx                             7735ADF9 5 Bytes  JMP 001F0A08 
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] USER32.dll!UnhookWinEvent                                  7735B750 5 Bytes  JMP 001F03FC 
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] USER32.dll!SetWindowsHookExW                               7735E30C 5 Bytes  JMP 001F0804 
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] USER32.dll!SetWinEventHook                                 773624DC 5 Bytes  JMP 001F01F8 
.text           C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe[1836] USER32.dll!SetWindowsHookExA                               77386D0C 5 Bytes  JMP 001F0600 
.text           C:\Windows\System32\spoolsv.exe[2036] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\System32\spoolsv.exe[2036] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\System32\spoolsv.exe[2036] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\System32\spoolsv.exe[2036] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 00090A08 
.text           C:\Windows\System32\spoolsv.exe[2036] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 000903FC 
.text           C:\Windows\System32\spoolsv.exe[2036] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 00090804 
.text           C:\Windows\System32\spoolsv.exe[2036] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 000901F8 
.text           C:\Windows\System32\spoolsv.exe[2036] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 00090600 
.text           C:\Windows\system32\svchost.exe[2180] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\svchost.exe[2180] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\svchost.exe[2180] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[2200] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000A03FC 
.text           C:\Windows\system32\svchost.exe[2200] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000A01F8 
.text           C:\Windows\system32\svchost.exe[2200] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[2200] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 00290A08 
.text           C:\Windows\system32\svchost.exe[2200] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 002903FC 
.text           C:\Windows\system32\svchost.exe[2200] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 00290804 
.text           C:\Windows\system32\svchost.exe[2200] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 002901F8 
.text           C:\Windows\system32\svchost.exe[2200] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 00290600 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] ntdll.dll!LdrUnloadDll            779EC86E 5 Bytes  JMP 000703FC 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] ntdll.dll!LdrLoadDll              779F223E 5 Bytes  JMP 000701F8 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] kernel32.dll!GetBinaryTypeW + 70  779169F4 1 Byte  [62]
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] USER32.dll!UnhookWindowsHookEx    7735ADF9 5 Bytes  JMP 00200A08 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] USER32.dll!UnhookWinEvent         7735B750 5 Bytes  JMP 002003FC 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] USER32.dll!SetWindowsHookExW      7735E30C 5 Bytes  JMP 00200804 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] USER32.dll!SetWinEventHook        773624DC 5 Bytes  JMP 002001F8 
.text           C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe[2248] USER32.dll!SetWindowsHookExA      77386D0C 5 Bytes  JMP 00200600 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] ntdll.dll!LdrUnloadDll                                                                779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] ntdll.dll!LdrLoadDll                                                                  779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] kernel32.dll!GetBinaryTypeW + 70                                                      779169F4 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] USER32.dll!UnhookWindowsHookEx                                                        7735ADF9 5 Bytes  JMP 00140A08 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] USER32.dll!UnhookWinEvent                                                             7735B750 5 Bytes  JMP 001403FC 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] USER32.dll!SetWindowsHookExW                                                          7735E30C 5 Bytes  JMP 00140804 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] USER32.dll!SetWinEventHook                                                            773624DC 5 Bytes  JMP 001401F8 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2600] USER32.dll!SetWindowsHookExA                                                          77386D0C 5 Bytes  JMP 00140600 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] ntdll.dll!LdrUnloadDll                                          779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] ntdll.dll!LdrLoadDll                                            779F223E 5 Bytes  JMP 000601F8 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] kernel32.dll!GetBinaryTypeW + 70                                779169F4 1 Byte  [62]
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] USER32.dll!UnhookWindowsHookEx                                  7735ADF9 5 Bytes  JMP 00AB0A08 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] USER32.dll!UnhookWinEvent                                       7735B750 5 Bytes  JMP 00AB03FC 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] USER32.dll!SetWindowsHookExW                                    7735E30C 5 Bytes  JMP 00AB0804 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] USER32.dll!SetWinEventHook                                      773624DC 5 Bytes  JMP 00AB01F8 
.text           C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2848] USER32.dll!SetWindowsHookExA                                    77386D0C 5 Bytes  JMP 00AB0600 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] ntdll.dll!LdrUnloadDll                                              779EC86E 5 Bytes  JMP 000603FC 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] ntdll.dll!LdrLoadDll                                                779F223E 5 Bytes  JMP 000601F8 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] kernel32.dll!GetBinaryTypeW + 70                                    779169F4 1 Byte  [62]
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] USER32.dll!UnhookWindowsHookEx                                      7735ADF9 5 Bytes  JMP 00100A08 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] USER32.dll!UnhookWinEvent                                           7735B750 5 Bytes  JMP 001003FC 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] USER32.dll!SetWindowsHookExW                                        7735E30C 5 Bytes  JMP 00100804 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] USER32.dll!SetWinEventHook                                          773624DC 5 Bytes  JMP 001001F8 
.text           c:\Program Files\Microsoft Security Client\MpCmdRun.exe[2852] USER32.dll!SetWindowsHookExA                                        77386D0C 5 Bytes  JMP 00100600 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] ntdll.dll!LdrUnloadDll                                                      779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] ntdll.dll!LdrLoadDll                                                        779F223E 5 Bytes  JMP 001601F8 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] kernel32.dll!GetBinaryTypeW + 70                                            779169F4 1 Byte  [62]
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] USER32.dll!UnhookWindowsHookEx                                              7735ADF9 5 Bytes  JMP 001F0A08 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] USER32.dll!UnhookWinEvent                                                   7735B750 5 Bytes  JMP 001F03FC 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] USER32.dll!SetWindowsHookExW                                                7735E30C 5 Bytes  JMP 001F0804 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] USER32.dll!SetWinEventHook                                                  773624DC 5 Bytes  JMP 001F01F8 
.text           C:\Program Files\Synaptics\SynTP\SynTPStart.exe[2872] USER32.dll!SetWindowsHookExA                                                77386D0C 5 Bytes  JMP 001F0600 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] ntdll.dll!LdrUnloadDll                                              779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] ntdll.dll!LdrLoadDll                                                779F223E 5 Bytes  JMP 001601F8 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] kernel32.dll!GetBinaryTypeW + 70                                    779169F4 1 Byte  [62]
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] USER32.dll!UnhookWindowsHookEx                                      7735ADF9 5 Bytes  JMP 001F0A08 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] USER32.dll!UnhookWinEvent                                           7735B750 5 Bytes  JMP 001F03FC 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] USER32.dll!SetWindowsHookExW                                        7735E30C 5 Bytes  JMP 001F0804 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] USER32.dll!SetWinEventHook                                          773624DC 5 Bytes  JMP 001F01F8 
.text           C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE[2884] USER32.dll!SetWindowsHookExA                                        77386D0C 5 Bytes  JMP 001F0600 
.text           C:\Program Files\Alwil Software\Avast5\AvastUI.exe[2904] kernel32.dll!GetBinaryTypeW + 70                                         779169F4 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] ntdll.dll!LdrUnloadDll                                                                779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] ntdll.dll!LdrLoadDll                                                                  779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] kernel32.dll!GetBinaryTypeW + 70                                                      779169F4 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] USER32.dll!UnhookWindowsHookEx                                                        7735ADF9 5 Bytes  JMP 00090A08 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] USER32.dll!UnhookWinEvent                                                             7735B750 5 Bytes  JMP 000903FC 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] USER32.dll!SetWindowsHookExW                                                          7735E30C 5 Bytes  JMP 00090804 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] USER32.dll!SetWinEventHook                                                            773624DC 5 Bytes  JMP 000901F8 
.text           C:\Windows\system32\wbem\wmiprvse.exe[2912] USER32.dll!SetWindowsHookExA                                                          77386D0C 5 Bytes  JMP 00090600 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] ntdll.dll!LdrUnloadDll                                                         779EC86E 5 Bytes  JMP 001703FC 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] ntdll.dll!LdrLoadDll                                                           779F223E 5 Bytes  JMP 001701F8 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] kernel32.dll!GetBinaryTypeW + 70                                               779169F4 1 Byte  [62]
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] USER32.dll!UnhookWindowsHookEx                                                 7735ADF9 5 Bytes  JMP 00200A08 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] USER32.dll!UnhookWinEvent                                                      7735B750 5 Bytes  JMP 002003FC 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] USER32.dll!SetWindowsHookExW                                                   7735E30C 5 Bytes  JMP 00200804 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] USER32.dll!SetWinEventHook                                                     773624DC 5 Bytes  JMP 002001F8 
.text           C:\Program Files\Ask.com\Updater\Updater.exe[2920] USER32.dll!SetWindowsHookExA                                                   77386D0C 5 Bytes  JMP 00200600 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] ntdll.dll!LdrUnloadDll                                                         779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] ntdll.dll!LdrLoadDll                                                           779F223E 5 Bytes  JMP 000601F8 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] kernel32.dll!GetBinaryTypeW + 70                                               779169F4 1 Byte  [62]
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] USER32.dll!UnhookWindowsHookEx                                                 7735ADF9 5 Bytes  JMP 000F0A08 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] USER32.dll!UnhookWinEvent                                                      7735B750 5 Bytes  JMP 000F03FC 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] USER32.dll!SetWindowsHookExW                                                   7735E30C 5 Bytes  JMP 000F0804 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] USER32.dll!SetWinEventHook                                                     773624DC 5 Bytes  JMP 000F01F8 
.text           C:\Program Files\AVG Secure Search\vprot.exe[2948] USER32.dll!SetWindowsHookExA                                                   77386D0C 5 Bytes  JMP 000F0600 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] ntdll.dll!LdrUnloadDll                                                         779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] ntdll.dll!LdrLoadDll                                                           779F223E 5 Bytes  JMP 000601F8 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] kernel32.dll!GetBinaryTypeW + 70                                               779169F4 1 Byte  [62]
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] USER32.dll!UnhookWindowsHookEx                                                 7735ADF9 5 Bytes  JMP 000A0A08 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] USER32.dll!UnhookWinEvent                                                      7735B750 5 Bytes  JMP 000A03FC 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] USER32.dll!SetWindowsHookExW                                                   7735E30C 5 Bytes  JMP 000A0804 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] USER32.dll!SetWinEventHook                                                     773624DC 5 Bytes  JMP 000A01F8 
.text           C:\Program Files\Windows Sidebar\sidebar.exe[3000] USER32.dll!SetWindowsHookExA                                                   77386D0C 5 Bytes  JMP 000A0600 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] ntdll.dll!LdrUnloadDll                                              779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] ntdll.dll!LdrLoadDll                                                779F223E 5 Bytes  JMP 001601F8 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] kernel32.dll!GetBinaryTypeW + 70                                    779169F4 1 Byte  [62]
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] USER32.dll!UnhookWindowsHookEx                                      7735ADF9 5 Bytes  JMP 00200A08 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] USER32.dll!UnhookWinEvent                                           7735B750 5 Bytes  JMP 002003FC 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] USER32.dll!SetWindowsHookExW                                        7735E30C 5 Bytes  JMP 00200804 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] USER32.dll!SetWinEventHook                                          773624DC 5 Bytes  JMP 002001F8 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE[3008] USER32.dll!SetWindowsHookExA                                        77386D0C 5 Bytes  JMP 00200600 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] ntdll.dll!LdrUnloadDll                                              779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] ntdll.dll!LdrLoadDll                                                779F223E 5 Bytes  JMP 001601F8 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] kernel32.dll!GetBinaryTypeW + 70                                    779169F4 1 Byte  [62]
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] USER32.dll!UnhookWindowsHookEx                                      7735ADF9 5 Bytes  JMP 001F0A08 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] USER32.dll!UnhookWinEvent                                           7735B750 5 Bytes  JMP 001F03FC 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] USER32.dll!SetWindowsHookExW                                        7735E30C 5 Bytes  JMP 001F0804 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] USER32.dll!SetWinEventHook                                          773624DC 5 Bytes  JMP 001F01F8 
.text           C:\Windows\system32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE[3064] USER32.dll!SetWindowsHookExA                                        77386D0C 5 Bytes  JMP 001F0600 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] ntdll.dll!LdrUnloadDll                                              779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] ntdll.dll!LdrLoadDll                                                779F223E 5 Bytes  JMP 000601F8 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] kernel32.dll!GetBinaryTypeW + 70                                    779169F4 1 Byte  [62]
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] USER32.dll!UnhookWindowsHookEx                                      7735ADF9 5 Bytes  JMP 000F0A08 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] USER32.dll!UnhookWinEvent                                           7735B750 5 Bytes  JMP 000F03FC 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] USER32.dll!SetWindowsHookExW                                        7735E30C 5 Bytes  JMP 000F0804 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] USER32.dll!SetWinEventHook                                          773624DC 5 Bytes  JMP 000F01F8 
.text           C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE[3084] USER32.dll!SetWindowsHookExA                                        77386D0C 5 Bytes  JMP 000F0600 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] ntdll.dll!LdrUnloadDll                                                        779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] ntdll.dll!LdrLoadDll                                                          779F223E 5 Bytes  JMP 001601F8 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] kernel32.dll!GetBinaryTypeW + 70                                              779169F4 1 Byte  [62]
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] USER32.dll!UnhookWindowsHookEx                                                7735ADF9 5 Bytes  JMP 001F0A08 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] USER32.dll!UnhookWinEvent                                                     7735B750 5 Bytes  JMP 001F03FC 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] USER32.dll!SetWindowsHookExW                                                  7735E30C 5 Bytes  JMP 001F0804 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] USER32.dll!SetWinEventHook                                                    773624DC 5 Bytes  JMP 001F01F8 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3320] USER32.dll!SetWindowsHookExA                                                  77386D0C 5 Bytes  JMP 001F0600 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] ntdll.dll!LdrUnloadDll                                                   779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] ntdll.dll!LdrLoadDll                                                     779F223E 5 Bytes  JMP 000601F8 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] kernel32.dll!GetBinaryTypeW + 70                                         779169F4 1 Byte  [62]
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] USER32.dll!UnhookWindowsHookEx                                           7735ADF9 5 Bytes  JMP 00100A08 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] USER32.dll!UnhookWinEvent                                                7735B750 5 Bytes  JMP 001003FC 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] USER32.dll!SetWindowsHookExW                                             7735E30C 5 Bytes  JMP 00100804 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] USER32.dll!SetWinEventHook                                               773624DC 5 Bytes  JMP 001001F8 
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3380] USER32.dll!SetWindowsHookExA                                             77386D0C 5 Bytes  JMP 00100600 
.text           C:\Windows\system32\SearchIndexer.exe[3468] ntdll.dll!LdrUnloadDll                                                                779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\SearchIndexer.exe[3468] ntdll.dll!LdrLoadDll                                                                  779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\SearchIndexer.exe[3468] kernel32.dll!GetBinaryTypeW + 70                                                      779169F4 1 Byte  [62]
.text           C:\Windows\system32\SearchIndexer.exe[3468] USER32.dll!UnhookWindowsHookEx                                                        7735ADF9 5 Bytes  JMP 00190A08 
.text           C:\Windows\system32\SearchIndexer.exe[3468] USER32.dll!UnhookWinEvent                                                             7735B750 5 Bytes  JMP 001903FC 
.text           C:\Windows\system32\SearchIndexer.exe[3468] USER32.dll!SetWindowsHookExW                                                          7735E30C 5 Bytes  JMP 00190804 
.text           C:\Windows\system32\SearchIndexer.exe[3468] USER32.dll!SetWinEventHook                                                            773624DC 5 Bytes  JMP 001901F8 
.text           C:\Windows\system32\SearchIndexer.exe[3468] USER32.dll!SetWindowsHookExA                                                          77386D0C 5 Bytes  JMP 00190600 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] ntdll.dll!LdrUnloadDll                                                                779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] ntdll.dll!LdrLoadDll                                                                  779F223E 5 Bytes  JMP 001601F8 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] kernel32.dll!GetBinaryTypeW + 70                                                      779169F4 1 Byte  [62]
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] USER32.dll!UnhookWindowsHookEx                                                        7735ADF9 5 Bytes  JMP 00210A08 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] USER32.dll!UnhookWinEvent                                                             7735B750 5 Bytes  JMP 002103FC 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] USER32.dll!SetWindowsHookExW                                                          7735E30C 5 Bytes  JMP 00210804 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] USER32.dll!SetWinEventHook                                                            773624DC 5 Bytes  JMP 002101F8 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3548] USER32.dll!SetWindowsHookExA                                                          77386D0C 5 Bytes  JMP 00210600 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] ntdll.dll!LdrUnloadDll                                                                779EC86E 5 Bytes  JMP 001603FC 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] ntdll.dll!LdrLoadDll                                                                  779F223E 5 Bytes  JMP 001601F8 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] kernel32.dll!GetBinaryTypeW + 70                                                      779169F4 1 Byte  [62]
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] USER32.dll!UnhookWindowsHookEx                                                        7735ADF9 5 Bytes  JMP 00220A08 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] USER32.dll!UnhookWinEvent                                                             7735B750 5 Bytes  JMP 002203FC 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] USER32.dll!SetWindowsHookExW                                                          7735E30C 5 Bytes  JMP 00220804 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] USER32.dll!SetWinEventHook                                                            773624DC 5 Bytes  JMP 002201F8 
.text           C:\Users\Hilde\Downloads\yif6qzl3.exe[3800] USER32.dll!SetWindowsHookExA                                                          77386D0C 5 Bytes  JMP 00220600 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] ntdll.dll!LdrUnloadDll                                                           779EC86E 5 Bytes  JMP 000503FC 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] ntdll.dll!LdrLoadDll                                                             779F223E 5 Bytes  JMP 000501F8 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] kernel32.dll!GetBinaryTypeW + 70                                                 779169F4 1 Byte  [62]
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] USER32.dll!UnhookWindowsHookEx                                                   7735ADF9 5 Bytes  JMP 00130A08 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] USER32.dll!UnhookWinEvent                                                        7735B750 5 Bytes  JMP 001303FC 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] USER32.dll!SetWindowsHookExW                                                     7735E30C 5 Bytes  JMP 00130804 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] USER32.dll!SetWinEventHook                                                       773624DC 5 Bytes  JMP 001301F8 
.text           C:\Windows\system32\SearchProtocolHost.exe[3964] USER32.dll!SetWindowsHookExA                                                     77386D0C 5 Bytes  JMP 00130600 
.text           C:\Windows\system32\taskeng.exe[4008] ntdll.dll!LdrUnloadDll                                                                      779EC86E 5 Bytes  JMP 000603FC 
.text           C:\Windows\system32\taskeng.exe[4008] ntdll.dll!LdrLoadDll                                                                        779F223E 5 Bytes  JMP 000601F8 
.text           C:\Windows\system32\taskeng.exe[4008] kernel32.dll!GetBinaryTypeW + 70                                                            779169F4 1 Byte  [62]
.text           C:\Windows\system32\taskeng.exe[4008] USER32.dll!UnhookWindowsHookEx                                                              7735ADF9 5 Bytes  JMP 000F0A08 
.text           C:\Windows\system32\taskeng.exe[4008] USER32.dll!UnhookWinEvent                                                                   7735B750 5 Bytes  JMP 000F03FC 
.text           C:\Windows\system32\taskeng.exe[4008] USER32.dll!SetWindowsHookExW                                                                7735E30C 5 Bytes  JMP 000F0804 
.text           C:\Windows\system32\taskeng.exe[4008] USER32.dll!SetWinEventHook                                                                  773624DC 5 Bytes  JMP 000F01F8 
.text           C:\Windows\system32\taskeng.exe[4008] USER32.dll!SetWindowsHookExA                                                                77386D0C 5 Bytes  JMP 000F0600 

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                           aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000066                                                                                                 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\tdx \Device\Udp                                                                                                           aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- EOF - GMER 1.0.15 ----
         

Bei defogger gab es keine Fehlermeldung (Schritt 1).

Danke schonmal für eure Hilfe!
Liebe Grüße
FraHi

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
MOD - [2012.07.23 16:14:01 | 001,147,488 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe 
SRV - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe -- (vToolbarUpdater12.1.5) 
SRV - [2012.07.19 08:58:45 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) 
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Hilde\AppData\Local\Temp\ugloipob.sys -- (ugloipob) 
DRV - [2010.09.27 14:02:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) 
DRV - [2010.09.27 14:02:14 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) 
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) 
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=111378&babsrc=SP_ss&mntrId=40517db30000000000000040d0a474c6 
IE - HKCU\..\SearchScopes\{86BED112-CFE1-4D22-BE45-637C306DD91A}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43 
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=dsp&q={searchTerms} 
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "about:home" 
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_ptnrs=&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43&apn_dtid=OSJ000&&q=" 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.1.0.21\ [2012.07.23 16:15:17 | 000,000,000 | ---D | M] 
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) 
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKLM..\Run: [CNAP2 Launcher] C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.) 
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe () 
O4 - Startup: C:\Users\Hilde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell - "" = AutoRun 
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell\AutoRun\command - "" = D:\XA.EXE redirect.htm 
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell - "" = AutoRun 
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell\AutoRun\command - "" = F:\SETUP.EXE 

[2012.07.23 16:06:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} 
[2012.07.13 02:13:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask 
[[2012.07.12 13:17:00 | 000,000,000 | ---D | C] -- C:\ProgramData\ywbcinzvddorazu 
[2012.07.12 13:17:04 | 000,000,051 | ---- | M] () -- C:\ProgramData\boxtbsxavutwzwc 

[2012.07.23 16:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search 
[2012.07.23 16:14:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search 
[2012.04.02 00:22:52 | 000,002,313 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml 
 
[2012.07.13 10:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com 
[2012.07.13 02:12:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} 
[2012.07.25 00:10:35 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
:Files

C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe

C:\autoexec.bat 

D:\XA.EXE redirect.htm
F:\SETUP.EXE

C:\ProgramData\boxtbsxavutwzwc
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Dankeschön! Das mach ich dann gleich mal!
Glg

Es hat soweit alles funktioniert + Neustart.

Hier die Logdatei:

All processes killed
========== OTL ==========
Service vToolbarUpdater12.1.5 stopped successfully!
Service vToolbarUpdater12.1.5 deleted successfully!
C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe moved successfully.
Service MozillaMaintenance stopped successfully!
Service MozillaMaintenance deleted successfully!
C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe moved successfully.
Error: No service named ugloipob was found to stop!
Service\Driver key ugloipob not found.
File C:\Users\Hilde\AppData\Local\Temp\ugloipob.sys not found.
Service atksgt stopped successfully!
Service atksgt deleted successfully!
C:\Windows\System32\drivers\atksgt.sys moved successfully.
Service lirsgt stopped successfully!
Service lirsgt deleted successfully!
C:\Windows\System32\drivers\lirsgt.sys moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.
C:\Programme\softonic-de3\tbsoft.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{86BED112-CFE1-4D22-BE45-637C306DD91A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86BED112-CFE1-4D22-BE45-637C306DD91A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "AVG Secure Search" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "about:home" removed from browser.startup.homepage
Prefs.js: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_ptnrs=&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43&apn_dtid=OSJ000&&q=" removed from keyword.URL
File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.1.0.21\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Programme\ConduitEngine\ConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File de3\tbsoft.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.
File de3\tbsoft.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Programme\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\CNAP2 Launcher deleted successfully.
C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vProt deleted successfully.
C:\Programme\AVG Secure Search\vprot.exe moved successfully.
C:\Users\Hilde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk moved successfully.
C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ not found.
File D:\XA.EXE redirect.htm not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ not found.
File F:\SETUP.EXE not found.
C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} folder moved successfully.
C:\ProgramData\Ask\APN-Stub folder moved successfully.
C:\ProgramData\Ask folder moved successfully.
C:\ProgramData\ywbcinzvddorazu folder moved successfully.
C:\ProgramData\boxtbsxavutwzwc moved successfully.
C:\Program Files\AVG Secure Search\radio folder moved successfully.
C:\Program Files\AVG Secure Search\Licenses folder moved successfully.
C:\Program Files\AVG Secure Search\Chrome\icons folder moved successfully.
C:\Program Files\AVG Secure Search\Chrome folder moved successfully.
C:\Program Files\AVG Secure Search\12.1.0.21\radio folder moved successfully.
C:\Program Files\AVG Secure Search\12.1.0.21\Chrome\icons folder moved successfully.
C:\Program Files\AVG Secure Search\12.1.0.21\Chrome folder moved successfully.
C:\Program Files\AVG Secure Search\12.1.0.21 folder moved successfully.
C:\Program Files\AVG Secure Search folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ToolBandTlb\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ToolBandTlb folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\DriverInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\DriverInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\DNTInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\DNTInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\CommonInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\CommonInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search folder moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
C:\Program Files\Ask.com\Updater folder moved successfully.
C:\Program Files\Ask.com\assets\oobe folder moved successfully.
C:\Program Files\Ask.com\assets folder moved successfully.
C:\Program Files\Ask.com folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\content folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} folder moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
========== FILES ==========
File\Folder C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe not found.
File\Folder C:\autoexec.bat not found.
File\Folder D:\XA.EXE redirect.htm not found.
File\Folder F:\SETUP.EXE not found.
File\Folder C:\ProgramData\boxtbsxavutwzwc not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Hilde\Desktop\cmd.bat deleted successfully.
C:\Users\Hilde\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Hilde
->Temp folder emptied: 117037365 bytes
->Temporary Internet Files folder emptied: 94439481 bytes
->Java cache emptied: 259789698 bytes
->FireFox cache emptied: 82849065 bytes
->Google Chrome cache emptied: 116669806 bytes
->Flash cache emptied: 49335132 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11763212 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 698,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Hilde
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.54.1 log created on 07252012_164115

Files\Folders moved on Reboot...
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\apiCAJ212RO.htm moved successfully.
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\apiCAJ5QN1P.htm moved successfully.
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\background-banner-middle-v9[3].jpg moved successfully.
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\background-banner-right-v9[2].jpg moved successfully.
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LGQ6C7Z\background_banner_7_de[1].jpg moved successfully.
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LGQ6C7Z\button-flex-blue2[1].png moved successfully.
C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LGQ6C7Z\tick-blue[1].png moved successfully.

PendingFileRenameOperations files...
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\apiCAJ212RO.htm not found!
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\apiCAJ5QN1P.htm not found!
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\background-banner-middle-v9[3].jpg not found!
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNC3NLXV\background-banner-right-v9[2].jpg not found!
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LGQ6C7Z\background_banner_7_de[1].jpg not found!
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LGQ6C7Z\button-flex-blue2[1].png not found!
File C:\Users\Hilde\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LGQ6C7Z\tick-blue[1].png not found!

Registry entries deleted on Reboot...
         

Was mach ich jetzt? Oder wars das schon?
Liebe Grüße

Jetzt ist gerade ein neues Problem aufgetreten, ich habe ein update für Avast installiert und beim Neustart, ist ein Problem aufgetreten (er konnte nicht mehr hoch fahren), windows hat dann eine Systemwiederherstellung gemacht; jedoch weiß ich nicht von welchem Zeitpunkt, wurde mir nicht angezeigt.

Muss ich jetzt alle Schritte wiederholen? An sich ist es ja möglich, dass sich einiges geändert hat oder sehe ich das falsch?

Das hier ist total zum verzweifeln .

Danke für die Hilfe!
GLg FraHi

Edit: Avast startet jetzt auch nicht mehr .

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hallo,
dankeschön, ich habe den Quick Scan wie beschrieben durchgeführt.

Hier wieder die OTL Logdatei:

OTL logfile created on: 31.07.2012 14:00:58 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Hilde\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,07 Mb Total Physical Memory | 471,42 Mb Available Physical Memory | 46,12% Memory free
2,00 Gb Paging File | 1,09 Gb Available in Paging File | 54,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 47,32 Gb Free Space | 31,77% Space Free | Partition Type: NTFS
 
Computer Name: HILDE-PC | User Name: Hilde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.31 13:03:38 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Hilde\Desktop\OTL.exe
PRC - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.05.04 15:43:20 | 001,561,768 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2012.03.26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.28 20:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastUI.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.05.18 16:13:58 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2007.10.09 07:23:32 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPStart.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.07.27 20:10:21 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe -- (vToolbarUpdater12.1.5)
SRV - [2012.07.19 08:58:45 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.03.26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.28 20:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.05.18 16:13:58 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2010.04.28 07:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.04.17 18:53:33 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.04.29 03:21:04 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.07.23 16:14:21 | 000,027,496 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.03.20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011.11.28 19:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.11.28 19:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.11.28 19:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.11.28 19:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.11.28 19:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011.11.28 19:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.11.20 14:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010.11.20 14:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010.11.20 12:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.27 14:02:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.09.27 14:02:14 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32)
DRV - [2009.04.29 03:20:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2007.03.07 16:28:42 | 000,167,424 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\aver7700.sys -- (aver7700)
DRV - [2006.11.30 15:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2006.11.24 21:46:38 | 002,085,888 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2005.11.14 13:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=hp
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A5 0E B4 C0 D2 AC CB 01  [binary data]
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=111378&babsrc=SP_ss&mntrId=40517db30000000000000040d0a474c6
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{86BED112-CFE1-4D22-BE45-637C306DD91A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_ptnrs=&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43&apn_dtid=OSJ000&&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.1.5\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.1.0.21\ [2012.07.23 16:15:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 08:58:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.13 02:12:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.07.24 18:34:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 08:58:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.13 02:12:30 | 000,000,000 | ---D | M]
 
[2010.04.11 22:22:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hilde\AppData\Roaming\mozilla\Extensions
[2010.04.11 22:22:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hilde\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.07.25 19:05:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hilde\AppData\Roaming\mozilla\Firefox\Profiles\l7lb6j5r.default\extensions
[2012.03.30 12:01:46 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Hilde\AppData\Roaming\mozilla\Firefox\Profiles\l7lb6j5r.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.07.25 19:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.25 19:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.07.19 08:58:47 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.19 14:58:10 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.23 16:13:54 | 000,003,752 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.03.19 14:58:10 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.03.19 14:58:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.19 14:58:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.19 14:58:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.19 14:58:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Hilde\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.2.5_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Codecv Class) - {815A7C14-BFD5-42E3-AF91-464085E0EEA4} - C:\ProgramData\Codecv\bhoclass.dll ()
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\12.1.0.21\AVG Secure Search_toolbar.dll ()
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\12.1.0.21\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CNAP2 Launcher] C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Hilde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Hilde\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab (DynaGeoX Element)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3530269C-7AD8-424E-8C18-4CFA33FECDF5}: DhcpNameServer = 192.168.100.130
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5B76002-FDDE-4FF1-8BEB-1F46BAF14A25}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\12.1.5\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell - "" = AutoRun
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell\AutoRun\command - "" = D:\XA.EXE redirect.htm
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell - "" = AutoRun
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.31 13:03:09 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Hilde\Desktop\OTL.exe
[2012.07.25 18:31:17 | 000,000,000 | ---D | C] -- C:\Avenger
[2012.07.25 17:53:43 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.07.25 16:41:15 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.07.25 00:49:21 | 000,100,864 | ---- | C] (GMER) -- C:\ugloipob.sys
[2012.07.23 17:53:40 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Roaming\Malwarebytes
[2012.07.23 17:53:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.23 17:52:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.23 17:52:45 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.23 17:52:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.23 16:15:45 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Local\AVG Secure Search
[2012.07.23 16:15:17 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012.07.23 16:14:20 | 000,027,496 | ---- | C] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.07.23 16:14:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012.07.23 16:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012.07.23 16:10:26 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Roaming\TuneUp Software
[2012.07.23 16:06:44 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.07.23 16:06:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.07.23 16:06:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.07.22 08:03:17 | 000,000,000 | -HSD | C] -- C:\found.025
[2012.07.13 10:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2012.07.10 07:32:11 | 000,000,000 | -HSD | C] -- C:\found.024
[2012.07.09 17:45:21 | 000,000,000 | ---D | C] -- C:\Users\Hilde\Desktop\eingescannte Unterlagen
[2012.07.08 18:06:12 | 000,000,000 | ---D | C] -- C:\Users\Hilde\Desktop\Hochzeitsvorbereitungen Jule und Thorsten
[2012.07.05 23:43:07 | 000,000,000 | -HSD | C] -- C:\found.023
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.31 14:09:04 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.31 13:03:38 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Hilde\Desktop\OTL.exe
[2012.07.31 10:10:33 | 000,017,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 10:10:33 | 000,017,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 10:02:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.31 10:02:47 | 803,786,752 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.25 11:13:52 | 000,027,043 | ---- | M] () -- C:\Users\Hilde\Desktop\Desktop.zip
[2012.07.25 00:49:21 | 000,100,864 | ---- | M] (GMER) -- C:\ugloipob.sys
[2012.07.25 00:20:11 | 000,000,000 | ---- | M] () -- C:\Users\Hilde\defogger_reenable
[2012.07.23 17:53:18 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.23 16:14:21 | 000,027,496 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.07.17 21:13:28 | 000,274,579 | ---- | M] () -- C:\Users\Hilde\Desktop\wohngeld_mietzuschuss.pdf
[2012.07.13 01:45:47 | 000,347,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.09 18:02:57 | 000,658,186 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.09 18:02:57 | 000,618,692 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.09 18:02:57 | 000,131,686 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.09 18:02:57 | 000,107,972 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.25 11:13:00 | 000,027,043 | ---- | C] () -- C:\Users\Hilde\Desktop\Desktop.zip
[2012.07.25 00:20:11 | 000,000,000 | ---- | C] () -- C:\Users\Hilde\defogger_reenable
[2012.07.23 17:53:18 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.17 21:13:28 | 000,274,579 | ---- | C] () -- C:\Users\Hilde\Desktop\wohngeld_mietzuschuss.pdf
[2011.06.21 08:00:08 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.06.13 17:02:00 | 000,009,071 | ---- | C] () -- C:\Users\Hilde\.recently-used.xbel
[2010.12.11 18:13:53 | 000,001,459 | ---- | C] () -- C:\Users\Hilde\gsview32.ini
[2010.11.12 18:23:07 | 000,000,337 | ---- | C] () -- C:\Users\Hilde\AppData\Local\Perfmon.PerfmonCfg
[2010.09.27 14:02:16 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.09.27 14:02:14 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.09.21 00:17:17 | 000,034,693 | ---- | C] () -- C:\Windows\scunin.dat
[2010.08.22 13:27:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.03 01:37:11 | 000,001,604 | ---- | C] () -- C:\Users\Hilde\AppData\Roaming\gnuplot_history
 
========== LOP Check ==========
 
[2012.03.03 01:15:39 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Amazon
[2011.04.23 19:12:45 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Audacity
[2012.04.02 00:22:43 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Babylon
[2011.04.23 19:18:30 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.05.23 00:29:31 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\DynaGeo
[2010.04.17 21:57:54 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\ImgBurn
[2011.05.25 17:55:23 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\inkscape
[2010.11.21 01:05:37 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Miranda
[2010.04.15 22:03:46 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\OpenOffice.org
[2010.10.07 18:07:00 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\OriginLab
[2010.04.13 20:48:49 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\ScummVM
[2010.10.03 20:17:38 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\SumatraPDF
[2010.04.16 16:37:05 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\TeamViewer
[2010.04.11 22:22:24 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Thunderbird
[2012.07.23 16:48:55 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\TuneUp Software
[2010.09.27 14:11:10 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Ubisoft
[2012.07.04 11:06:41 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.03.25 23:30:52 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Adobe
[2012.03.03 01:15:39 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Amazon
[2011.04.23 19:12:45 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Audacity
[2012.04.02 00:22:43 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Babylon
[2011.10.15 05:35:34 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\dvdcss
[2011.04.23 19:18:30 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.05.23 00:29:31 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\DynaGeo
[2010.04.11 21:25:29 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Identities
[2010.04.17 21:57:54 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\ImgBurn
[2011.05.25 17:55:23 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\inkscape
[2012.07.25 19:39:03 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Macromedia
[2012.07.23 17:53:40 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Malwarebytes
[2011.05.23 01:48:34 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Mathematica
[2009.07.14 10:56:56 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Media Center Programs
[2011.06.16 17:53:21 | 000,000,000 | --SD | M] -- C:\Users\Hilde\AppData\Roaming\Microsoft
[2010.10.03 19:59:06 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\MiKTeX
[2010.11.21 01:05:37 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Miranda
[2010.04.11 21:29:04 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Mozilla
[2010.04.15 22:03:46 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\OpenOffice.org
[2010.10.07 18:07:00 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\OriginLab
[2010.04.13 20:48:49 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\ScummVM
[2012.07.25 18:53:18 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Skype
[2012.07.25 18:46:24 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\skypePM
[2010.10.03 20:17:38 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\SumatraPDF
[2010.04.16 16:37:05 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\TeamViewer
[2010.04.11 22:22:24 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Thunderbird
[2012.07.23 16:48:55 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\TuneUp Software
[2010.09.27 14:11:10 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Ubisoft
[2012.06.09 14:42:45 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\vlc
 
< %APPDATA%\*.exe /s >
[2012.03.25 23:08:04 | 000,117,427 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Hilde\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\digitaleditions\digitaleditions.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\afm2afm.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\authorindex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\autoinst.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\bdftops.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\bib2xhtml.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\bibhtml.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\biokey2html.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\biokey2html1.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\biokey2html2.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\biokey2html3.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\birm.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\cmap2enc.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\config.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\csvtools.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dblatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbmxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dbxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\dumphint.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\eps2eps.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\escontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\eslatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\esmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\estex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\estexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\esxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\esxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\feynmf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\fig4latex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\findhyph.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\fixmswrd.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\fixwada2.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\font2afm.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\font2c.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gsbj.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gsdj.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gsdj500.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gslj.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gslp.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gsnd.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gsndt.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gssetgs.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gst.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\gstt.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ht.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\htcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\htlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\htmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\httex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\httexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\htxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\htxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ibyhyph.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1context.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1latex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1mex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1tex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1texi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1xelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jh1xetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jhxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jkpexa.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jmxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jscontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jslatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jsmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jstex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jstexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jsxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\jsxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\latexdiff-fast.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\latexdiff-so.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\latexdiff-vc.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\latexdiff.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\latexmk.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\latexrevise.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\lp386.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\lp386r2.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\lpgs.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\lpr2.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\makeglossaries.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\makeuniwada.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\merge.exe
[2009.09.23 16:47:53 | 001,234,432 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\miktex-taskbar-icon.exe
[2009.09.23 16:47:53 | 001,234,432 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\miktex-update.exe
[2009.09.23 16:47:53 | 001,234,944 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\miktex-update_admin.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mk4ht.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mkt1font.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mm.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mzcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mzlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mzmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mztex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mztexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mzxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\mzxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\nts.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\oocontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\oolatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\oomex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ootex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ootexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ooxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ooxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\orderrefs.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ot2kpx.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pdf2dsc.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pdf2ps.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pdfatfi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pdfcrop.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pdfopt.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pedigree.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\perltex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pf2afm.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pfbtopfa.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pfm2kpx.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pftogsf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\plind.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pn2pdf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2ascii.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2epsi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2pdf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2pdf12.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2pdf13.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2pdf14.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2pdfxx.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2ps.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps2ps2.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\ps4pdf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\pst2pdf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\rcsinfo.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\showglyphs.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\splitindex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\svn-multi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teicontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teilatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teimxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teitex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teitexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teixelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\teixetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\texcount.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\texdiff.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\texdirflatten.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\texshow.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\thumbpdf.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\urlbst.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\uxhxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\vpl2ovp.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\vpl2vpl.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wmakebat.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\wxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xdv2pdf_mergemarks.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmcontext.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmlatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmmex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhmxetex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhtex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhtexi.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhxelatex.exe
[2009.10.03 20:02:05 | 000,022,528 | ---- | M] () -- C:\Users\Hilde\AppData\Roaming\MiKTeX\2.8\miktex\bin\xhxetex.exe
 
< %SYSTEMDRIVE%\*.exe >
[2008.04.11 08:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\drivers\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\drivers\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >
 
<           >

< End of report >
         

LG

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
PRC - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe 
PRC - [2012.05.04 15:43:20 | 001,561,768 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe 
SRV - [2012.07.23 16:14:10 | 000,830,048 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe -- (vToolbarUpdater12.1.5) 
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=111378&babsrc=SP_ss&mntrId=40517db30000000000000040d0a474c6 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{86BED112-CFE1-4D22-BE45-637C306DD91A}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=dsp&q={searchTerms} 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 
IE - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "about:home" 
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_ptnrs=&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43&apn_dtid=OSJ000&&q=" 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.1.0.21\ [2012.07.23 16:15:17 | 000,000,000 | ---D | M] 
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) 
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. 
O3 - HKU\S-1-5-21-3054361464-688899464-1391419043-1001\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKLM..\Run: [CNAP2 Launcher] C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.) 
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe () 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell - "" = AutoRun 
O33 - MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\Shell\AutoRun\command - "" = D:\XA.EXE redirect.htm 
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell - "" = AutoRun 
O33 - MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\Shell\AutoRun\command - "" = F:\SETUP.EXE 
NetSvcs: FastUserSwitchingCompatibility - File not found 
NetSvcs: Nla - File not found 
NetSvcs: Ntmssvc - File not found 
NetSvcs: NWCWorkstation - File not found 
NetSvcs: Nwsapagent - File not found 
NetSvcs: SRService - File not found 
NetSvcs: WmdmPmSp - File not found 
NetSvcs: LogonHours - File not found 
NetSvcs: PCAudit - File not found 
NetSvcs: helpsvc - File not found 
NetSvcs: uploadmgr - File not found 

[2012.07.23 16:06:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} 
[2012.07.23 16:06:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files 
[2012.03.19 14:58:10 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.03.19 14:58:10 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml 
[2012.03.19 14:58:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml 
[2012.03.19 14:58:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.03.19 14:58:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.03.19 14:58:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml 
[2012.07.23 16:13:54 | 000,003,752 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml 
[2012.07.23 16:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search 
[2012.07.23 16:14:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search 
 [2012.07.23 16:15:45 | 000,000,000 | ---D | C] -- C:\Users\Hilde\AppData\Local\AVG Secure Search 
[2012.07.13 10:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com 
[2012.07.31 14:09:04 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
[2012.04.02 00:22:43 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\Babylon 
[2012.07.25 18:46:24 | 000,000,000 | ---D | M] -- C:\Users\Hilde\AppData\Roaming\skypePM
:Files


D:\XA.EXE 

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Erledigt:

All processes killed
========== OTL ==========
Process ToolbarUpdater.exe killed successfully!
No active process named Updater.exe was found!
Service vToolbarUpdater12.1.5 stopped successfully!
Service vToolbarUpdater12.1.5 deleted successfully!
C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5\ToolbarUpdater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.
C:\Programme\softonic-de3\tbsoft.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\SearchScopes\{86BED112-CFE1-4D22-BE45-637C306DD91A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86BED112-CFE1-4D22-BE45-637C306DD91A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "AVG Secure Search" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "about:home" removed from browser.startup.homepage
Prefs.js: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=F253B74C-645E-4B8E-B4B9-D071BA7874F6&apn_ptnrs=&apn_sauid=0D097579-F55B-430D-8B4C-9132DFA89E43&apn_dtid=OSJ000&&q=" removed from keyword.URL
File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.1.0.21\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Programme\ConduitEngine\ConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File de3\tbsoft.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-3054361464-688899464-1391419043-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.
File de3\tbsoft.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Programme\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\CNAP2 Launcher deleted successfully.
C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vProt deleted successfully.
C:\Programme\AVG Secure Search\vprot.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f0e8520-687e-11e1-8b98-da9d220af60f}\ not found.
File D:\XA.EXE redirect.htm not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ddefd00-c4df-11df-9caa-0040d0a474c6}\ not found.
File F:\SETUP.EXE not found.
FastUserSwitchingCompatibility removed from NetSvcs value successfully!
Nla removed from NetSvcs value successfully!
Ntmssvc removed from NetSvcs value successfully!
NWCWorkstation removed from NetSvcs value successfully!
Nwsapagent removed from NetSvcs value successfully!
SRService removed from NetSvcs value successfully!
WmdmPmSp removed from NetSvcs value successfully!
LogonHours removed from NetSvcs value successfully!
PCAudit removed from NetSvcs value successfully!
helpsvc removed from NetSvcs value successfully!
uploadmgr removed from NetSvcs value successfully!
C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} folder moved successfully.
C:\ProgramData\Common Files folder moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\avg-secure-search.xml moved successfully.
C:\Program Files\AVG Secure Search\12.1.0.21 folder moved successfully.
C:\Program Files\AVG Secure Search folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\DriverInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\DriverInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\CommonInstaller\12.1.5 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\CommonInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search folder moved successfully.
C:\Users\Hilde\AppData\Local\AVG Secure Search\SiteSafety folder moved successfully.
C:\Users\Hilde\AppData\Local\AVG Secure Search\DNT folder moved successfully.
C:\Users\Hilde\AppData\Local\AVG Secure Search folder moved successfully.
C:\Program Files\Ask.com\Updater folder moved successfully.
C:\Program Files\Ask.com folder moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\Users\Hilde\AppData\Roaming\Babylon folder moved successfully.
C:\Users\Hilde\AppData\Roaming\skypePM folder moved successfully.
========== FILES ==========
File\Folder D:\XA.EXE not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Hilde\Desktop\cmd.bat deleted successfully.
C:\Users\Hilde\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Hilde
->Temp folder emptied: 247871834 bytes
->Temporary Internet Files folder emptied: 38769215 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 101992752 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 141940 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2515252 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 373,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Hilde
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.55.0 log created on 07312012_150215

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
File\Folder C:\Windows\temp\TMP00000001311A078625B33EA4 not found!

PendingFileRenameOperations files...
[2009.07.14 03:14:23 | 000,093,696 | ---- | M] (Microsoft Corporation) C:\Windows\System32\mctadmin.exe : MD5=BBA1A5B86134F496B926DDAF247DB871
File C:\Windows\temp\TMP00000001311A078625B33EA4 not found!

Registry entries deleted on Reboot...
         

Sehr gut!


1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Danke für deine schnelle Hilfe! Ihr seid echt super!

Vollscan mit MAM ergab keine Fehler/Viren und Co:

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.30.08

Schutz: Aktiviert

31.07.2012 15:34:41
mbam-log-2012-07-31 (15-34-41).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 335314
Laufzeit: 1 Stunde(n), 41 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

ADW-Cleaner:

# AdwCleaner v1.703 - Logfile created 07/31/2012 at 17:50:25
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : Hilde - HILDE-PC
# Running from : C:\Users\Hilde\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Hilde\AppData\Local\Babylon
Folder Found : C:\Users\Hilde\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Hilde\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Hilde\AppData\LocalLow\Conduit
Folder Found : C:\Users\Hilde\AppData\LocalLow\ConduitEngine
Folder Found : C:\Users\Hilde\AppData\LocalLow\PriceGong
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\ProgramData\Babylon
Folder Found : C:\ProgramData\InstallMate
Folder Found : C:\Program Files\Conduit
Folder Found : C:\Program Files\ConduitEngine
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\conduitEngine
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\AVG Secure Search
Key Found : HKLM\SOFTWARE\Babylon
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho
Key Found : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\conduitEngine
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=hp
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxps://isearch.avg.com/tab?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=nt

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Hilde\AppData\Roaming\Mozilla\Firefox\Profiles\l7lb6j5r.default\prefs.js

Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Found : user_pref("extensions.BabylonToolbar.admin", false);
Found : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Found : user_pref("extensions.BabylonToolbar.babExt", "");
Found : user_pref("extensions.BabylonToolbar.babTrack", "affID=111378");
Found : user_pref("extensions.BabylonToolbar.bbDpng", 2);
Found : user_pref("extensions.BabylonToolbar.dfltSrch", false);
Found : user_pref("extensions.BabylonToolbar.hmpg", false);
Found : user_pref("extensions.BabylonToolbar.id", "40517db30000000000000040d0a474c6");
Found : user_pref("extensions.BabylonToolbar.instlDay", "15431");
Found : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Found : user_pref("extensions.BabylonToolbar.lastDP", 2);
Found : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.170:23:02");
Found : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "11.0");
Found : user_pref("extensions.BabylonToolbar.newTab", true);
Found : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Found : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Found : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Found : user_pref("extensions.BabylonToolbar.propectorlck", 71909082);
Found : user_pref("extensions.BabylonToolbar.prtkDS", 1);
Found : user_pref("extensions.BabylonToolbar.prtkHmpg", 1);
Found : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Found : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Found : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Found : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Found : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Found : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.170:23:02");
Found : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Found : user_pref("extensions.BabylonToolbar_i.babExt", "");
Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111378");
Found : user_pref("extensions.BabylonToolbar_i.hardId", "40517db30000000000000040d0a474c6");
Found : user_pref("extensions.BabylonToolbar_i.id", "40517db30000000000000040d0a474c6");
Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15431");
Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Found : user_pref("extensions.BabylonToolbar_i.newTab", true);
Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=111378&babsrc=N[...]
Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.170:23:02");
Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Found : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.babylon.com/?affID=111378&babsr[...]
Found : user_pref("extensions.nurit5562nurit235.scode", "(function(){try{for(i=0;i<5;i++){window.setTimeout([...]

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Hilde\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found : {"bookmark_bar":{"show_on_all_tabs":true},"browser":{"check_default_browser":false,"ntp":{"promo_ima[...]

*************************

AdwCleaner[R1].txt - [11953 octets] - [31/07/2012 17:50:25]

########## EOF - C:\AdwCleaner[R1].txt - [12082 octets] ##########
         

Sehr gut!

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Einmal:

# AdwCleaner v1.703 - Logfile created 07/31/2012 at 19:33:04
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : Hilde - HILDE-PC
# Running from : C:\Users\Hilde\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Hilde\AppData\Local\Babylon
Folder Deleted : C:\Users\Hilde\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Hilde\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Hilde\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Hilde\AppData\LocalLow\ConduitEngine
Folder Deleted : C:\Users\Hilde\AppData\LocalLow\PriceGong
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\ConduitEngine
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\conduitEngine
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho
Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=hp --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxps://isearch.avg.com/tab?cid={6AFAD66C-D621-4AF8-A3F8-B0FE834018BF}&mid=c287475fcad247d0ae6f78f6f08611f6-aedbff8af46d1f6351514d5e2801ba14325979f9&lang=de&ds=tt014&pr=sa&d=2012-07-23 16:14:29&v=12.1.0.21&sap=nt --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Hilde\AppData\Roaming\Mozilla\Firefox\Profiles\l7lb6j5r.default\prefs.js

C:\Users\Hilde\AppData\Roaming\Mozilla\Firefox\Profiles\l7lb6j5r.default\user.js ... Deleted !

Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("extensions.BabylonToolbar.admin", false);
Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar.babExt", "");
Deleted : user_pref("extensions.BabylonToolbar.babTrack", "affID=111378");
Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 2);
Deleted : user_pref("extensions.BabylonToolbar.dfltSrch", false);
Deleted : user_pref("extensions.BabylonToolbar.hmpg", false);
Deleted : user_pref("extensions.BabylonToolbar.id", "40517db30000000000000040d0a474c6");
Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15431");
Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar.lastDP", 2);
Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.170:23:02");
Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "11.0");
Deleted : user_pref("extensions.BabylonToolbar.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Deleted : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 71909082);
Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 1);
Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 1);
Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.170:23:02");
Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");
Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111378");
Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "40517db30000000000000040d0a474c6");
Deleted : user_pref("extensions.BabylonToolbar_i.id", "40517db30000000000000040d0a474c6");
Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15431");
Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=111378&babsrc=N[...]
Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.170:23:02");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.babylon.com/?affID=111378&babsr[...]
Deleted : user_pref("extensions.nurit5562nurit235.scode", "(function(){try{for(i=0;i<5;i++){window.setTimeout([...]

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Hilde\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted : {"bookmark_bar":{"show_on_all_tabs":true},"browser":{"check_default_browser":false,"ntp":{"promo_ima[...]

*************************

AdwCleaner[R1].txt - [12084 octets] - [31/07/2012 17:50:25]
AdwCleaner[S1].txt - [12473 octets] - [31/07/2012 19:33:04]

########## EOF - C:\AdwCleaner[S1].txt - [12602 octets] ##########
         

Zweimal:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 31.07.2012 19:43:48

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	31.07.2012 19:45:37


Gescannt	601315
Gefunden	0

Scan Ende:	31.07.2012 20:53:40
Scan Zeit:	1:08:03
         

Da scheinst du ganze Arbeit geleistet zu haben! Nichts mehr da !

Muss ich noch etwas machen?

Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.