virus: gvu-trojaner 2.07

john_b · 30.07.2012, 14:53

Hallo ihr Helfer,
bei mir auf dem Computer(Windows Vista) ist der GVU-Trojaner in der Version 2.07 aufgetreten. Die Version habe ich durch einen Bildvergleich herausgefunden. Nach Anweisungen im diesem Forum habe ich einen Scan mit OTL durchlaufen lassen und ich sind die Ergebisse:

Aus der OTL.txt:

Code:

ATTFilter

OTL logfile created on: 30.07.2012 15:28:55 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Leon\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 79,52% Memory free
4,23 Gb Paging File | 4,00 Gb Available in Paging File | 94,61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221,19 Gb Total Space | 39,84 Gb Free Space | 18,01% Space Free | Partition Type: NTFS
Drive D: | 11,70 Gb Total Space | 2,17 Gb Free Space | 18,56% Space Free | Partition Type: NTFS
Drive F: | 3,84 Gb Total Space | 3,84 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: LEON-PC | User Name: Leon | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Leon\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Adobe\Reader 8.0\Reader\ViewerPS.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (STSService) -- C:\Program Files\SoundTaxi Media Suite\STSService.exe File not found
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Sony Ericsson PCCompanion) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Boonty Games) -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (BOONTY)
SRV - (IAANTMON) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Automatic LiveUpdate Scheduler) -- c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate) -- c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (Com4Qlb) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe (Hewlett-Packard Development Company, L.P.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (XDva327) -- C:\Windows\system32\XDva327.sys File not found
DRV - (XDva326) -- C:\Windows\system32\XDva326.sys File not found
DRV - (XDva323) -- C:\Windows\system32\XDva323.sys File not found
DRV - (XDva321) -- C:\Windows\system32\XDva321.sys File not found
DRV - (vsdatant7) -- System32\drivers\vsdatant.win7.sys File not found
DRV - (SymIMMP) -- system32\DRIVERS\SymIM.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (SndTAudio) -- C:\Windows\System32\drivers\SndTAudio.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (s3117obex) -- C:\Windows\System32\drivers\s3117obex.sys (MCCI Corporation)
DRV - (s3117mdfl) -- C:\Windows\System32\drivers\s3117mdfl.sys (MCCI Corporation)
DRV - (s3117mdm) -- C:\Windows\System32\drivers\s3117mdm.sys (MCCI Corporation)
DRV - (s3117unic) -- C:\Windows\System32\drivers\s3117unic.sys (MCCI Corporation)
DRV - (s3117mgmt) -- C:\Windows\System32\drivers\s3117mgmt.sys (MCCI Corporation)
DRV - (s3117nd5) -- C:\Windows\System32\drivers\s3117nd5.sys (MCCI Corporation)
DRV - (s3117bus) -- C:\Windows\System32\drivers\s3117bus.sys (MCCI Corporation)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - ({22D78859-9CE9-4B77-BF18-AC83E81A9263}) -- C:\Program Files\Hp\QuickPlay\000.fcl (Cyberlink Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (HpqRemHid) -- C:\Windows\System32\drivers\HpqRemHid.sys (Hewlett-Packard Development Company, L.P.)
DRV - (NETw4v32) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (PVUSB) -- C:\Windows\System32\drivers\CESG502.sys (Hitachi Semiconductor and Devices Sales Co.,Ltd.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (sfvfs02) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology (StarForce))
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (sfdrv01) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (sfhlp02) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Pavilion&pf=laptop
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKLM\..\SearchScopes\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\SearchScopes,DefaultScope = {66462A9D-B84E-49CD-8446-0D7035B87A34}
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=PV&apn_dtid=YYYYYYYYDE&apn_uid=1CF52209-0032-44F1-928D-BC52143EC9E8&apn_sauid=4C168B62-7B6F-4D1A-BAE7-AF7E865DA6DB
IE - HKCU\..\SearchScopes\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{66462A9D-B84E-49CD-8446-0D7035B87A34}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKCU\..\SearchScopes\{892C1B9F-BBB6-4441-AE0E-9F4EC4225442}: "URL" = hxxp://www.google.de/search?hl=de&q={searchTerms}&btnG=Suche&meta=
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKCU\..\SearchScopes\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKCU\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q={searchTerms}&crm=1
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKCU\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@virtools.com/3DviaPlayer: C:\Program Files\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 16:51:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.05 21:52:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 16:51:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.05 21:52:15 | 000,000,000 | ---D | M]
 
[2009.12.12 13:49:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leon\AppData\Roaming\mozilla\Extensions
[2012.07.28 14:45:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions
[2012.03.29 14:49:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.07.17 17:52:19 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2010.06.16 21:34:47 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.31 01:51:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.06.18 22:22:30 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010.11.20 17:20:53 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\battlefieldheroespatcher@ea.com
[2011.02.10 19:18:48 | 000,000,000 | ---D | M] (FIFA Online Web Launcher) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\eafo3fflauncher@ea.com
[2011.05.12 17:57:35 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com
[2012.07.28 14:45:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\staged
[2010.02.22 16:33:30 | 000,000,000 | ---D | M] (Vodafone DRM Plugin for Firefox) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\vodafone_drm_plugin@vodafone.com
[2011.07.11 16:39:21 | 000,002,396 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\askcom.xml
[2010.09.10 17:47:35 | 000,001,828 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\bing.xml
[2010.12.15 17:12:32 | 000,000,923 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\conduit.xml
[2012.07.28 14:43:28 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-1.xml
[2010.12.13 16:06:38 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-10.xml
[2011.03.02 21:43:16 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-11.xml
[2011.03.06 21:01:05 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-12.xml
[2011.03.25 17:00:12 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-13.xml
[2011.04.30 18:22:08 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-14.xml
[2011.06.13 13:46:14 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-15.xml
[2011.06.22 21:02:03 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-16.xml
[2011.06.27 15:01:39 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-17.xml
[2011.09.02 20:50:34 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-18.xml
[2011.09.07 20:49:34 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-19.xml
[2010.06.11 21:13:20 | 000,000,961 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-2.xml
[2011.10.04 20:09:43 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-20.xml
[2011.10.06 19:21:09 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-21.xml
[2011.11.11 18:01:14 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-22.xml
[2012.01.09 22:34:24 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-23.xml
[2012.02.06 22:03:24 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-24.xml
[2012.02.13 15:09:39 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-25.xml
[2012.02.20 15:40:49 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-26.xml
[2012.03.19 15:21:06 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-27.xml
[2012.04.27 17:01:07 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-28.xml
[2012.06.20 22:52:40 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-29.xml
[2010.08.05 17:33:47 | 000,000,961 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-3.xml
[2012.07.19 16:52:04 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-30.xml
[2010.08.22 19:11:22 | 000,000,961 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-4.xml
[2010.09.18 23:53:21 | 000,000,961 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-5.xml
[2010.10.03 13:40:57 | 000,000,961 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-6.xml
[2010.10.23 20:55:47 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-7.xml
[2010.10.29 14:14:00 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-8.xml
[2010.11.03 15:39:53 | 000,000,950 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin-9.xml
[2012.03.19 20:09:28 | 000,000,168 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin.gif
[2012.03.19 20:09:28 | 000,000,618 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\icqplugin.xml
[2012.04.27 17:00:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.01.22 15:42:23 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.07.19 16:51:47 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.19 18:35:40 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.20 22:51:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.20 22:51:30 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.20 22:51:30 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.20 22:51:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.20 22:51:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.20 22:51:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ICQ Sparberater) - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Program Files\icq\Internet Explorer\icq.dll (solute gmbh)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [FTweakFCleaner] C:\Program Files\FCleaner\FCleaner.exe (FTweak)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background File not found
O4 - HKCU..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun File not found
O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 2010\UIWatcher.exe File not found
O4 - HKCU..\Run: [Vidalia] C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube Download - C:\Users\Leon\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Leon\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.31.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} hxxp://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe (Virtools WebPlayer Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 87.245.0.34 87.245.0.35
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7647D8CE-F003-41F6-AED2-D21D792DB77D}: DhcpNameServer = 192.168.178.1 87.245.0.34 87.245.0.35
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Leon\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Leon\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005.09.11 17:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O33 - MountPoints2\{838b190c-0d8e-11df-87b1-001e68309a4c}\Shell\AutoRun\command - "" = F:\.\atze_player.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.30 15:26:47 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Leon\Desktop\OTL.exe
[2012.07.13 11:45:45 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.13 11:38:56 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.07.13 11:38:53 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.07.13 11:38:53 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.07.13 11:38:52 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.07.13 11:38:51 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.07.13 11:38:51 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.07.13 11:38:50 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.07.11 17:19:53 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.05 21:51:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.07.05 21:51:35 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2012.07.04 14:36:18 | 000,000,000 | ---D | C] -- C:\Users\Leon\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2012.07.04 14:35:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag
[2012.07.04 14:35:37 | 000,000,000 | ---D | C] -- C:\Program Files\Wendel-Verlag
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.30 15:27:08 | 000,637,984 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.30 15:27:08 | 000,603,936 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.30 15:27:08 | 000,130,306 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.30 15:27:08 | 000,107,372 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.30 15:17:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.30 15:15:25 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.30 15:15:25 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.30 15:13:50 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Leon\Desktop\OTL.exe
[2012.07.30 15:12:00 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{31C74AA4-1D5E-4047-99E0-8F74DABB2563}.job
[2012.07.30 15:10:54 | 004,503,728 | ---- | M] () -- C:\ProgramData\zak_lo0i7g.pad
[2012.07.30 14:54:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.30 14:33:22 | 000,000,680 | ---- | M] () -- C:\Users\Leon\AppData\Local\d3d9caps.dat
[2012.07.30 14:30:38 | 000,143,624 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.07.30 14:30:38 | 000,143,624 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.07.30 14:30:09 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.28 15:16:15 | 000,001,722 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.26 22:53:45 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 1).job
[2012.07.26 13:32:00 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 4).job
[2012.07.25 20:00:38 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012.07.24 13:15:00 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.07.24 13:15:00 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.07.17 20:39:00 | 000,699,329 | ---- | M] () -- C:\Users\Leon\Desktop\Erfolgsfaktor Duales Studium.pdf
[2012.07.16 12:44:33 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2012.07.14 18:14:21 | 000,385,304 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.05 22:19:26 | 000,205,824 | ---- | M] () -- C:\Users\Leon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.05 21:51:55 | 000,001,686 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.07.04 14:35:40 | 000,000,948 | ---- | M] () -- C:\Users\Public\Desktop\Fragen-Lern-CD 4.1.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.28 15:16:15 | 000,001,722 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.28 15:16:14 | 004,503,728 | ---- | C] () -- C:\ProgramData\zak_lo0i7g.pad
[2012.07.17 20:39:00 | 000,699,329 | ---- | C] () -- C:\Users\Leon\Desktop\Erfolgsfaktor Duales Studium.pdf
[2012.07.05 21:51:55 | 000,001,686 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.07.04 14:35:40 | 000,000,948 | ---- | C] () -- C:\Users\Public\Desktop\Fragen-Lern-CD 4.1.lnk
[2012.01.28 16:56:34 | 000,000,004 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\steam_md4.dat
[2011.02.17 16:14:10 | 000,000,054 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.02.17 16:14:10 | 000,000,039 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.02.10 19:21:25 | 000,794,408 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2011.02.01 22:23:33 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2011.02.01 22:23:33 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll
[2011.02.01 22:23:33 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll
[2010.11.19 21:26:38 | 000,139,152 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\PnkBstrK.sys
[2010.11.19 21:26:38 | 000,138,968 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.11.19 21:26:22 | 000,214,592 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2010.11.19 21:26:19 | 002,427,248 | ---- | C] () -- C:\Windows\System32\pbsvc_heroes.exe
[2010.11.19 21:26:19 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2010.09.07 20:20:50 | 000,017,408 | ---- | C] () -- C:\Users\Leon\AppData\Local\WebpageIcons.db
[2010.05.23 19:48:36 | 000,000,104 | ---- | C] () -- C:\Users\Leon\Netzwerk - Verknüpfung.lnk
[2009.12.06 19:09:17 | 000,143,624 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.06 19:09:14 | 000,143,624 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.09.24 15:40:20 | 000,000,329 | ---- | C] () -- C:\Users\Leon\Admin - Verknüpfung.lnk
[2009.03.28 20:20:33 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2008.11.16 14:33:28 | 000,000,680 | ---- | C] () -- C:\Users\Leon\AppData\Local\d3d9caps.dat
[2008.10.26 21:42:30 | 000,205,824 | ---- | C] () -- C:\Users\Leon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.07.02 20:38:30 | 000,000,092 | ---- | C] () -- C:\Users\Leon\AppData\Local\fusioncache.dat
[2008.06.30 11:30:32 | 000,041,192 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\nvModes.001
[2008.06.29 23:21:59 | 000,041,192 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\nvModes.dat
[2008.06.29 18:17:14 | 000,000,680 | RHS- | C] () -- C:\Users\Leon\ntuser.pol
 
========== LOP Check ==========
 
[2009.10.02 18:23:08 | 000,000,000 | -HSD | M] -- C:\Users\Leon\AppData\Roaming\.#
[2012.01.13 16:54:47 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\.minecraft
[2011.01.27 21:23:41 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Amazon
[2011.01.28 19:06:39 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Ashampoo
[2012.06.14 15:31:05 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Audacity
[2008.12.25 19:24:57 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Canon
[2012.01.19 18:18:42 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011.02.01 22:26:52 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\concept design
[2012.01.27 15:54:03 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\DAEMON Tools Lite
[2012.07.04 14:36:18 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2008.11.14 19:30:29 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\DesktopPlayer
[2011.08.18 20:27:32 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\DVDVideoSoft
[2011.03.30 21:01:58 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.06.26 15:04:39 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\FTWeak
[2011.03.12 19:07:12 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\GrabPro
[2012.06.18 19:25:53 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\ICQ
[2010.04.05 18:54:10 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Leadertech
[2009.05.04 21:15:42 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\LEGO Company
[2010.12.14 15:39:52 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Merscom
[2010.07.12 20:14:01 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Mp3tag
[2010.09.10 18:45:38 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Need for Speed World
[2011.12.01 16:26:22 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Nik Software
[2011.07.11 17:16:53 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Orbit
[2011.07.11 17:15:37 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\PhotoLine
[2009.07.27 14:40:36 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\PlayFirst
[2011.03.11 19:12:02 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\ProgSense
[2011.09.20 21:23:03 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\pymclevel
[2010.09.07 21:34:36 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Similarity
[2010.06.09 17:37:52 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\smc
[2009.05.30 19:39:41 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Sony
[2009.06.12 19:55:42 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Spore
[2012.01.29 18:01:07 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\streamWriter
[2012.04.19 17:03:39 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\temp
[2009.12.21 16:06:47 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Xilisoft Corporation
[2012.07.26 22:53:45 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 1).job
[2012.07.16 12:44:33 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 2).job
[2011.07.31 13:32:36 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 3).job
[2012.07.26 13:32:00 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 4).job
[2012.07.25 20:00:38 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2012.07.30 15:15:13 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.30 15:12:00 | 000,000,428 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{31C74AA4-1D5E-4047-99E0-8F74DABB2563}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 48 bytes -> C:\Windows:04A35E1587C26DCB

< End of report >

------------------------------

Aus der Extras.txt:

Code:

ATTFilter

OTL Extras logfile created on: 30.07.2012 15:28:55 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Leon\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 79,52% Memory free
4,23 Gb Paging File | 4,00 Gb Available in Paging File | 94,61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221,19 Gb Total Space | 39,84 Gb Free Space | 18,01% Space Free | Partition Type: NTFS
Drive D: | 11,70 Gb Total Space | 2,17 Gb Free Space | 18,56% Space Free | Partition Type: NTFS
Drive F: | 3,84 Gb Total Space | 3,84 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: LEON-PC | User Name: Leon | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{30D1E1B9-436B-45B3-8C81-DFE25D6ACC49}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{613F1883-B0F7-4734-A2AE-0F4BC989EE3F}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E24C4C7E-802E-47FC-B00A-DB136BB76B03}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{012BF7DC-5084-4BE6-A208-060B1DC1989E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{061ED3F3-EBAF-4D5F-9AF4-14460947E30D}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{092F9E1A-8436-4FA2-A681-EC5E65FF5691}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{0D828D62-4489-41D5-B694-B85A85FF4BB9}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 
"{125962B0-34BD-41B2-BA8A-34D197DC9831}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 
"{1420372B-7055-469C-BF7A-AD3E7E0C3849}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 
"{1C4801DA-9563-4929-8D52-155C05AA6298}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe | 
"{22D5055E-89FB-4E88-9D6B-29B114759457}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{28A343E5-D8D0-4605-AADD-EA49E70CB63F}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe | 
"{2C99B7A8-04EB-4F95-9E4C-FDFB697E309A}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\server\clipinc-server.exe | 
"{2E420A20-64A0-4A52-B061-164F76867307}" = protocol=17 | dir=in | app=c:\program files\phenomedia\moorhuhn kart 3 demo\game\moorhuhn_kart3.exe | 
"{2FA6C2A0-4C74-4066-BFD8-337682F3BAA6}" = protocol=6 | dir=in | app=c:\program files\phenomedia\moorhuhn kart 3 demo\game\moorhuhn_kart3.exe | 
"{33D51F77-7241-4CB0-9380-7116DE50D445}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 
"{33F1CB2C-CE6D-4462-9DA3-B02E508A68D7}" = protocol=17 | dir=in | app=c:\program files\sony ericsson\sony ericsson media manager\mediamanager.exe | 
"{3CC39D66-1640-4771-8B60-A16D567D8870}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\server\clipinc-server.exe | 
"{41B9DBBE-F241-4682-BF4E-115E31C28F32}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{538C4557-9446-40E3-9A4F-8AB2C3531BB0}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{84F7B216-7927-44BB-B37E-50A88B003998}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{86E1BB50-8C1F-4B1E-9914-C87D47D73093}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{96F43E44-653A-487A-BCE9-E04350BBF9B0}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{980160E9-5C91-4F3F-849F-C9FA52A9F17D}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{99352EB5-86B9-48F9-B95C-0285D59456F6}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{AA648D38-045B-4AD6-B93C-48B960BF6B96}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{B1539918-AEBC-42D5-953D-5133A222E40C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{B3A76C0C-4F68-4D3E-A72F-B2ACA8BCB8E1}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe | 
"{BE05848C-952C-4210-B162-899C15936F0D}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{C1222D7D-6D98-475B-9991-2965E4C66CDB}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{C67A0EEA-E28F-45D7-9EE0-33CF1190DBF7}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{C883F146-0CDA-47DA-B9B4-25D29C1D4409}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe | 
"{CBF68E46-1F9A-4A9C-83A8-18C80540A00C}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{D1B45366-DEE0-4829-8849-F960268661CE}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{D29C069D-436D-4CAF-BDF3-7C7919F2BD6D}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{D69B0C16-62D4-433E-893C-6D12AD43C3C2}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{D6AFE1FC-6A63-4F20-97D9-22A49B074950}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{D8A67397-D0A4-4356-B230-44CE172F2004}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{DB2C447D-6717-4C77-9FD5-04C913CEE6C6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{E603ECAC-4B3D-469F-B9CD-103A56C0BCF9}" = protocol=6 | dir=in | app=c:\program files\sony ericsson\sony ericsson media manager\mediamanager.exe | 
"{E65B240E-3282-4EBF-8A7A-4AB8628E901A}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 
"{E908CE21-6C09-47AA-8757-26FE51D48B46}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{EA122D67-C5B2-43DF-882F-1DDC7C000757}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"TCP Query User{02A7694B-DF60-4427-9036-83F3D562FFA7}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{09AA1246-845C-4E8D-8DA5-385A385162CD}C:\users\leon\desktop\games\mw2\iw4mp.dat" = protocol=6 | dir=in | app=c:\users\leon\desktop\games\mw2\iw4mp.dat | 
"TCP Query User{10691CE5-56C0-497B-8C14-60ADF41A4773}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"TCP Query User{1367E3A2-B212-41DF-B712-3BB52396F7B2}G:\luca\spiele\trackmania nations eswc\tmnationseswc.exe" = protocol=6 | dir=in | app=g:\luca\spiele\trackmania nations eswc\tmnationseswc.exe | 
"TCP Query User{207817FA-FAF7-46A3-8E09-D3FE9DC518F0}C:\program files\ea sports\fifa online\nfe.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa online\nfe.exe | 
"TCP Query User{2FD4585A-3686-4530-964D-29328B54CEDE}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{39237B3E-005A-45FB-8F66-D39B57B824CE}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"TCP Query User{3A7C751D-D799-47C2-A278-DC4551165984}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{41989B6B-1184-4651-8E3E-16D88DCDE008}C:\program files\1c company\13th century - death or glory\engine.exe" = protocol=6 | dir=in | app=c:\program files\1c company\13th century - death or glory\engine.exe | 
"TCP Query User{421B1E02-D23E-476F-A3D2-B46B6F3CCCB1}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{4673F6B7-56F4-4467-B40F-D5D3C713E69C}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"TCP Query User{6A923721-9754-44B2-82D3-BBD6C7EA93F2}C:\users\leon\desktop\games\mw2\iw4mp.exe" = protocol=6 | dir=in | app=c:\users\leon\desktop\games\mw2\iw4mp.exe | 
"TCP Query User{6B300062-E68A-4A17-A1D7-6815C37DFCA3}C:\program files\icq7.4\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"TCP Query User{6F70A659-546F-4DC9-8A28-5BDFC8176E15}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"TCP Query User{7FC6A49C-B944-4C55-9CC3-E45989BF29A5}C:\program files\ea games\die schlacht um mittelerde(tm)\patchget.dat" = protocol=6 | dir=in | app=c:\program files\ea games\die schlacht um mittelerde(tm)\patchget.dat | 
"TCP Query User{97BC7ACE-7B54-4AFA-B1DA-D65DEDD217C1}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{A871EA3B-C77C-4BEB-B9A5-2720B9F7DB7A}G:\luca\filme luca\left 4 dead\123boxl4dxers\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=g:\luca\filme luca\left 4 dead\123boxl4dxers\left 4 dead\left4dead.exe | 
"TCP Query User{AC7CADFA-5AC9-4939-BC90-0A50ECB0B985}C:\program files\trackmania nations eswc\tmnationseswc.exe" = protocol=6 | dir=in | app=c:\program files\trackmania nations eswc\tmnationseswc.exe | 
"TCP Query User{B1547034-3497-4C37-928D-BF690AE3EC2A}C:\games\paintball2\paintball2.exe" = protocol=6 | dir=in | app=c:\games\paintball2\paintball2.exe | 
"TCP Query User{BD1920AF-7DF5-4AF8-ABEF-59C2E31AFB9A}C:\users\leon\desktop\minigames\achtungkurve\netacka31-win\netacka.exe" = protocol=6 | dir=in | app=c:\users\leon\desktop\minigames\achtungkurve\netacka31-win\netacka.exe | 
"TCP Query User{C433A7AC-F539-424B-B101-0FA9407617AE}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{C7CF8376-C27D-4D88-AACA-0478F910B6F7}C:\program files\bluej\bluej.exe" = protocol=6 | dir=in | app=c:\program files\bluej\bluej.exe | 
"TCP Query User{D247C986-11BA-4037-89FF-0232A8AF85ED}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{D4B53A9B-4ACB-4E28-A8AA-5B2D2939D64C}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=6 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe | 
"TCP Query User{F2FD6B12-1F8C-43C2-AF27-661299EB80AD}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{F78F8E17-341B-46CC-9C9B-1CFCB56F5BD0}C:\program files\firefly studios\stronghold crusader\stronghold crusader.exe" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold crusader\stronghold crusader.exe | 
"UDP Query User{26E3043C-8A59-4C2C-9A9F-8C391594D794}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{31FADC89-6021-497F-BB11-80182BEC2874}C:\program files\ea games\die schlacht um mittelerde(tm)\patchget.dat" = protocol=17 | dir=in | app=c:\program files\ea games\die schlacht um mittelerde(tm)\patchget.dat | 
"UDP Query User{3DFC9553-BAA5-490F-87DA-78DBD73D4197}C:\program files\icq7.4\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"UDP Query User{423A7729-9E11-45B8-A10D-83082A3ED0AA}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=17 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe | 
"UDP Query User{45183DAE-6AF9-4A8E-8F7D-0AF57FF45C2F}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{494AEA54-F938-4060-887E-A75E0FF95970}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{5E44C2FC-A701-41FC-B25E-902A88A7980A}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"UDP Query User{60CA7733-BFDD-4F87-B32F-823C068971DA}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{671012BA-2D51-4184-9267-658629EE71BC}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"UDP Query User{68596042-054F-413A-9217-DA32F1E8D68D}C:\program files\trackmania nations eswc\tmnationseswc.exe" = protocol=17 | dir=in | app=c:\program files\trackmania nations eswc\tmnationseswc.exe | 
"UDP Query User{85BA98A4-43C2-446D-B24C-73ED06BB6B34}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{8D9FDECA-3E9C-49EA-8FA8-54544E4F4F62}C:\users\leon\desktop\games\mw2\iw4mp.exe" = protocol=17 | dir=in | app=c:\users\leon\desktop\games\mw2\iw4mp.exe | 
"UDP Query User{99DE7695-C6AF-4CF5-9652-96BFEB937BD7}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{A52E41A8-D267-41BE-8E1D-DE17E347D8B8}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{AA42231E-8E4E-4EBA-BC13-0257D64C4281}C:\program files\ea sports\fifa online\nfe.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa online\nfe.exe | 
"UDP Query User{B42102A7-E4B4-4B56-BCE0-A108689CE901}C:\program files\firefly studios\stronghold crusader\stronghold crusader.exe" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold crusader\stronghold crusader.exe | 
"UDP Query User{C8C26AEB-EB93-48EC-B4F5-7CB4CC36A167}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{CFF15495-24B3-49C7-9AFF-F7B1A921E9B3}C:\program files\bluej\bluej.exe" = protocol=17 | dir=in | app=c:\program files\bluej\bluej.exe | 
"UDP Query User{D8FB32B2-3782-40FF-99A9-CE43EC4C0D3A}C:\users\leon\desktop\games\mw2\iw4mp.dat" = protocol=17 | dir=in | app=c:\users\leon\desktop\games\mw2\iw4mp.dat | 
"UDP Query User{D9248947-364F-4356-BB99-994B3669D250}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{D9BD969F-C607-4758-9F01-DF53245E9D35}C:\users\leon\desktop\minigames\achtungkurve\netacka31-win\netacka.exe" = protocol=17 | dir=in | app=c:\users\leon\desktop\minigames\achtungkurve\netacka31-win\netacka.exe | 
"UDP Query User{E2C458E4-4A42-4D47-9F0A-FF4E11E649B0}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"UDP Query User{E4B65356-414E-45A4-AF2A-4E406686C7D7}G:\luca\filme luca\left 4 dead\123boxl4dxers\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=g:\luca\filme luca\left 4 dead\123boxl4dxers\left 4 dead\left4dead.exe | 
"UDP Query User{E75DC1E9-8B27-463A-9804-9A06BB02DF2D}C:\program files\1c company\13th century - death or glory\engine.exe" = protocol=17 | dir=in | app=c:\program files\1c company\13th century - death or glory\engine.exe | 
"UDP Query User{EB0E50A1-185B-4150-98E7-4A07ABE1988C}G:\luca\spiele\trackmania nations eswc\tmnationseswc.exe" = protocol=17 | dir=in | app=g:\luca\spiele\trackmania nations eswc\tmnationseswc.exe | 
"UDP Query User{FC9774BC-7ECA-4105-8162-AEFA967C5F5C}C:\games\paintball2\paintball2.exe" = protocol=17 | dir=in | app=c:\games\paintball2\paintball2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series" = Canon MP540 series MP Drivers
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{31216452-5540-4C96-B754-94890A63D5AB}" = HP Help and Support
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32A3A4F4-B792-11D6-A78A-00B0D0160310}" = Java(TM) SE Development Kit 6 Update 31
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D356AA9-2D0C-4373-A762-B42F1A289233}" = MSCU for Microsoft Vista
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3EE2F527-F306-49E9-0086-662C337ADD3B}" = FUSSBALL MANAGER 07
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D49757C-367A-4333-BDB3-68966162B14E}" = HP User Guides 0087
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 5.0
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{65AA10FF-6F32-48AE-881F-FC96E7BF3A5E}" = ESU for Microsoft Vista
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73EC658D-A1C6-40CA-8E86-E05821BAACE7}" = Java DB 10.6.2.1
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7CDA2B02-E0A4-4EB5-8533-050D535BA43A}" = Media Converter for Philips
"{7D66971C-652B-4065-A6B1-B3EE313C254B}" = BlueJ
"{7DC4A410-9986-4329-9E5D-687B2C42CA39}" = HP QuickTouch 1.00 C4
"{7E910FDA-CBBE-4451-8728-235E6A4DE162}" = Sony Ericsson Media Manager 1.1
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant
"{97C769CF-6562-43ED-BD1F-7E19DF32EE0B}" = N
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0D888F5-B8E9-D6BC-6309-35671E22649F}" = Fragen-Lern-CD 4.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A83000000003}" = Adobe Reader 8.3.1 - Deutsch
"{b02df929-29a7-4fd2-9a70-81a644b635f7}" = HP Total Care Advisor
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BD0E2B92-3814-46F0-893B-4612EA010C7E}" = HP Customer Experience Enhancements
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
"{CC13FB47-0B90-46C3-9BB7-57D2DB455D4D}" = Microsoft Xbox 360 Accessories 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EC87E256-B0A4-4A41-8682-AB57FF21196D}" = SweetIM for Messenger 2.7
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.01.231
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{FB47E710-6249-4EFA-BE36-E922B0612AF4}" = CASIO FA-124
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FE163F11-1919-4257-A280-FF5AF8DAEECB}" = ICQ Sparberater
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon MP540 series Benutzerregistrierung" = Canon MP540 series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Color Efex Pro 3.0 Stand-Alone Standard" = Color Efex Pro 3.0 Standard
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"DAEMON Tools Lite" = DAEMON Tools Lite
"de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1" = Fragen-Lern-CD 4.1
"EADM" = EA Download Manager
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FCleaner_is1" = FCleaner 1.2.0.615
"FormatFactory" = FormatFactory 2.70
"Free Audio Dub_is1" = Free Audio Dub version 1.5
"Free Studio_is1" = Free Studio version 4.8
"Free Video Dub_is1" = Free Video Dub version 1.8.12.602
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.8.815
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
"ICQToolbar" = ICQ Toolbar
"Icy Tower v1.4_is1" = Icy Tower v1.4
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"Mp3tag" = Mp3tag v2.46a
"NVIDIA Drivers" = NVIDIA Drivers
"Open Codecs" = Xiph.Org Open Codecs 0.84.17315
"OpenAL" = OpenAL
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"PunkBusterSvc" = PunkBuster Services
"SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.4
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SopCast" = SopCast 3.2.9
"streamWriter_is1" = streamWriter
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.9
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 27.07.2012 11:19:35 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4251433
 
Error - 27.07.2012 11:19:35 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4251433
 
Error - 27.07.2012 11:19:36 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 27.07.2012 11:19:36 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4252478
 
Error - 27.07.2012 11:19:36 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4252478
 
Error - 27.07.2012 11:19:37 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 27.07.2012 11:19:37 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4253523
 
Error - 27.07.2012 11:19:37 | Computer Name = Leon-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4253523
 
Error - 30.07.2012 08:32:23 | Computer Name = Leon-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16447, Zeitstempel
 0x4fc9cd53, fehlerhaftes Modul USER32.dll, Version 6.0.6002.18541, Zeitstempel 
0x4ec3e3d5, Ausnahmecode 0xc0000142, Fehleroffset 0x00009f5d,  Prozess-ID 0x17a8, 
Anwendungsstartzeit 01cd6e4f5cc5e020.
 
Error - 30.07.2012 09:17:26 | Computer Name = Leon-PC | Source = EventSystem | ID = 4609
Description = 
 
[ OSession Events ]
Error - 25.02.2012 13:04:08 | Computer Name = Leon-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13864
 seconds with 3180 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:18:29 | Computer Name = Leon-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 30.07.2012 09:37:45 | Computer Name = Leon-PC | Source = DCOM | ID = 10005
Description = 
 
 
< End of report >

------

Das waren die Codes. Vielen Dank für eure Hilfe!!!

t'john · 30.07.2012, 16:00

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

ATTFilter

:OTL
SRV - (STSService) -- C:\Program Files\SoundTaxi Media Suite\STSService.exe File not found 
DRV - (XDva327) -- C:\Windows\system32\XDva327.sys File not found 
DRV - (XDva326) -- C:\Windows\system32\XDva326.sys File not found 
DRV - (XDva323) -- C:\Windows\system32\XDva323.sys File not found 
DRV - (XDva321) -- C:\Windows\system32\XDva321.sys File not found 
DRV - (vsdatant7) -- System32\drivers\vsdatant.win7.sys File not found 
DRV - (SymIMMP) -- system32\DRIVERS\SymIM.sys File not found 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found 
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found 
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found 
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found 
IE - HKLM\..\URLSearchHook: - No CLSID value found 
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKLM\..\SearchScopes\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}: "URL" = http://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 
IE - HKLM\..\SearchScopes\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de 
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 
IE - HKCU\..\URLSearchHook: - No CLSID value found 
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) 
IE - HKCU\..\SearchScopes,DefaultScope = {66462A9D-B84E-49CD-8446-0D7035B87A34} 
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=PV&apn_dtid=YYYYYYYYDE&apn_uid=1CF52209-0032-44F1-928D-BC52143EC9E8&apn_sauid=4C168B62-7B6F-4D1A-BAE7-AF7E865DA6DB 
IE - HKCU\..\SearchScopes\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}: "URL" = http://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933 
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKCU\..\SearchScopes\{66462A9D-B84E-49CD-8446-0D7035B87A34}: "URL" = http://de.search.yahoo.com/search?p={searchTerms} 
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de 
IE - HKCU\..\SearchScopes\{892C1B9F-BBB6-4441-AE0E-9F4EC4225442}: "URL" = http://www.google.de/search?hl=de&q={searchTerms}&btnG=Suche&meta= 
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 
IE - HKCU\..\SearchScopes\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de 
IE - HKCU\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q={searchTerms}&crm=1 
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms} 
IE - HKCU\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q=" 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found 
[2012.03.29 14:49:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} 
[2012.07.17 17:52:19 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} 
[2010.06.16 21:34:47 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} 
[2011.05.12 17:57:35 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com 
[2010.02.22 16:33:30 | 000,000,000 | ---D | M] (Vodafone DRM Plugin for Firefox) -- C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\vodafone_drm_plugin@vodafone.com 
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) 
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. 
O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" File not found 
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found 
O4 - HKCU..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background File not found 
O4 - HKCU..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun File not found 
O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson) 
O4 - HKCU..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 2010\UIWatcher.exe File not found 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.) 
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) 
O24 - Desktop WallPaper: C:\Users\Leon\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg 
O24 - Desktop BackupWallPaper: C:\Users\Leon\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O32 - AutoRun File - [2005.09.11 17:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ] 
O33 - MountPoints2\{838b190c-0d8e-11df-87b1-001e68309a4c}\Shell\AutoRun\command - "" = F:\.\atze_player.exe 


[2012.07.30 15:10:54 | 004,503,728 | ---- | M] () -- C:\ProgramData\zak_lo0i7g.pad 
[2012.07.30 14:30:38 | 000,143,624 | ---- | M] () -- C:\ProgramData\nvModes.dat 
[2012.07.30 14:30:38 | 000,143,624 | ---- | M] () -- C:\ProgramData\nvModes.001 
[2012.07.28 15:16:15 | 000,001,722 | ---- | M] () -- C:\Users\Leon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 

[2008.06.30 11:30:32 | 000,041,192 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\nvModes.001 
[2008.06.29 23:21:59 | 000,041,192 | ---- | C] () -- C:\Users\Leon\AppData\Roaming\nvModes.dat 


[2012.04.19 17:03:39 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\temp 
@Alternate Data Stream - 48 bytes -> C:\Windows:04A35E1587C26DCB 

[2012.07.30 15:12:00 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{31C74AA4-1D5E-4047-99E0-8F74DABB2563}.job 
[2012.07.30 14:54:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012.07.30 14:30:09 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
[2012.07.26 22:53:45 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 1).job 
[2012.07.26 13:32:00 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 4).job 
[2012.07.25 20:00:38 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job 
[2012.07.16 12:44:33 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 2).job 
[2011.07.31 13:32:36 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 3).job 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

john_b · 30.07.2012, 16:29

Vielen Dank!!

Hier die Meldung des Programmes:

Code:

ATTFilter

All processes killed
========== OTL ==========
Service STSService stopped successfully!
Service STSService deleted successfully!
File C:\Program Files\SoundTaxi Media Suite\STSService.exe File not found not found.
Service XDva327 stopped successfully!
Service XDva327 deleted successfully!
File C:\Windows\system32\XDva327.sys File not found not found.
Service XDva326 stopped successfully!
Service XDva326 deleted successfully!
File C:\Windows\system32\XDva326.sys File not found not found.
Service XDva323 stopped successfully!
Service XDva323 deleted successfully!
File C:\Windows\system32\XDva323.sys File not found not found.
Service XDva321 stopped successfully!
Service XDva321 deleted successfully!
File C:\Windows\system32\XDva321.sys File not found not found.
Service vsdatant7 stopped successfully!
Service vsdatant7 deleted successfully!
File System32\drivers\vsdatant.win7.sys File not found not found.
Service SymIMMP stopped successfully!
Service SymIMMP deleted successfully!
File system32\DRIVERS\SymIM.sys File not found not found.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys File not found not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys File not found not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys File not found not found.
Service blbdrive stopped successfully!
Service blbdrive deleted successfully!
File C:\Windows\system32\drivers\blbdrive.sys File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Program Files\ICQ6Toolbar\ICQToolBar.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
File C:\Program Files\ICQ6Toolbar\ICQToolBar.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53F65F7F-62C5-4906-BCBF-B86AA9BA513D}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{66462A9D-B84E-49CD-8446-0D7035B87A34}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66462A9D-B84E-49CD-8446-0D7035B87A34}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{892C1B9F-BBB6-4441-AE0E-9F4EC4225442}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{892C1B9F-BBB6-4441-AE0E-9F4EC4225442}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B880BBBA-E7C2-4E85-8ABA-AA2D2C643B9D}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF739809-1C6C-47C0-85B9-569DBB141420}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player\ deleted successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully.
Folder move failed. C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome scheduled to be moved on reboot.
Folder move failed. C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} scheduled to be moved on reboot.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\Plugins folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\modules folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\engine@conduit.com folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\vodafone_drm_plugin@vodafone.com\plugins folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\vodafone_drm_plugin@vodafone.com\META-INF folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\vodafone_drm_plugin@vodafone.com\components folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\vodafone_drm_plugin@vodafone.com folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
File move failed. C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll scheduled to be moved on reboot.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Software Informer deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Sony Ericsson PC Companion deleted successfully.
C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\UIWatcher deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616}
C:\Windows\Downloaded Program Files\DivXPlugin.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General\\WallPaper deleted successfully.
C:\Users\Leon\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General\\BackupWallPaper deleted successfully.
File C:\Users\Leon\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
D:\AUTOMODE moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{838b190c-0d8e-11df-87b1-001e68309a4c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{838b190c-0d8e-11df-87b1-001e68309a4c}\ not found.
File F:\.\atze_player.exe not found.
C:\ProgramData\zak_lo0i7g.pad moved successfully.
C:\ProgramData\nvModes.dat moved successfully.
C:\ProgramData\nvModes.001 moved successfully.
C:\Users\Leon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\Users\Leon\AppData\Roaming\nvModes.001 moved successfully.
C:\Users\Leon\AppData\Roaming\nvModes.dat moved successfully.
C:\Users\Leon\AppData\Roaming\temp folder moved successfully.
ADS C:\Windows:04A35E1587C26DCB deleted successfully.
C:\Windows\Tasks\User_Feed_Synchronization-{31C74AA4-1D5E-4047-99E0-8F74DABB2563}.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\Ad-Aware Update (Daily 1).job moved successfully.
C:\Windows\Tasks\Ad-Aware Update (Daily 4).job moved successfully.
C:\Windows\Tasks\Ad-Aware Update (Weekly).job moved successfully.
C:\Windows\Tasks\Ad-Aware Update (Daily 2).job moved successfully.
C:\Windows\Tasks\Ad-Aware Update (Daily 3).job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache konnte nicht geleert werden: Beim Ausfhren der Funktion ist ein Fehler aufgetreten.
C:\Users\Leon\Desktop\cmd.bat deleted successfully.
C:\Users\Leon\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Leon
->Temp folder emptied: 78536997 bytes
->Temporary Internet Files folder emptied: 50325555 bytes
->Java cache emptied: 4662373 bytes
->FireFox cache emptied: 579552511 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 841485 bytes

User: Leon Harre
->Temporary Internet Files folder emptied: 245760 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 22016 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 279440 bytes
Windows Temp folder emptied: 4622972262 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 22417062 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 12875548 bytes
RecycleBin emptied: 1342559537 bytes

Total Files Cleaned = 6.404,00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Leon
->Flash cache emptied: 0 bytes

User: Leon Harre

User: Public

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.55.0 log created on 07302012_170417

Files\Folders moved on Reboot...
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
File move failed. C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll scheduled to be moved on reboot.

PendingFileRenameOperations files...
File C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome not found!
File C:\Users\Leon\AppData\Roaming\mozilla\Firefox\Profiles\oln6rzzp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} not found!
[2011.08.30 21:57:33 | 000,061,888 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll : MD5=897493762A427D94B66A30EE6AB35966

Registry entries deleted on Reboot...

----

Ist damit dann alles erledigt und der Trojaner vollständig entfernt oder muss ich noch etwas tun?

Mfg, john_b

t'john · 30.07.2012, 18:22

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

john_b · 31.07.2012, 21:33

Rechner lauft wieder!

Hier der Log von Malwarebytes:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.31.10

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Leon :: LEON-PC [Administrator]

Schutz: Aktiviert

31.07.2012 18:45:44
mbam-log-2012-07-31 (18-45-44).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 444899
Laufzeit: 1 Stunde(n), 53 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (PUP.MyWebSearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Und hier der Log vom AdwCleaner:

Code:

ATTFilter

# AdwCleaner v1.703 - Logfile created 07/31/2012 at 22:29:16
# Updated 20/07/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Leon - LEON-PC
# Running from : C:\Users\Leon\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Leon\AppData\LocalLow\PriceGong
Folder Found : C:\Users\Leon\AppData\LocalLow\SweetIM
Folder Found : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\Conduit
Folder Found : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\ConduitCommon
Folder Found : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\ConduitEngine
Folder Found : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\extensions\staged
Folder Found : C:\ProgramData\SweetIM
Folder Found : C:\Program Files\AskTBar
File Found : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\Askcom.xml
File Found : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\Conduit.xml
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Found : C:\Program Files\Mozilla FireFox\Components\AskSearch.js

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2475029
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\eRightSoft\OpenCandy

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\prefs.js

Found : user_pref("CT2475029..clientLogIsEnabled", false);
Found : user_pref("CT2475029..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2475029..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2475029.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2475029.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2475029.BrowserCompStateIsOpen_129469746101488132", true);
Found : user_pref("CT2475029.BrowserCompStateIsOpen_129681723868939970", true);
Found : user_pref("CT2475029.CT2481020.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481020.alertChannelId", "874426");
Found : user_pref("CT2475029.CT2481024.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481024.alertChannelId", "874430");
Found : user_pref("CT2475029.CT2481025.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481025.alertChannelId", "874431");
Found : user_pref("CT2475029.CT2481029.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481029.alertChannelId", "874435");
Found : user_pref("CT2475029.CT2481031.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481031.alertChannelId", "874437");
Found : user_pref("CT2475029.CT2481032.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481032.alertChannelId", "874438");
Found : user_pref("CT2475029.CT2481033.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481033.alertChannelId", "874439");
Found : user_pref("CT2475029.CT2481034.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481034.alertChannelId", "874440");
Found : user_pref("CT2475029.CT2481035.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481035.alertChannelId", "874441");
Found : user_pref("CT2475029.CT2481037.CommunityChanged", true);
Found : user_pref("CT2475029.CT2481037.alertChannelId", "874443");
Found : user_pref("CT2475029.CTID", "ct2481020");
Found : user_pref("CT2475029.CommunitiesChangesLastCheckTime", "Sat Jul 28 2012 15:15:57 GMT+0200");
Found : user_pref("CT2475029.CommunitiesChangesLastUrl", "hxxp://grouping.services.conduit.com/GroupingReque[...]
Found : user_pref("CT2475029.CommunityChanged", true);
Found : user_pref("CT2475029.CurrentServerDate", "28-7-2012");
Found : user_pref("CT2475029.DialogsAlignMode", "LTR");
Found : user_pref("CT2475029.DialogsGetterLastCheckTime", "Fri Jul 27 2012 13:50:47 GMT+0200");
Found : user_pref("CT2475029.DownloadDomainsCheckInterval", "168");
Found : user_pref("CT2475029.DownloadDomainsListLastCheckTime", "Wed Jul 25 2012 14:05:10 GMT+0200");
Found : user_pref("CT2475029.DownloadDomainsListLastServerUpdateTime", "1201069983");
Found : user_pref("CT2475029.DownloadReferralCookieData", "");
Found : user_pref("CT2475029.EMailNotifierPollDate", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076849370150342", "Sat Mar 24 2012 11:04:14 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076850042182211", "Sat Mar 24 2012 11:04:14 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076850596400916", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076850791868756", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076852434375419", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076853083906444", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076854010937606", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076855068438037", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076855340312884", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076855597344292", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076855883906472", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076856408281730", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076856723281882", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076856982969262", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076857229219583", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076857478587121", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129076858014837073", "Sat Mar 24 2012 11:04:17 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129132307482029379", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129132307482029381", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129132307482029382", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129133095459686870", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129133095459686871", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129137437659687146", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129137437659687147", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129137437659687148", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214602500", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214602506", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214602512", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214602518", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214602524", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214602530", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603404", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603410", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603416", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603422", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603428", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603434", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603440", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603446", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603452", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603458", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603464", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603470", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603476", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603482", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603488", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214603494", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758786", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758792", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758798", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758804", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758810", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758816", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758822", "Fri Jan 28 2011 18:50:46 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758828", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758834", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758840", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758846", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758852", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758858", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758864", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758870", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758876", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758882", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758888", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758894", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758900", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758906", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758912", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758918", "Fri Jan 28 2011 18:50:47 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758924", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758930", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758936", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758942", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758948", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758954", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedPollDate129255180214758960", "Fri Jan 28 2011 18:50:48 GMT+0100");
Found : user_pref("CT2475029.FeedTTL129076850596400916", 5);
Found : user_pref("CT2475029.FeedTTL129076850791868756", 5);
Found : user_pref("CT2475029.FeedTTL129076855068438037", 2);
Found : user_pref("CT2475029.FeedTTL129076856408281730", 2);
Found : user_pref("CT2475029.FeedTTL129076856723281882", 5);
Found : user_pref("CT2475029.FeedTTL129076857229219583", 30);
Found : user_pref("CT2475029.FeedTTL129076858014837073", 2);
Found : user_pref("CT2475029.FeedTTL129132307482029379", 40);
Found : user_pref("CT2475029.FeedTTL129132307482029381", 40);
Found : user_pref("CT2475029.FeedTTL129132307482029382", 40);
Found : user_pref("CT2475029.FeedTTL129133095459686870", 40);
Found : user_pref("CT2475029.FeedTTL129133095459686871", 40);
Found : user_pref("CT2475029.FeedTTL129137437659687146", 40);
Found : user_pref("CT2475029.FeedTTL129137437659687147", 40);
Found : user_pref("CT2475029.FeedTTL129137437659687148", 40);
Found : user_pref("CT2475029.FeedTTL129255180214602500", 15);
Found : user_pref("CT2475029.FeedTTL129255180214602512", 2);
Found : user_pref("CT2475029.FeedTTL129255180214602518", 5);
Found : user_pref("CT2475029.FeedTTL129255180214602524", 5);
Found : user_pref("CT2475029.FeedTTL129255180214603416", 15);
Found : user_pref("CT2475029.FeedTTL129255180214603428", 60);
Found : user_pref("CT2475029.FeedTTL129255180214603482", 60);
Found : user_pref("CT2475029.FeedTTL129255180214603488", 15);
Found : user_pref("CT2475029.FeedTTL129255180214603494", 2);
Found : user_pref("CT2475029.FeedTTL129255180214758786", 5);
Found : user_pref("CT2475029.FeedTTL129255180214758798", 30);
Found : user_pref("CT2475029.FeedTTL129255180214758804", 30);
Found : user_pref("CT2475029.FeedTTL129255180214758810", 2);
Found : user_pref("CT2475029.FeedTTL129255180214758828", 15);
Found : user_pref("CT2475029.FeedTTL129255180214758840", 15);
Found : user_pref("CT2475029.FeedTTL129255180214758846", 15);
Found : user_pref("CT2475029.FeedTTL129255180214758852", 15);
Found : user_pref("CT2475029.FeedTTL129255180214758870", 1440);
Found : user_pref("CT2475029.FeedTTL129255180214758900", 10);
Found : user_pref("CT2475029.FeedTTL129255180214758918", 5);
Found : user_pref("CT2475029.FirstServerDate", "28-1-2011");
Found : user_pref("CT2475029.FirstTime", true);
Found : user_pref("CT2475029.FirstTimeFF3", true);
Found : user_pref("CT2475029.FixPageNotFoundErrors", true);
Found : user_pref("CT2475029.GroupingLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Found : user_pref("CT2475029.GroupingLastErrorCode", "");
Found : user_pref("CT2475029.GroupingLastResponse", false);
Found : user_pref("CT2475029.GroupingLastServerUpdateTime", "129754451000000000");
Found : user_pref("CT2475029.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2475029.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2475029.HasUserGlobalKeys", true);
Found : user_pref("CT2475029.Initialize", true);
Found : user_pref("CT2475029.InitializeCommonPrefs", true);
Found : user_pref("CT2475029.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT2475029.InstallationId", "MyAshampoo.exe");
Found : user_pref("CT2475029.InstallationType", "ConduitIntegration");
Found : user_pref("CT2475029.InstalledDate", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.IsAlertDBUpdated", true);
Found : user_pref("CT2475029.IsGrouping", true);
Found : user_pref("CT2475029.IsMulticommunity", true);
Found : user_pref("CT2475029.IsOpenThankYouPage", false);
Found : user_pref("CT2475029.IsOpenUninstallPage", true);
Found : user_pref("CT2475029.LanguagePackLastCheckTime", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2475029.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2475029.LastLogin_3.10.0.1", "Sat Mar 24 2012 11:04:19 GMT+0100");
Found : user_pref("CT2475029.LastLogin_3.12.2.3", "Wed Jun 06 2012 16:59:13 GMT+0200");
Found : user_pref("CT2475029.LastLogin_3.13.0.6", "Mon Jul 16 2012 13:17:36 GMT+0200");
Found : user_pref("CT2475029.LastLogin_3.14.1.0", "Sat Jul 28 2012 14:41:37 GMT+0200");
Found : user_pref("CT2475029.LastLogin_3.2.5.2", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.LatestVersion", "3.14.1.0");
Found : user_pref("CT2475029.Locale", "en");
Found : user_pref("CT2475029.MCDetectTooltipHeight", "83");
Found : user_pref("CT2475029.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2475029.MCDetectTooltipWidth", "295");
Found : user_pref("CT2475029.MyStuffEnabledAtInstallation", true);
Found : user_pref("CT2475029.RadioIsPodcast", false);
Found : user_pref("CT2475029.RadioMediaID", "9962");
Found : user_pref("CT2475029.RadioMediaType", "Media Player");
Found : user_pref("CT2475029.RadioMenuSelectedID", "EBRadioMenu_CT24750299962");
Found : user_pref("CT2475029.RadioShrinkedFromSetup", false);
Found : user_pref("CT2475029.RadioStationName", "California%20Rock");
Found : user_pref("CT2475029.RadioStationURL", "hxxp://feedlive.net/california.asx");
Found : user_pref("CT2475029.SavedHomepage", "hxxp://www.sportal.de/");
Found : user_pref("CT2475029.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2475029.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT247[...]
Found : user_pref("CT2475029.SearchInNewTabEnabled", true);
Found : user_pref("CT2475029.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2475029.SearchInNewTabLastCheckTime", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2475029.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Found : user_pref("CT2475029.ServiceMapLastCheckTime", "Sat Jul 28 2012 14:41:30 GMT+0200");
Found : user_pref("CT2475029.SettingsLastCheckTime", "Fri Jan 28 2011 18:50:42 GMT+0100");
Found : user_pref("CT2475029.SettingsLastUpdate", "1295971309");
Found : user_pref("CT2475029.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2475029.ThirdPartyComponentsLastCheck", "Fri Jan 28 2011 18:50:42 GMT+0100");
Found : user_pref("CT2475029.ThirdPartyComponentsLastUpdate", "1246790578");
Found : user_pref("CT2475029.ToolbarShrinkedFromSetup", false);
Found : user_pref("CT2475029.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2475029");
Found : user_pref("CT2475029.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT2475029.UserID", "UN22418642261672653");
Found : user_pref("CT2475029.WeatherNetwork", "");
Found : user_pref("CT2475029.WeatherPollDate", "Fri Jan 28 2011 18:50:45 GMT+0100");
Found : user_pref("CT2475029.WeatherUnit", "C");
Found : user_pref("CT2475029.alertChannelId", "868510");
Found : user_pref("CT2475029.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...]
Found : user_pref("CT2475029.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Found : user_pref("CT2475029.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Found : user_pref("CT2475029.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...]
Found : user_pref("CT2475029.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Found : user_pref("CT2475029.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Found : user_pref("CT2475029.backendstorage./9b+7e06cg5el8:", "6E6D6E706E6C72717774");
Found : user_pref("CT2475029.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737476747278777D7A242F4B4947[...]
Found : user_pref("CT2475029.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Found : user_pref("CT2475029.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Found : user_pref("CT2475029.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Found : user_pref("CT2475029.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Found : user_pref("CT2475029.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Found : user_pref("CT2475029.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Found : user_pref("CT2475029.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Found : user_pref("CT2475029.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...]
Found : user_pref("CT2475029.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Found : user_pref("CT2475029.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Found : user_pref("CT2475029.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Found : user_pref("CT2475029.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Found : user_pref("CT2475029.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Found : user_pref("CT2475029.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Found : user_pref("CT2475029.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Found : user_pref("CT2475029.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Found : user_pref("CT2475029.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Found : user_pref("CT2475029.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Found : user_pref("CT2475029.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Found : user_pref("CT2475029.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Found : user_pref("CT2475029.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Found : user_pref("CT2475029.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Found : user_pref("CT2475029.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...]
Found : user_pref("CT2475029.backendstorage./9b-0?3g>d", "3C706A6E726E44757A46747648204A497C4A2550514F222A25[...]
Found : user_pref("CT2475029.backendstorage./9b-0?3g@6:5;", "");
Found : user_pref("CT2475029.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F297B7E7D21202F26313E424[...]
Found : user_pref("CT2475029.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Found : user_pref("CT2475029.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484779213F3E484F4E4D464[...]
Found : user_pref("CT2475029.backendstorage./9b5ba==9cjag", "3D3A3E3C4171706D7A7547747378777C4D787D797E");
Found : user_pref("CT2475029.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6E706E6C72726E73727677");
Found : user_pref("CT2475029.backendstorage./9b9643g3/9e", "6A");
Found : user_pref("CT2475029.backendstorage./9b<:222h64<", "393F352F3E");
Found : user_pref("CT2475029.backendstorage./9b=+03eh8h8j?:", "4443");
Found : user_pref("CT2475029.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Found : user_pref("CT2475029.backendstorage./9b?b0d:8aj62<h", "6D");
Found : user_pref("CT2475029.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Found : user_pref("CT2475029.backendstorage.active", "796573");
Found : user_pref("CT2475029.backendstorage.firstinstall", "796573");
Found : user_pref("CT2475029.backendstorage.gsdomain", "");
Found : user_pref("CT2475029.backendstorage.lastrun", "31333332353833343635353339");
Found : user_pref("CT2475029.backendstorage.partner_id", "3937346665643236");
Found : user_pref("CT2475029.backendstorage.shoppingapp.gk.exipres", "546875204D617220323920323031322031313A[...]
Found : user_pref("CT2475029.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Found : user_pref("CT2475029.backendstorage.shopupdate", "323031322D30332D3234");
Found : user_pref("CT2475029.backendstorage.shopversionv2", "33");
Found : user_pref("CT2475029.backendstorage.short", "30");
Found : user_pref("CT2475029.backendstorage.tbready", "74727565");
Found : user_pref("CT2475029.ct2481020.DialogsAlignMode", "LTR");
Found : user_pref("CT2475029.ct2481020.FeedLastCount129076858299680990", 697);
Found : user_pref("CT2475029.ct2481020.GroupingInvalidateCache", false);
Found : user_pref("CT2475029.ct2481020.GroupingLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Found : user_pref("CT2475029.ct2481020.GroupingLastErrorCode", "");
Found : user_pref("CT2475029.ct2481020.GroupingLastResponse", false);
Found : user_pref("CT2475029.ct2481020.GroupingLastServerUpdateTime", "129732820530000000");
Found : user_pref("CT2475029.ct2481020.InvalidateCache", false);
Found : user_pref("CT2475029.ct2481020.LanguagePackLastCheckTime", "Sat Jul 28 2012 14:41:37 GMT+0200");
Found : user_pref("CT2475029.ct2481020.Locale", "de");
Found : user_pref("CT2475029.ct2481020.RadioLastCheckTime", "Sat Mar 24 2012 11:04:15 GMT+0100");
Found : user_pref("CT2475029.ct2481020.RadioLastUpdateIPServer", "3");
Found : user_pref("CT2475029.ct2481020.RadioLastUpdateServer", "3");
Found : user_pref("CT2475029.ct2481020.SearchInNewTabLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Found : user_pref("CT2475029.ct2481020.SettingsLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Found : user_pref("CT2475029.ct2481020.SettingsLastUpdate", "1343304722");
Found : user_pref("CT2475029.ct2481020.ThirdPartyComponentsLastCheck", "Sat Mar 24 2012 11:04:12 GMT+0100");
Found : user_pref("CT2475029.ct2481020.ThirdPartyComponentsLastUpdate", "1255348257");
Found : user_pref("CT2475029.ct2481020.globalFirstTimeInfoLastCheckTime", "Sat Mar 24 2012 11:04:20 GMT+0100[...]
Found : user_pref("CT2475029.ct2481020.toolbarAppMetaDataLastCheckTime", "Sat Jul 28 2012 14:41:37 GMT+0200"[...]
Found : user_pref("CT2475029.ct2481020.toolbarContextMenuLastCheckTime", "Sat Mar 24 2012 11:04:23 GMT+0100"[...]
Found : user_pref("CT2475029.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT2475029.homepageProtectorEnableByLogin", true);
Found : user_pref("CT2475029.initDone", true);
Found : user_pref("CT2475029.isAppTrackingManagerOn", true);
Found : user_pref("CT2475029.isFirstRadioInstallation", false);
Found : user_pref("CT2475029.myStuffEnabled", true);
Found : user_pref("CT2475029.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2475029.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2475029.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2475029.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2475029.oldAppsList", "200,129058856464344002,129058856464656507,111,129469746101488132[...]
Found : user_pref("CT2475029.revertSettingsEnabled", true);
Found : user_pref("CT2475029.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT2475029.searchProtectorEnableByLogin", true);
Found : user_pref("CT2475029.testingCtid", "");
Found : user_pref("CT2475029.toolbarAppMetaDataLastCheckTime", "Fri Jan 28 2011 18:50:43 GMT+0100");
Found : user_pref("CT2475029.toolbarContextMenuLastCheckTime", "Fri Jan 28 2011 18:50:44 GMT+0100");
Found : user_pref("CT2475029.usagesFlag", 2);
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/ct2481020/CT2475029[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2481020", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2475029",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equaliz[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimiz[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gi[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gi[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"e3d[...]
Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Leon\\AppData\\Roaming\\Mozilla\\Fi[...]
Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Found : user_pref("CommunityToolbar.globalUserId", "60cc3b91-0774-4670-95fb-76a6c8152393");
Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 24 2012 11:04:1[...]
Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.notifications.locale", "en");
Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Mar 24 2012 11:04:12 GMT+0100");
Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.notifications.userId", "23ebf70e-2226-4ae6-ae3e-bf5a62898776");

*************************

AdwCleaner[R1].txt - [32942 octets] - [31/07/2012 22:29:16]

########## EOF - C:\AdwCleaner[R1].txt - [33071 octets] ##########

t'john · 31.07.2012, 22:01

Sehr gut!

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

john_b · 02.08.2012, 12:50

Hier die Logfile des AdwCleaner:

Code:

ATTFilter

# AdwCleaner v1.703 - Logfile created 08/01/2012 at 14:32:25
# Updated 20/07/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Leon - LEON-PC
# Running from : C:\Users\Leon\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Leon\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Leon\AppData\LocalLow\SweetIM
Folder Deleted : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\Conduit
Folder Deleted : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\ConduitCommon
Folder Deleted : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\ConduitEngine
Folder Deleted : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\extensions\staged
Folder Deleted : C:\ProgramData\SweetIM
Folder Deleted : C:\Program Files\AskTBar
File Deleted : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\Askcom.xml
File Deleted : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\searchplugins\Conduit.xml
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\Program Files\Mozilla FireFox\Components\AskSearch.js

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2475029
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\DT Soft
Key Deleted : HKLM\SOFTWARE\eRightSoft\OpenCandy

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\prefs.js

C:\Users\Leon\AppData\Roaming\Mozilla\Firefox\Profiles\oln6rzzp.default\user.js ... Deleted !

Deleted : user_pref("CT2475029..clientLogIsEnabled", false);
Deleted : user_pref("CT2475029..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2475029..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2475029.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2475029.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2475029.BrowserCompStateIsOpen_129469746101488132", true);
Deleted : user_pref("CT2475029.BrowserCompStateIsOpen_129681723868939970", true);
Deleted : user_pref("CT2475029.CT2481020.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481020.alertChannelId", "874426");
Deleted : user_pref("CT2475029.CT2481024.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481024.alertChannelId", "874430");
Deleted : user_pref("CT2475029.CT2481025.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481025.alertChannelId", "874431");
Deleted : user_pref("CT2475029.CT2481029.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481029.alertChannelId", "874435");
Deleted : user_pref("CT2475029.CT2481031.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481031.alertChannelId", "874437");
Deleted : user_pref("CT2475029.CT2481032.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481032.alertChannelId", "874438");
Deleted : user_pref("CT2475029.CT2481033.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481033.alertChannelId", "874439");
Deleted : user_pref("CT2475029.CT2481034.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481034.alertChannelId", "874440");
Deleted : user_pref("CT2475029.CT2481035.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481035.alertChannelId", "874441");
Deleted : user_pref("CT2475029.CT2481037.CommunityChanged", true);
Deleted : user_pref("CT2475029.CT2481037.alertChannelId", "874443");
Deleted : user_pref("CT2475029.CTID", "ct2481020");
Deleted : user_pref("CT2475029.CommunitiesChangesLastCheckTime", "Sat Jul 28 2012 15:15:57 GMT+0200");
Deleted : user_pref("CT2475029.CommunitiesChangesLastUrl", "hxxp://grouping.services.conduit.com/GroupingReque[...]
Deleted : user_pref("CT2475029.CommunityChanged", true);
Deleted : user_pref("CT2475029.CurrentServerDate", "28-7-2012");
Deleted : user_pref("CT2475029.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2475029.DialogsGetterLastCheckTime", "Fri Jul 27 2012 13:50:47 GMT+0200");
Deleted : user_pref("CT2475029.DownloadDomainsCheckInterval", "168");
Deleted : user_pref("CT2475029.DownloadDomainsListLastCheckTime", "Wed Jul 25 2012 14:05:10 GMT+0200");
Deleted : user_pref("CT2475029.DownloadDomainsListLastServerUpdateTime", "1201069983");
Deleted : user_pref("CT2475029.DownloadReferralCookieData", "");
Deleted : user_pref("CT2475029.EMailNotifierPollDate", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076849370150342", "Sat Mar 24 2012 11:04:14 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076850042182211", "Sat Mar 24 2012 11:04:14 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076850596400916", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076850791868756", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076852434375419", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076853083906444", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076854010937606", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076855068438037", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076855340312884", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076855597344292", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076855883906472", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076856408281730", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076856723281882", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076856982969262", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076857229219583", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076857478587121", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129076858014837073", "Sat Mar 24 2012 11:04:17 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129132307482029379", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129132307482029381", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129132307482029382", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129133095459686870", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129133095459686871", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129137437659687146", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129137437659687147", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129137437659687148", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214602500", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214602506", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214602512", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214602518", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214602524", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214602530", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603404", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603410", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603416", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603422", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603428", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603434", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603440", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603446", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603452", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603458", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603464", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603470", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603476", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603482", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603488", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214603494", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758786", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758792", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758798", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758804", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758810", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758816", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758822", "Fri Jan 28 2011 18:50:46 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758828", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758834", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758840", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758846", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758852", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758858", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758864", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758870", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758876", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758882", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758888", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758894", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758900", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758906", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758912", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758918", "Fri Jan 28 2011 18:50:47 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758924", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758930", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758936", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758942", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758948", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758954", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedPollDate129255180214758960", "Fri Jan 28 2011 18:50:48 GMT+0100");
Deleted : user_pref("CT2475029.FeedTTL129076850596400916", 5);
Deleted : user_pref("CT2475029.FeedTTL129076850791868756", 5);
Deleted : user_pref("CT2475029.FeedTTL129076855068438037", 2);
Deleted : user_pref("CT2475029.FeedTTL129076856408281730", 2);
Deleted : user_pref("CT2475029.FeedTTL129076856723281882", 5);
Deleted : user_pref("CT2475029.FeedTTL129076857229219583", 30);
Deleted : user_pref("CT2475029.FeedTTL129076858014837073", 2);
Deleted : user_pref("CT2475029.FeedTTL129132307482029379", 40);
Deleted : user_pref("CT2475029.FeedTTL129132307482029381", 40);
Deleted : user_pref("CT2475029.FeedTTL129132307482029382", 40);
Deleted : user_pref("CT2475029.FeedTTL129133095459686870", 40);
Deleted : user_pref("CT2475029.FeedTTL129133095459686871", 40);
Deleted : user_pref("CT2475029.FeedTTL129137437659687146", 40);
Deleted : user_pref("CT2475029.FeedTTL129137437659687147", 40);
Deleted : user_pref("CT2475029.FeedTTL129137437659687148", 40);
Deleted : user_pref("CT2475029.FeedTTL129255180214602500", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214602512", 2);
Deleted : user_pref("CT2475029.FeedTTL129255180214602518", 5);
Deleted : user_pref("CT2475029.FeedTTL129255180214602524", 5);
Deleted : user_pref("CT2475029.FeedTTL129255180214603416", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214603428", 60);
Deleted : user_pref("CT2475029.FeedTTL129255180214603482", 60);
Deleted : user_pref("CT2475029.FeedTTL129255180214603488", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214603494", 2);
Deleted : user_pref("CT2475029.FeedTTL129255180214758786", 5);
Deleted : user_pref("CT2475029.FeedTTL129255180214758798", 30);
Deleted : user_pref("CT2475029.FeedTTL129255180214758804", 30);
Deleted : user_pref("CT2475029.FeedTTL129255180214758810", 2);
Deleted : user_pref("CT2475029.FeedTTL129255180214758828", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214758840", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214758846", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214758852", 15);
Deleted : user_pref("CT2475029.FeedTTL129255180214758870", 1440);
Deleted : user_pref("CT2475029.FeedTTL129255180214758900", 10);
Deleted : user_pref("CT2475029.FeedTTL129255180214758918", 5);
Deleted : user_pref("CT2475029.FirstServerDate", "28-1-2011");
Deleted : user_pref("CT2475029.FirstTime", true);
Deleted : user_pref("CT2475029.FirstTimeFF3", true);
Deleted : user_pref("CT2475029.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2475029.GroupingLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Deleted : user_pref("CT2475029.GroupingLastErrorCode", "");
Deleted : user_pref("CT2475029.GroupingLastResponse", false);
Deleted : user_pref("CT2475029.GroupingLastServerUpdateTime", "129754451000000000");
Deleted : user_pref("CT2475029.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2475029.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2475029.HasUserGlobalKeys", true);
Deleted : user_pref("CT2475029.Initialize", true);
Deleted : user_pref("CT2475029.InitializeCommonPrefs", true);
Deleted : user_pref("CT2475029.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2475029.InstallationId", "MyAshampoo.exe");
Deleted : user_pref("CT2475029.InstallationType", "ConduitIntegration");
Deleted : user_pref("CT2475029.InstalledDate", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.IsAlertDBUpdated", true);
Deleted : user_pref("CT2475029.IsGrouping", true);
Deleted : user_pref("CT2475029.IsMulticommunity", true);
Deleted : user_pref("CT2475029.IsOpenThankYouPage", false);
Deleted : user_pref("CT2475029.IsOpenUninstallPage", true);
Deleted : user_pref("CT2475029.LanguagePackLastCheckTime", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2475029.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2475029.LastLogin_3.10.0.1", "Sat Mar 24 2012 11:04:19 GMT+0100");
Deleted : user_pref("CT2475029.LastLogin_3.12.2.3", "Wed Jun 06 2012 16:59:13 GMT+0200");
Deleted : user_pref("CT2475029.LastLogin_3.13.0.6", "Mon Jul 16 2012 13:17:36 GMT+0200");
Deleted : user_pref("CT2475029.LastLogin_3.14.1.0", "Sat Jul 28 2012 14:41:37 GMT+0200");
Deleted : user_pref("CT2475029.LastLogin_3.2.5.2", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.LatestVersion", "3.14.1.0");
Deleted : user_pref("CT2475029.Locale", "en");
Deleted : user_pref("CT2475029.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2475029.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2475029.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2475029.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2475029.RadioIsPodcast", false);
Deleted : user_pref("CT2475029.RadioMediaID", "9962");
Deleted : user_pref("CT2475029.RadioMediaType", "Media Player");
Deleted : user_pref("CT2475029.RadioMenuSelectedID", "EBRadioMenu_CT24750299962");
Deleted : user_pref("CT2475029.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT2475029.RadioStationName", "California%20Rock");
Deleted : user_pref("CT2475029.RadioStationURL", "hxxp://feedlive.net/california.asx");
Deleted : user_pref("CT2475029.SavedHomepage", "hxxp://www.sportal.de/");
Deleted : user_pref("CT2475029.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2475029.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT247[...]
Deleted : user_pref("CT2475029.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2475029.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2475029.SearchInNewTabLastCheckTime", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2475029.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT2475029.ServiceMapLastCheckTime", "Sat Jul 28 2012 14:41:30 GMT+0200");
Deleted : user_pref("CT2475029.SettingsLastCheckTime", "Fri Jan 28 2011 18:50:42 GMT+0100");
Deleted : user_pref("CT2475029.SettingsLastUpdate", "1295971309");
Deleted : user_pref("CT2475029.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2475029.ThirdPartyComponentsLastCheck", "Fri Jan 28 2011 18:50:42 GMT+0100");
Deleted : user_pref("CT2475029.ThirdPartyComponentsLastUpdate", "1246790578");
Deleted : user_pref("CT2475029.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2475029.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2475029");
Deleted : user_pref("CT2475029.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2475029.UserID", "UN22418642261672653");
Deleted : user_pref("CT2475029.WeatherNetwork", "");
Deleted : user_pref("CT2475029.WeatherPollDate", "Fri Jan 28 2011 18:50:45 GMT+0100");
Deleted : user_pref("CT2475029.WeatherUnit", "C");
Deleted : user_pref("CT2475029.alertChannelId", "868510");
Deleted : user_pref("CT2475029.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e06cg5el8:", "6E6D6E706E6C72717774");
Deleted : user_pref("CT2475029.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737476747278777D7A242F4B4947[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Deleted : user_pref("CT2475029.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...]
Deleted : user_pref("CT2475029.backendstorage./9b-0?3g>d", "3C706A6E726E44757A46747648204A497C4A2550514F222A25[...]
Deleted : user_pref("CT2475029.backendstorage./9b-0?3g@6:5;", "");
Deleted : user_pref("CT2475029.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F297B7E7D21202F26313E424[...]
Deleted : user_pref("CT2475029.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Deleted : user_pref("CT2475029.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484779213F3E484F4E4D464[...]
Deleted : user_pref("CT2475029.backendstorage./9b5ba==9cjag", "3D3A3E3C4171706D7A7547747378777C4D787D797E");
Deleted : user_pref("CT2475029.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6E706E6C72726E73727677");
Deleted : user_pref("CT2475029.backendstorage./9b9643g3/9e", "6A");
Deleted : user_pref("CT2475029.backendstorage./9b<:222h64<", "393F352F3E");
Deleted : user_pref("CT2475029.backendstorage./9b=+03eh8h8j?:", "4443");
Deleted : user_pref("CT2475029.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Deleted : user_pref("CT2475029.backendstorage./9b?b0d:8aj62<h", "6D");
Deleted : user_pref("CT2475029.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Deleted : user_pref("CT2475029.backendstorage.active", "796573");
Deleted : user_pref("CT2475029.backendstorage.firstinstall", "796573");
Deleted : user_pref("CT2475029.backendstorage.gsdomain", "");
Deleted : user_pref("CT2475029.backendstorage.lastrun", "31333332353833343635353339");
Deleted : user_pref("CT2475029.backendstorage.partner_id", "3937346665643236");
Deleted : user_pref("CT2475029.backendstorage.shoppingapp.gk.exipres", "546875204D617220323920323031322031313A[...]
Deleted : user_pref("CT2475029.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Deleted : user_pref("CT2475029.backendstorage.shopupdate", "323031322D30332D3234");
Deleted : user_pref("CT2475029.backendstorage.shopversionv2", "33");
Deleted : user_pref("CT2475029.backendstorage.short", "30");
Deleted : user_pref("CT2475029.backendstorage.tbready", "74727565");
Deleted : user_pref("CT2475029.ct2481020.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2475029.ct2481020.FeedLastCount129076858299680990", 697);
Deleted : user_pref("CT2475029.ct2481020.GroupingInvalidateCache", false);
Deleted : user_pref("CT2475029.ct2481020.GroupingLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Deleted : user_pref("CT2475029.ct2481020.GroupingLastErrorCode", "");
Deleted : user_pref("CT2475029.ct2481020.GroupingLastResponse", false);
Deleted : user_pref("CT2475029.ct2481020.GroupingLastServerUpdateTime", "129732820530000000");
Deleted : user_pref("CT2475029.ct2481020.InvalidateCache", false);
Deleted : user_pref("CT2475029.ct2481020.LanguagePackLastCheckTime", "Sat Jul 28 2012 14:41:37 GMT+0200");
Deleted : user_pref("CT2475029.ct2481020.Locale", "de");
Deleted : user_pref("CT2475029.ct2481020.RadioLastCheckTime", "Sat Mar 24 2012 11:04:15 GMT+0100");
Deleted : user_pref("CT2475029.ct2481020.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2475029.ct2481020.RadioLastUpdateServer", "3");
Deleted : user_pref("CT2475029.ct2481020.SearchInNewTabLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Deleted : user_pref("CT2475029.ct2481020.SettingsLastCheckTime", "Sat Jul 28 2012 14:41:31 GMT+0200");
Deleted : user_pref("CT2475029.ct2481020.SettingsLastUpdate", "1343304722");
Deleted : user_pref("CT2475029.ct2481020.ThirdPartyComponentsLastCheck", "Sat Mar 24 2012 11:04:12 GMT+0100");
Deleted : user_pref("CT2475029.ct2481020.ThirdPartyComponentsLastUpdate", "1255348257");
Deleted : user_pref("CT2475029.ct2481020.globalFirstTimeInfoLastCheckTime", "Sat Mar 24 2012 11:04:20 GMT+0100[...]
Deleted : user_pref("CT2475029.ct2481020.toolbarAppMetaDataLastCheckTime", "Sat Jul 28 2012 14:41:37 GMT+0200"[...]
Deleted : user_pref("CT2475029.ct2481020.toolbarContextMenuLastCheckTime", "Sat Mar 24 2012 11:04:23 GMT+0100"[...]
Deleted : user_pref("CT2475029.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2475029.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2475029.initDone", true);
Deleted : user_pref("CT2475029.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2475029.isFirstRadioInstallation", false);
Deleted : user_pref("CT2475029.myStuffEnabled", true);
Deleted : user_pref("CT2475029.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2475029.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2475029.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2475029.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2475029.oldAppsList", "200,129058856464344002,129058856464656507,111,129469746101488132[...]
Deleted : user_pref("CT2475029.revertSettingsEnabled", true);
Deleted : user_pref("CT2475029.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2475029.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2475029.testingCtid", "");
Deleted : user_pref("CT2475029.toolbarAppMetaDataLastCheckTime", "Fri Jan 28 2011 18:50:43 GMT+0100");
Deleted : user_pref("CT2475029.toolbarContextMenuLastCheckTime", "Fri Jan 28 2011 18:50:44 GMT+0100");
Deleted : user_pref("CT2475029.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/ct2481020/CT2475029[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2481020", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2475029",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equaliz[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimiz[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gi[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gi[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"e3d[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Leon\\AppData\\Roaming\\Mozilla\\Fi[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Deleted : user_pref("CommunityToolbar.globalUserId", "60cc3b91-0774-4670-95fb-76a6c8152393");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Mar 24 2012 11:04:1[...]
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Mar 24 2012 11:04:12 GMT+0100");
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "23ebf70e-2226-4ae6-ae3e-bf5a62898776");

*************************

AdwCleaner[R1].txt - [33073 octets] - [31/07/2012 22:29:16]
AdwCleaner[R2].txt - [33134 octets] - [01/08/2012 14:32:12]
AdwCleaner[S1].txt - [33913 octets] - [01/08/2012 14:32:25]

########## EOF - C:\AdwCleaner[S1].txt - [34042 octets] ##########

Und hier die der Emisoft Anti-Malware:

Code:

ATTFilter

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 01.08.2012 15:05:01

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	01.08.2012 15:05:30

c:\program files\phenomedia 	gefunden: Trace.File.moorfrog 1.0!E1
Key: hkey_local_machine\software\asktbar 	gefunden: Trace.Registry.asktbar!E1
C:\Users\Leon\Documents\ICQ\428735316\ReceivedFiles\454176116 Tobi\FIFA10.exe 	gefunden: Virus.Win32.Heur!E2
C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe 	gefunden: APPL!E2
C:\HP\BIN\EndProcess.exe 	gefunden: Riskware.Win32.KillApp!E1

Gescannt	685241
Gefunden	5

Scan Ende:	02.08.2012 13:39:20
Scan Zeit:	22:33:50

C:\HP\BIN\EndProcess.exe	Quarantäne Riskware.Win32.KillApp!E1
C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe	Quarantäne APPL!E2
C:\Users\Leon\Documents\ICQ\428735316\ReceivedFiles\454176116 Tobi\FIFA10.exe	Quarantäne Virus.Win32.Heur!E2
Key: hkey_local_machine\software\asktbar	Quarantäne Trace.Registry.asktbar!E1
c:\program files\phenomedia	Quarantäne Trace.File.moorfrog 1.0!E1

Quarantäne	5

t'john · 02.08.2012, 12:51

Sehr gut!

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

john_b · 02.08.2012, 20:58

Hier die Logfile von Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=173edcc83e82ec478a53f1ffb26e53b9
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-02 06:08:35
# local_time=2012-08-02 08:08:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 100 432825 118807902 0 0
# compatibility_mode=5892 16776573 100 100 3518 181444066 0 0
# compatibility_mode=8192 67108863 100 0 618 618 0 0
# compatibility_mode=9217 16777214 25 13 62986368 62986369 0 0
# scanned=362846
# found=2
# cleaned=2
# scan_time=19577
C:\Users\Leon\Downloads\FFSetup220.zip	Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C
H:\Leon\Leon-PC\Downloads\FFSetup220.zip	Win32/Adware.ADON application (deleted - quarantined)	00000000000000000000000000000000	C

t'john · 03.08.2012, 13:13

Sehr gut!

damit bist Du sauber und entlassen!

Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html

Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der