Hallo,

ich habe den Bundestrojaner bekommen und konnte erstmal ueberhaupt nichts machen, dann habe ich eine Systemwiederherstellung durchgefuehrt und ich konnte den Laptop wieder benutzen.

Aber ich glaube der Virus ist immer noch auf dem Laptop, ich habe deinen Anweisungen schon gefolgt und habe Malwarebytes laufen lassen, 2 mal, beim ersten mal hatte ich den Trojaner geloescht und beim zweiten Scan war der dann immer noch da.


Das ist der Report den ich von Malwarebytes bekommen habe:



Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.14.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
JustADUit :: JUSTADUIT-HP [administrator]

Protection: Enabled

14-Aug-12 3:18:40 PM
mbam-log-2012-08-14 (08-59-11).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 347924
Time elapsed: 59 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\JustADUit\AppData\Local\Temp\.exe (Trojan.Agent) -> No action taken.

(end)


Dann habe ich wie gelesen, den OTL Scan durchgefuehrt und habe folgendes bekommen:

OTL Logfile:

OTL logfile created on: 14-Aug-12 4:58:27 PM - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\JustADUit\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy
 
5.95 Gb Total Physical Memory | 2.71 Gb Available Physical Memory | 45.63% Memory free
11.90 Gb Paging File | 8.01 Gb Available in Paging File | 67.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 681.33 Gb Total Space | 584.56 Gb Free Space | 85.80% Space Free | Partition Type: NTFS
Drive D: | 17.02 Gb Total Space | 1.86 Gb Free Space | 10.95% Space Free | Partition Type: NTFS
 
Computer Name: JUSTADUIT-HP | User Name: JustADUit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\JustADUit\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe (GameStop Corp.)
PRC - C:\Program Files (x86)\ooVoo\ooVoo.exe (ooVoo LLC)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe (SlimWare Utilities, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe (Wajam)
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe (Apple Inc.)
PRC - C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Hewlett-Packard Development Company L.P.)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (HP)
PRC - C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe (HP)
PRC - C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe (HP)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe (Roxio)
PRC - C:\Windows\SysWOW64\ezSharedSvcHost.exe (EasyBits Software AS)
PRC - C:\Windows\SysWOW64\ezSharedSvcHost.exe (EasyBits Software AS)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\pdf.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\libglesv2.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\libegl.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\avutil-51.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\avformat-54.dll ()
MOD - C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\avcodec-54.dll ()
MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0018dd52b56988a833ee41699cf49325\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\e7cd67fc34ad0fc611c1e1244cfc6584\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (STacSV) -- C:\Program Files\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (AESTFilters) -- C:\Program Files\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (AMPPALR3) -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (EvtEng) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (BTHSSecurityMgr) -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel(R) Corporation)
SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (HPAuto) -- C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe (Hewlett-Packard)
SRV:64bit: - (HPClientSvc) -- C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (vToolbarUpdater11.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (NACAgent) -- C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgent.exe (Cisco Systems, Inc.)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (WajamUpdater) -- C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe (Wajam)
SRV - (IconMan_R) -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
SRV - (HPWMISVC) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (HP Support Assistant Service) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (hpCMSrv) -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Hewlett-Packard Development Company L.P.)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (PinnacleUpdateSvc) -- C:\Program Files (x86)\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe (PowerUp Software, LLC)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (FPLService) -- C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (HP)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (RoxioNow Service) -- C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe (Roxio)
SRV - (GamesAppService) -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (SWDUMon) -- C:\Windows\SysNative\drivers\SWDUMon.sys ()
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (intelkmd) -- C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (RSPCIESTOR) -- C:\Windows\SysNative\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AMPPAL) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (RimUsb) -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV:64bit: - (RimVSerPort) -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (iwdbus) -- C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) -- C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (clwvd) -- C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV - (WinRing0_1_2_0) -- C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys (OpenLibSys.org)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}: "URL" = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT/1
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
IE - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
IE - HKLM\..\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}: "URL" = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=hp
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110014&babsrc=SP_ss&mntrId=ba5974c600000000000074e50b1d2801
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}: "URL" = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\JustADUit\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\JustADUit\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012-07-13 18:27:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-08-14 18:04:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-08-14 18:04:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012-03-07 01:22:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\JustADUit\AppData\Roaming\Mozilla\Extensions
[2012-08-07 18:58:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions
[2012-08-07 08:43:57 | 000,000,000 | ---D | M] (ooVoo toolbar, powered by Ask.com) -- C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com
[2012-08-11 20:28:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012-08-11 20:28:44 | 000,000,000 | ---D | M] (TrueSuite Website Logon) -- C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
[2012-08-07 18:58:50 | 001,184,804 | ---- | M] () (No name found) -- C:\USERS\JUSTADUIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WM43CQBF.DEFAULT-1344342359944\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI
[2012-08-11 20:28:47 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012-07-13 18:27:16 | 000,003,769 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012-05-04 15:30:45 | 000,002,313 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012-07-13 19:16:36 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012-07-13 19:16:36 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://isearch.avg.com/?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=hp
CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = hxxp://isearch.avg.com/search?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.12&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding}
CHR - homepage: hxxp://isearch.avg.com/?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=hp
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\JustADUit\AppData\Local\Google\Chrome\Application\21.0.1180.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Simple Pass 2011 (Enabled) = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0\npwebsitelogon.dll
CHR - plugin: Wajam (Enabled) = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.23_0\plugins/PriamNPAPI.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\JustADUit\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: Oovoo Toolbar = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanijiojpcccpkjdjjmjghddcgcbfj\7.15.2.23076_0\
CHR - Extension: Website Logon = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0\
CHR - Extension: YouTube = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Wajam = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.23_0\
CHR - Extension: Google Mail = C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009-06-10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (ooVoo toolbar, powered by Ask.com) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (ooVoo toolbar, powered by Ask.com) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe (Hewlett-Packard Development Company L.P.)
O4 - HKLM..\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NACAgentUI] C:\Program Files (x86)\Cisco\Cisco NAC Agent\NACAgentUI.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000..\Run: [ooVoo.exe] C:\Program Files (x86)\ooVoo\oovoo.exe (ooVoo LLC)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\JustADUit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameStop Now.lnk = C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe (GameStop Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55E16296-D898-46BC-9CB4-483CE6AC3014}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012-08-14 16:48:36 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\JustADUit\Desktop\OTL.exe
[2012-08-14 15:11:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012-08-14 15:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012-08-14 06:53:47 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Roaming\hellomoto
[2012-08-12 20:27:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012-08-12 19:51:47 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Roaming\Urbo
[2012-08-12 19:51:47 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Roaming\Ryurv
[2012-08-12 19:51:47 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Roaming\Caylaw
[2012-08-12 18:17:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\XCPCSync.OEM
[2012-08-12 17:58:19 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\Desktop\Speditions Buecher
[2012-08-12 11:00:37 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Local\{97C6A11D-E33B-49DE-87B2-84DA802E930C}
[2012-08-12 11:00:27 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Local\{59C880E8-F1B9-4C50-9D08-D2FDDC3BD28E}
[2012-08-12 10:57:29 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Local\PDF24
[2012-08-11 20:28:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012-08-07 08:44:05 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Roaming\ooVoo Details
[2012-08-07 08:43:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com
[2012-08-07 08:43:49 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Local\APN
[2012-08-07 08:43:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ooVoo
[2012-08-07 08:43:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ooVoo
[2012-08-07 07:26:03 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\Desktop\Alte Firefox-Daten
[2012-08-01 10:54:30 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\Desktop\Iphone App
[2012-07-28 11:20:44 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Local\GameStop
[2012-07-17 16:21:04 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2012-07-17 16:18:25 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012-07-17 16:18:25 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012-07-17 16:18:25 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012-07-17 16:18:25 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012-07-17 16:18:24 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012-07-17 16:18:24 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012-07-17 16:18:24 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012-07-17 16:18:24 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012-07-17 16:18:23 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012-07-17 16:18:23 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012-07-17 16:18:23 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012-07-17 16:18:23 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012-07-17 16:18:23 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012-07-17 12:17:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012-07-17 12:17:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012-07-17 12:17:33 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012-07-17 12:17:32 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012-07-17 12:17:31 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012-08-14 16:47:57 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\JustADUit\Desktop\OTL.exe
[2012-08-14 16:43:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2750785616-3380480199-1391761155-1000UA.job
[2012-08-14 16:28:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012-08-14 15:22:54 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012-08-14 15:22:54 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012-08-14 15:13:55 | 000,032,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-08-14 15:13:55 | 000,032,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-08-14 15:12:22 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012-08-14 15:11:45 | 000,726,444 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012-08-14 15:11:45 | 000,624,412 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012-08-14 15:11:45 | 000,106,756 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012-08-14 15:07:14 | 000,002,070 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012-08-14 15:06:32 | 000,001,204 | ---- | M] () -- C:\Users\JustADUit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameStop Now.lnk
[2012-08-14 15:06:11 | 000,000,426 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job
[2012-08-14 15:06:05 | 000,015,672 | ---- | M] () -- C:\Windows\SysNative\drivers\SWDUMon.sys
[2012-08-14 15:05:44 | 000,119,296 | ---- | M] () -- C:\Windows\SysWow64\zlib.dll
[2012-08-14 15:05:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012-08-14 15:05:26 | 495,865,855 | -HS- | M] () -- C:\hiberfil.sys
[2012-08-12 18:34:11 | 000,013,785 | ---- | M] () -- C:\ads_err.adt
[2012-08-12 18:34:11 | 000,004,559 | ---- | M] () -- C:\ads_err.adm
[2012-08-12 18:34:11 | 000,003,072 | ---- | M] () -- C:\ads_err.adi
[2012-08-10 14:59:58 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForJUSTADUIT-HP$.job
[2012-08-09 15:49:09 | 000,002,477 | ---- | M] () -- C:\Users\JustADUit\Desktop\Google Chrome.lnk
[2012-08-08 14:05:19 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012-08-08 14:05:19 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012-08-08 07:55:38 | 000,351,471 | ---- | M] () -- C:\Users\JustADUit\Desktop\Untitled.jpg
[2012-08-08 05:23:18 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForJustADUit.job
[2012-08-07 08:43:45 | 000,001,857 | ---- | M] () -- C:\Users\Public\Desktop\ooVoo.lnk
[2012-08-05 12:26:58 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012-08-03 08:58:14 | 000,186,844 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2012-08-01 12:27:57 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012-07-22 00:43:00 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2750785616-3380480199-1391761155-1000Core.job
[2012-07-17 17:10:15 | 000,417,032 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012-08-12 18:33:51 | 000,013,785 | ---- | C] () -- C:\ads_err.adt
[2012-08-12 18:33:51 | 000,004,559 | ---- | C] () -- C:\ads_err.adm
[2012-08-12 18:33:51 | 000,003,072 | ---- | C] () -- C:\ads_err.adi
[2012-08-08 07:55:38 | 000,351,471 | ---- | C] () -- C:\Users\JustADUit\Desktop\Untitled.jpg
[2012-08-07 08:43:45 | 000,001,857 | ---- | C] () -- C:\Users\Public\Desktop\ooVoo.lnk
[2012-07-31 19:30:19 | 000,000,348 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForJustADUit.job
[2012-06-16 17:26:08 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012-06-16 17:26:08 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012-06-16 17:26:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012-06-16 17:26:02 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012-06-01 20:30:48 | 000,010,752 | ---- | C] () -- C:\Users\JustADUit\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-05-27 00:17:04 | 002,601,752 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_moh.exe
[2012-05-26 12:27:54 | 000,000,074 | ---- | C] () -- C:\Windows\wininit.ini
[2012-05-25 21:17:02 | 000,282,296 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012-05-25 21:17:00 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2012-05-25 21:17:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012-05-23 11:10:36 | 000,119,296 | ---- | C] () -- C:\Windows\SysWow64\zlib.dll
[2012-05-23 11:10:36 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ADsSecurity.dll
[2012-05-23 11:10:36 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\dxinputdll.dll
[2012-04-22 17:26:38 | 000,186,844 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2012-03-15 11:30:30 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2012-02-19 03:02:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012-02-19 02:53:21 | 000,003,155 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat
[2012-02-19 02:52:09 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012-02-19 02:52:08 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012-02-19 02:47:35 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011-09-30 22:42:20 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011-09-28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011-08-24 23:36:56 | 000,000,068 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2011-03-04 00:04:58 | 000,007,736 | ---- | C] () -- C:\Windows\hpDSTRES.DLL
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\Windows\SysWow64\zlib.dll:SummaryInformation
@Alternate Data Stream - 128 bytes -> C:\Windows\SysWow64\zlib.dll:DocumentSummaryInformation

< End of report >
         

Dann OTL EXTRAS Logfile:

OTL Extras logfile created on: 14-Aug-12 4:58:27 PM - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\JustADUit\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy
 
5.95 Gb Total Physical Memory | 2.71 Gb Available Physical Memory | 45.63% Memory free
11.90 Gb Paging File | 8.01 Gb Available in Paging File | 67.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 681.33 Gb Total Space | 584.56 Gb Free Space | 85.80% Space Free | Partition Type: NTFS
Drive D: | 17.02 Gb Total Space | 1.86 Gb Free Space | 10.95% Space Free | Partition Type: NTFS
 
Computer Name: JUSTADUIT-HP | User Name: JustADUit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{066B0E55-1AED-4848-97D1-F6310FD8005F}" = lport=445 | protocol=6 | dir=in | app=system | 
"{140197A6-BB54-4059-A60D-F6EF70B60A42}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1B019452-5565-4837-AB5E-AE492527F98B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2753D446-7485-457B-9C13-315FBB682F2E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{347FE359-817D-40DD-B549-5144E14F6F85}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery | 
"{3733480D-0DE1-462C-B8CE-BD740B97D7F4}" = lport=138 | protocol=17 | dir=in | app=system | 
"{397ED446-815D-4497-ADA1-B2F3C7CEFA09}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3A22AFB1-E574-412C-A38F-F85D346FEE11}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{50EC6090-677B-4744-90F1-1BFBD702ABF9}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{55B03B13-C122-4426-90DF-B90857303D9E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5961ECDD-CFA1-4A2C-879F-F7507E0E1B0C}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{683A7690-1B52-43E0-A21A-9F761D87A8E6}" = rport=138 | protocol=17 | dir=out | app=system | 
"{9D532958-4959-4022-973D-57A1010E816A}" = rport=137 | protocol=17 | dir=out | app=system | 
"{9EAFD860-3EF0-418E-AABB-6A62D2086190}" = rport=139 | protocol=6 | dir=out | app=system | 
"{A47F20DF-5A84-4883-8E87-9B72AE47DBCA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A6A6FD01-ECF6-4CA0-944E-143F64BE9583}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{AA0A3445-2129-4868-ADED-3A6305037309}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer | 
"{B5FFF0E4-14D3-43CE-B045-00BA0B37A6CB}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
"{BAA86B2E-1C1C-491B-AA7C-53E05A37F0CB}" = lport=139 | protocol=6 | dir=in | app=system | 
"{CC526ED5-EB22-4606-934D-50AE0D29855E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CDA92B34-2BE7-44B4-AAAB-318C725DBB6A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{D77F3723-71B2-4B92-B022-C5B56C8008AF}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery | 
"{D9FEBA22-E22F-4AE0-885F-AC4FAE6A85A5}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer | 
"{E1C6FD90-A30B-4DFD-9A48-6E5CB8DE1CCB}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{E5212861-9CE5-4CBD-9157-91EE556CEAE7}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{EF9E8924-D811-4850-80FE-ABE6F9AA52A0}" = rport=445 | protocol=6 | dir=out | app=system | 
"{F8C745D3-766A-450D-B721-646DAFC3B8A2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FEFCE59A-AB5B-4266-B8BD-AC799B17814C}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00F45E5C-3184-49CC-B43A-6671D423866E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{03E6EE6E-D162-4A4E-9E1E-AC6863757E44}" = protocol=6 | dir=out | app=system | 
"{050561FC-7094-43F1-B56C-4B15B06B78FC}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{0BADB049-67B5-4653-ACDE-D28F8C114B00}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\rnow.exe | 
"{0E7D9EF1-0C3C-432F-A073-9B4C393C6271}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{2662842A-E723-4619-9870-BB301C8E7250}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{29BF49CC-5B6F-498F-AEF6-FB9EB3E8B16B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{323FA34F-CBDF-49DE-8396-B7AB730346A3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{38390B92-9BB5-4F93-8917-1F7722D9F194}" = dir=in | app=c:\program files (x86)\intel corporation\intel widi\widiapp.exe | 
"{40414F59-916B-4185-AB33-0B44DAD42C32}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{42C020F2-BCF0-4D5F-A906-943612EE1BAC}" = protocol=17 | dir=in | app=c:\program files (x86)\gamespy arcade\aphex.exe | 
"{452BF436-3850-49DF-A4B5-E42DD1E5B024}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{45305DB2-D5CC-4563-AD2E-02679B7A89D6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{46CA15A4-FBA5-444B-B366-4739B48381E3}" = dir=in | app=c:\windows\system32\ezsharedsvchost.exe | 
"{47D7F76B-C4C2-4A4E-8387-00A8581C66D6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{482E636C-52B1-472C-8DDD-D07BB820E715}" = protocol=17 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe | 
"{4A55E2E5-D01D-46A8-A7FF-C4B67F6B6909}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{4A580853-D7D2-4BD9-A00D-7855920A8DCB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4EAAE1D1-EF32-4CE7-B289-6A924D371F10}" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars republic commando\gamedata\system\swrepubliccommando.exe | 
"{4FAD2344-DC0D-413D-BE67-D3A2DC04F3B6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{51590D41-FF22-4232-85A4-0FC22705F82D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{555CB0A8-0398-4414-B362-30DBAC16FE67}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe | 
"{5715DD86-FAF0-4620-8D98-674E7766EE2C}" = protocol=6 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe | 
"{577B66D0-B308-41B9-9069-C713D5BFB519}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{58D88B11-2A7E-4966-88DC-7C0C813C2D85}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{5C7B6DF9-890D-43C0-AA5B-7F536BE3A482}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{5D61211E-6DBA-47D9-B3AF-74A45FCB0DB8}" = dir=in | app=c:\program files (x86)\easybits for kids\ezdesktop.exe | 
"{6950E39C-EDDE-48ED-803B-AFA37A728E35}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6C5795D1-7651-4C59-A99D-4F6F02A79A80}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{6D7024D4-B10B-4796-BF2F-8AFE79012524}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6E499203-9D08-4297-9481-7D921267D99D}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{79747B53-26CC-4A57-9C22-A92E9B87B907}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{79A997A8-9141-4074-B5DA-405663C058E4}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{A1B6D1E6-90D6-46DD-B0DF-22AC7B307577}" = protocol=17 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe | 
"{A32CEAAC-841B-45AA-8EAC-E8D3D7A256CE}" = protocol=6 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe | 
"{A73F60B0-30FC-42CE-B56C-55C93AF1C36A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{B414E4BA-3C6C-4334-9849-067ED406EAE4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C0468D2E-F0CE-4DCC-B150-541E975D1418}" = protocol=17 | dir=in | app=c:\program files (x86)\roxio\roxionow player\rnowshell.exe | 
"{C1EE13FB-359B-4AB5-9A0A-C33B603718A0}" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars republic commando\gamedata\system\swrepubliccommando.exe | 
"{C7F8C1A2-AFDB-4409-A1AC-241A0C79772F}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{D2D3698C-8601-4A29-B61F-7FAE0EA135A0}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D9584E8F-AACF-4CAA-9CF1-25469393B032}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{DF16B107-9921-4B65-8631-3EA51CEF3745}" = protocol=6 | dir=in | app=c:\program files (x86)\roxio\roxionow player\rnowshell.exe | 
"{E2180426-1110-45A4-AE1C-3F5268B60CA8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{E474C533-9C14-47FE-9A9D-289EC47334A5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{E81D51D7-784E-44C7-8A2B-3A97E4F3D7D3}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{F28BFE36-29AA-4182-90CC-00B3CC5968A4}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{F4B2EAA7-EA29-47E0-993E-8A8DB65CDF91}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{F7FEF457-EE18-49B9-AE04-E1B1882E6135}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{F85DA7DA-C3B1-4757-8417-BEB538F455FF}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\rnow.exe | 
"{F9E73C42-2F03-4097-AB0E-43C799924CC1}" = protocol=6 | dir=in | app=c:\program files (x86)\gamespy arcade\aphex.exe | 
"{FA270CB6-6917-41CB-9BA3-A67B6BFE94CB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{FA8E5A67-21CF-4C52-A15C-415D3D2003E9}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"TCP Query User{0D2CE725-5690-4B62-8C98-1CF623C4DAB5}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe | 
"TCP Query User{0FA81FEC-A3A7-4E73-9FF0-AF467854BA24}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"TCP Query User{28D0CF05-24FE-40D1-B7A9-553E8A897B9F}C:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe | 
"TCP Query User{3C785F29-8ABE-4CA5-9B21-F9D70FEBB2C5}C:\program files (x86)\electronic arts\medal of honor\mp\mohmpgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor\mp\mohmpgame.exe | 
"TCP Query User{51B2F40F-C5DA-45A4-8FED-F6E057E30EB8}C:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe | 
"TCP Query User{B7D2E007-9331-4F56-80C4-658B9E02F43D}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"TCP Query User{FE5FA9A2-D3BB-43F9-9046-C671D8A3DAAC}C:\program files (x86)\electronic arts\medal of honor\binaries\moh.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor\binaries\moh.exe | 
"UDP Query User{2D8A73C6-0990-4CFF-ACFC-40BAFE614C2D}C:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe | 
"UDP Query User{6AD67837-BCAB-4CCF-8B4B-213473BB1804}C:\program files (x86)\electronic arts\medal of honor\binaries\moh.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor\binaries\moh.exe | 
"UDP Query User{787B513C-C3FD-40A3-AB36-D656271EC690}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe | 
"UDP Query User{79EE37D8-2FBF-4E9A-B219-4023F1AE12BB}C:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warner bros\batman - arkham asylum goty edition\binaries\shippingpc-bmgame.exe | 
"UDP Query User{A8640324-772D-462D-B56C-34F7E0FC2791}C:\program files (x86)\electronic arts\medal of honor\mp\mohmpgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor\mp\mohmpgame.exe | 
"UDP Query User{DFE99FB6-2FA7-418A-BFA8-BCDDD4698009}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"UDP Query User{E02C0C4A-414B-4279-985B-594F1AC26C76}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{054EF02F-95D8-48F4-9EEB-2F9CE3072ED8}" = AuthenTec TrueAPI
"{1876545F-47B1-80A7-2F98-D175DA98A392}" = ccc-utility64
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{25FBDA9A-E868-4B3B-B9FF-D923818511A1}" = Intel(R) PROSet/Wireless WiFi Software
"{26A24AE4-039D-4CA4-87B4-2F86416024FF}" = Java(TM) 6 Update 24 (64-bit)
"{2856A1C2-70C5-4EC3-AFF7-E5B51E5530A2}" = HP Client Services
"{28EF7372-9087-4AC3-9B9F-D9751FCDF830}" = Intel(R) Wireless Display
"{3BF3599D-7F28-C60B-1C5D-82BFD4E5EF33}" = AMD Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4BDE7544-0A08-4AD9-8A8F-4B7944471C36}" = iTunes
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{79174AF2-6CB1-42F5-981E-66DCA49391D0}" = Validity WBF DDK
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUS_{1779650B-2E44-4A19-8DF6-3866D645764A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-1000-0000000FF1CE}_Office14.PROPLUS_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010
"{90140000-0043-0409-1000-0000000FF1CE}_Office14.PROPLUS_{FCD1C311-8B02-4DBD-BA46-1079C629577E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-1000-0000000FF1CE}_Office14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-1000-0000000FF1CE}_Office14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{DFB497E0-CE3F-40FC-9596-FC7A48775DE4}" = HP 3D DriveGuard
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics TouchPad Driver
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{07AF6797-0CF6-FFBB-FDE3-CC51D3B5F342}" = Catalyst Control Center Graphics Previews Common
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08523528-BA2F-43BB-87E3-252C081872B9}" = Catalyst Control Center - Branding
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0DD706AF-B542-438C-999E-B30C7F625C8D}" = Intel(R) WiDi
"{0EDEB615-1A60-425E-8306-0E10519C7B55}" = RoxioNow Player
"{120262A6-7A4B-4889-AE85-F5E5688D3683}" = HP MovieStore
"{120F4744-38ED-FB1E-F313-A7A7E419A71E}" = CCC Help Chinese Traditional
"{135AAD7D-FB4A-800C-E7F2-58D02B936C38}" = Catalyst Control Center Localization All
"{178EA4CE-9622-76B4-308F-73FEC150DBB4}" = CCC Help Norwegian
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1AE85A98-397D-B62B-0D21-3F7DC93F4F3A}" = CCC Help Swedish
"{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}" = Bing Bar
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{210A03F5-B2ED-4947-B27E-516F50CBB292}" = HP Setup
"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 32
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{339F5A1B-8DB7-E4F8-0A07-EF35B60EBE53}" = CCC Help Portuguese
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield Bad Company 2
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{412308A1-73B4-A26B-57A8-BE827ADA9BF9}" = Catalyst Control Center Profiles Mobile
"{415030B8-3E8B-462A-8C03-41D95AA3AB3B}" = Medal of Honor (TM)
"{49BF48CC-ABB6-4795-9B35-B5DE005D8612}" = Pinnacle Game Profiler
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6937DA-DABE-31C9-C433-D67C640B7BED}" = CCC Help Italian
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{52594AFD-2797-356A-CC6F-57047524F1E1}" = CCC Help Japanese
"{53B17A98-5BF0-40BC-AAFF-850A357975AC}" = HP Quick Launch
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{56709CD7-06E8-B205-56A6-110DC5090A9A}" = PX Profile Update
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5C7F3D35-9018-A839-3B9C-E50B517B9458}" = CCC Help Hungarian
"{5CA75999-3DDE-7B58-3394-38A4E82D8466}" = Catalyst Control Center InstallProxy
"{5E63C0AB-19B0-47D4-842E-6B324EB0614B}" = HP Connection Manager
"{60CD8628-DDD9-B498-A368-D01A4793CCFA}" = CCC Help Dutch
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6866ADAD-71F1-D306-B979-6371D8C4411A}" = CCC Help German
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76D0E682-0183-E295-FA4C-DA6763669CCA}" = CCC Help English
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7ECF4252-E10A-4BCC-AF34-A21E6F9A7852}" = Cisco NAC Agent 
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83A375B6-6FC2-4F8A-948E-E506DB9DCDF0}" = HP Documentation
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DB85CDE-EC37-A333-05B1-23846D03F08D}" = CCC Help Russian
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F6285DB-2536-7EDE-23D2-CA10E2D6399C}" = CCC Help French
"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MovieStore
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9368DDD5-CE7F-4BD7-A83A-F00FABE338EC}" = Blio
"{962CB079-85E6-405F-8704-1C62365AE46F}" = HP Software Framework
"{98397040-58E9-47CD-95D7-7086023D75A5}" = DriverUpdate
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA16FAFC-CCD3-899B-2860-A709BDE31CDC}" = CCC Help Korean
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.4) MUI
"{AE856388-AFAD-4753-81DF-D96B19D0A17C}" = HP Setup Manager
"{B357B619-36C5-7C1E-063B-92677609CB14}" = CCC Help Danish
"{BCFAA37D-A6DB-43BF-A351-43F183E52D07}" = HP SimplePass 2011
"{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}" = Energy Star Digital Logo
"{BDEB2CF5-C1C5-BCC8-DF29-1EE4CF389F9D}" = CCC Help Turkish
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{C5AC39F1-001D-4338-84C6-35109525588A}" = TweetDeck
"{C5D8263A-4D81-8979-91DE-B10120642FC5}" = Catalyst Control Center
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CEEE5B98-96F1-2F1E-0627-853C5F98DE41}" = CCC Help Finnish
"{CF48FF43-B417-637C-C804-0F285FD7ED05}" = CCC Help Spanish
"{CF6A05D4-E715-BCF4-9ED2-A3307E386D28}" = CCC Help Czech
"{CFABC775-5386-4BA5-86B4-505BBD36E812}" = Batman: Arkham Asylum Game of the Year Edition
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}" = HP Power Manager
"{DB2C5E6A-CFDD-D6FD-480E-692EBEC17BFC}" = CCC Help Greek
"{DBCD5E64-7379-4648-9444-8A6558DCB614}" = Recovery Manager
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DFAE9340-E8BB-4433-9A08-C8334DAFE1B9}" = Star Wars Republic Commando
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E59E0B3D-F840-5910-DF8C-73CFA82613C2}" = CCC Help Polish
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E635F3DC-E92B-6E68-A2E7-BF77298E8584}" = PX Profile Update
"{E77268D6-5E7F-6DE1-34AC-A1A276710C21}" = CCC Help Chinese Standard
"{EA450D5D-95EA-4FD0-B8B0-6D8E68FBE2C7}" = GameStop App
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ED1BD69A-07E3-418C-91F1-D856582581BF}" = HP On Screen Display
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Display Audio Driver
"{F5C7356C-463C-75BC-E4E0-324E4516EB73}" = CCC Help Thai
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote v. 4.2.2
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F909BB1B-3FC1-4EDA-AF1F-8F1A89163591}" = BlackBerry Desktop Software 6.1
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVG Secure Search" = AVG Security Toolbar
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"Battlefield Bad Company 2" = Battlefield Bad Company 2
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"EasyBits Magic Desktop" = Magic Desktop
"Game Booster_is1" = Game Booster 3
"GameSpy Arcade" = GameSpy Arcade
"GameStop App" = GameStop App
"HP DVB-T TV Tuner" = HP DVB-T TV Tuner 8.0.64.43
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Medal of Honor" = Medal of Honor
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"Origin" = Origin
"ProInst" = Intel PROSet Wireless
"PunkBusterSvc" = PunkBuster Services
"Wajam" = Wajam
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials
"WT087328" = Blackhawk Striker 2
"WT087330" = Bounce Symphony
"WT087335" = Build-a-lot 2
"WT087343" = Dora's World Adventure
"WT087393" = Mah Jong Medley
"WT087394" = Penguins!
"WT087395" = Poker Superstars III
"WT087396" = Polar Bowler
"WT087397" = Polar Golfer
"WT087415" = Wheel of Fortune 2
"WT087536" = Diner Dash 2 Restaurant Rescue
"WT089307" = Virtual Villagers 4 - The Tree of Life
"WT089308" = Blasterball 3
"WT089328" = Farm Frenzy
"WT089359" = Cake Mania
"WT089362" = Agatha Christie - Peril at End House
"WT089453" = Bejeweled 2 Deluxe
"WT089454" = Chuzzle Deluxe
"WT089455" = Zuma Deluxe
"WT089457" = Slingo Supreme
"WT089458" = Plants vs. Zombies - Game of the Year
"WT089470" = FATE - The Traitor Soul
"WT089484" = Namco All-Stars PAC-MAN
"WT089496" = Mystery P.I. - Stolen in San Francisco
"WT089498" = Bejeweled 3
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = ooVoo toolbar, powered by Ask.com Updater
"ActiveTouchMeetingClient" = Cisco WebEx Meetings
"Google Chrome" = Google Chrome
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05-Aug-12 10:08:09 AM | Computer Name = JustADUit-HP | Source = System Restore | ID = 8193
Description = 
 
Error - 05-Aug-12 10:08:09 AM | Computer Name = JustADUit-HP | Source = System Restore | ID = 8211
Description = 
 
Error - 05-Aug-12 1:25:47 PM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 05-Aug-12 4:16:56 PM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 06-Aug-12 5:11:48 AM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 06-Aug-12 5:11:37 PM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 07-Aug-12 8:11:46 AM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 07-Aug-12 8:22:03 AM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 07-Aug-12 7:48:53 PM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 08-Aug-12 6:23:25 AM | Computer Name = JustADUit-HP | Source = WinMgmt | ID = 10
Description = 
 
[ Hewlett-Packard Events ]
Error - 10-Apr-12 11:46:30 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 07-May-12 2:01:28 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 14-Jun-12 1:51:49 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467261   at HP.SupportAssistant.Common.CustomerExperience.HPSASession.AddNavigationProperties()
Message:
 Object reference not set to an instance of an object.  StackTrace:   at HP.SupportAssistant.Common.CustomerExperience.HPSASession.AddNavigationProperties()
Source:
 HP.SupportAssistant.Common    Name: HPSF.exe  Version: 06.00.01.01  Path: C:\Program Files
 (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe  Format: en-US  RAM: 6091  Ram Utilization:
 30  TargetSite: HP.SupportFramework.HPSFReporting._Property[] AddNavigationProperties()

 
Error - 14-Jun-12 11:56:40 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467261   at HP.SupportAssistant.Common.CustomerExperience.HPSASession.AddNavigationProperties()
Message:
 Object reference not set to an instance of an object.  StackTrace:   at HP.SupportAssistant.Common.CustomerExperience.HPSASession.AddNavigationProperties()
Source:
 HP.SupportAssistant.Common    Name: HPSF.exe  Version: 06.00.01.01  Path: C:\Program Files
 (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe  Format: en-US  RAM: 6091  Ram Utilization:
 30  TargetSite: HP.SupportFramework.HPSFReporting._Property[] AddNavigationProperties()

 
Error - 16-Jun-12 5:11:19 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 11-Jul-12 12:39:10 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 11-Jul-12 12:45:32 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 11-Jul-12 12:47:54 PM | Computer Name = JustADUit-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 07-Aug-12 8:06:40 PM | Computer Name = JustADUit-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateDetail(String
 category)     at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetectCore()

   at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: Failed to perform update.  StackTrace:   at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateDetail(String
 category)     at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetectCore()

   at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager  InnerException.Message:
 Object '/0e4fd1b7_a300_417d_a70e_0db51824bb89/tvz9xbyuu6blgkdiignwjsvb_5.rem' has
 been disconnected or does not exist at the server.    Name: hpsa_service.exe  Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 en-US  RAM: 6091  Ram Utilization: 40  TargetSite: Void UpdateDetail(System.String)  
 
Error - 14-Aug-12 3:50:42 PM | Computer Name = JustADUit-HP | Source = HPSFMsgr.exe | ID = 4000
Description = 
 
[ HP Connection Manager Events ]
Error - 12-Aug-12 9:12:12 AM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 08:12:12.569|00001740|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 9:12:17 AM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 08:12:17.108|00001740|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 9:12:17 AM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 08:12:17.700|00001740|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 12:59:45 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 11:59:45.069|00001D38|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 8:56:59 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 19:56:59.948|000005B8|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 8:57:07 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 19:57:07.531|000005B8|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 9:16:23 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 20:16:23.180|00001418|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 10:04:02 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 21:04:02.506|00001AD4|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 10:04:08 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 21:04:08.516|00001AD4|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 12-Aug-12 10:04:10 PM | Computer Name = JustADUit-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/12 21:04:10.856|00001AD4|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
[ HP Software Framework Events ]
Error - 08-May-12 1:41:23 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-08 00:41:23.933|00001954|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 08-May-12 2:12:24 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-08 01:12:24.327|00001874|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 08-May-12 1:06:02 PM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-08 12:06:02.494|00000804|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:39:42 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-09 23:39:42.764|000016C4|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:47:21 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012/05/09 23:47:21.900|0000031C|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:50:37 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-09 23:50:37.099|000015D8|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:50:40 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-09 23:50:40.635|00001B1C|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:50:47 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-09 23:50:47.146|000019D4|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:50:50 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-09 23:50:50.476|00000428|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 10-May-12 12:50:57 AM | Computer Name = JustADUit-HP | Source = CaslWmi | ID = 5
Description = 2012-05-09 23:50:57.582|000012DC|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
[ System Events ]
Error - 14-Aug-12 3:56:16 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the Ancillary Function
 Driver for Winsock service which failed to start because of the following error:
   %%31
 
Error - 14-Aug-12 3:56:16 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The Network Store Interface Service service depends on the NSI proxy
 service driver. service which failed to start because of the following error:   %%31
 
Error - 14-Aug-12 3:56:17 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The Workstation service depends on the Network Store Interface Service
 service which failed to start because of the following error:   %%1068
 
Error - 14-Aug-12 3:56:17 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The IP Helper service depends on the Network Store Interface Service
 service which failed to start because of the following error:   %%1068
 
Error - 14-Aug-12 3:56:17 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The SMB MiniRedirector Wrapper and Engine service depends on the Redirected
 Buffering Sub Sysytem service which failed to start because of the following error:
   %%31
 
Error - 14-Aug-12 3:56:17 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector
 Wrapper and Engine service which failed to start because of the following error:
   %%1068
 
Error - 14-Aug-12 3:56:17 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector
 Wrapper and Engine service which failed to start because of the following error:
   %%1068
 
Error - 14-Aug-12 3:56:17 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7001
Description = The Network Location Awareness service depends on the Network Store
 Interface Service service which failed to start because of the following error:
   %%1068
 
Error - 14-Aug-12 3:56:19 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   AFD  avipbb  avkmgr  DfsC  discache  NetBIOS  NetBT  nsiproxy  Psched  rdbss  spldr  tdx  vwififlt  Wanarpv6
WfpLwf
 
Error - 14-Aug-12 4:05:57 PM | Computer Name = JustADUit-HP | Source = Service Control Manager | ID = 7034
Description = The PinnacleUpdate Service service terminated unexpectedly.  It has
 done this 1 time(s).
 
 
< End of report >
         

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
SRV - (vToolbarUpdater11.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox 
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF 
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF 
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms} 
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms} 
IE:64bit: - HKLM\..\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox 
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF 
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF 
IE - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms} 
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms} 
IE - HKLM\..\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=hp 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110014&babsrc=SP_ss&mntrId=ba5974c600000000000074e50b1d2801 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=dsp&q={searchTerms} 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms} 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms} 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
CHR - homepage: http://isearch.avg.com/?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.7&sap=hp 
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={21BAA7FD-5560-4121-86C0-17D6EF5ABF64}&mid=36be2aad91d447d0864dd967196355a7-f1b1d432f6a96d12c75f2510671d5925d5a6c653&lang=en&ds=ts026&pr=sa&d=2012-05-16 22:14:36&v=11.1.0.12&sap=dsp&q={searchTerms} 
O2 - BHO: (ooVoo toolbar, powered by Ask.com) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (ooVoo toolbar, powered by Ask.com) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. 
O3 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKU\S-1-5-21-2750785616-3380480199-1391761155-1000..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) 
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32) 
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 

@Alternate Data Stream - 128 bytes -> C:\Windows\SysWow64\zlib.dll:SummaryInformation 
@Alternate Data Stream - 128 bytes -> C:\Windows\SysWow64\zlib.dll:DocumentSummaryInformation 
[2012-08-07 08:43:57 | 000,000,000 | ---D | M] (ooVoo toolbar, powered by Ask.com) -- C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com 
[2012-08-07 08:43:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com 
[2012-08-07 08:43:49 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Local\APN 
[2012-08-14 06:53:47 | 000,000,000 | ---D | C] -- C:\Users\JustADUit\AppData\Roaming\hellomoto 
[2012-08-14 16:43:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2750785616-3380480199-1391761155-1000UA.job 
[2012-08-14 16:28:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
[2012-08-14 15:06:11 | 000,000,426 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job 
[2012-08-14 15:06:05 | 000,015,672 | ---- | M] () -- C:\Windows\SysNative\drivers\SWDUMon.sys 
[2012-08-10 14:59:58 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForJUSTADUIT-HP$.job 
[2012-08-08 05:23:18 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForJustADUit.job 
[2012-07-22 00:43:00 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2750785616-3380480199-1391761155-1000Core.job 
:Files


ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Hier das habe ich nach dem FIX bekommen:

All processes killed
========== OTL ==========
Service vToolbarUpdater11.2.0 stopped successfully!
Service vToolbarUpdater11.2.0 deleted successfully!
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827}\ not found.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}\ not found.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3}\ not found.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}\ not found.
Registry key HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4F9B109-1257-4C90-A50E-58708F7D9BEB}\ not found.
HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to remove the default_search_provider items.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files (x86)\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-2750785616-3380480199-1391761155-1000\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
ADS C:\Windows\SysWow64\zlib.dll:SummaryInformation deleted successfully.
ADS C:\Windows\SysWow64\zlib.dll:DocumentSummaryInformation deleted successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com\searchplugins folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com\defaults folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com\chrome\content folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com\chrome folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\extensions\toolbar@ask.com folder moved successfully.
C:\Program Files (x86)\Ask.com\Updater folder moved successfully.
C:\Program Files (x86)\Ask.com\assets\oobe folder moved successfully.
C:\Program Files (x86)\Ask.com\assets folder moved successfully.
C:\Program Files (x86)\Ask.com folder moved successfully.
C:\Users\JustADUit\AppData\Local\APN\GoogleCRXs folder moved successfully.
C:\Users\JustADUit\AppData\Local\APN folder moved successfully.
C:\Users\JustADUit\AppData\Roaming\hellomoto folder moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2750785616-3380480199-1391761155-1000UA.job moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\Windows\Tasks\DriverUpdate Startup.job moved successfully.
C:\Windows\SysNative\drivers\SWDUMon.sys moved successfully.
C:\Windows\Tasks\HPCeeScheduleForJUSTADUIT-HP$.job moved successfully.
File C:\Windows\tasks\HPCeeScheduleForJustADUit.job not found.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2750785616-3380480199-1391761155-1000Core.job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\JustADUit\Desktop\cmd.bat deleted successfully.
C:\Users\JustADUit\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: JustADUit
->Temp folder emptied: 49194683 bytes
->Temporary Internet Files folder emptied: 37413501 bytes
->Java cache emptied: 5839100 bytes
->FireFox cache emptied: 60154902 bytes
->Google Chrome cache emptied: 562044536 bytes
->Flash cache emptied: 57236 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 234059335 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes
RecycleBin emptied: 123426 bytes
 
Total Files Cleaned = 905.00 mb
 
 
OTL by OldTimer - Version 3.2.57.0 log created on 08152012_071530

Files\Folders moved on Reboot...
File\Folder C:\Users\JustADUit\AppData\Local\Temp\OICE_F0355777-A276-4D7E-9D4E-EAC2191FEE18.0\E1CC8D0C. not found!
C:\Users\JustADUit\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\JustADUit\AppData\Local\Temp\OICE_F0355777-A276-4D7E-9D4E-EAC2191FEE18.0\E1CC8D0C. not found!
File C:\Users\JustADUit\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
         

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Schon mal vielen Dank, der Rechner laeuft jetzt schon etwas besser! Malwarebytes hat jetzt keinen Virus mehr gefunden, das war der Log:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.15.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
JustADUit :: JUSTADUIT-HP [administrator]

Protection: Enabled

15-Aug-12 7:39:05 AM
mbam-log-2012-08-15 (07-39-05).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 343215
Time elapsed: 58 minute(s), 36 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
         

Und fuer AdwCleaner:

# AdwCleaner v1.608 - Logfile created 08/15/2012 at 09:11:29
# Updated 27/05/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : JustADUit - JUSTADUIT-HP
# Running from : C:\Users\JustADUit\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : WajamUpdater

***** [Files / Folders] *****

Folder Found : C:\Users\JustADUit\AppData\Local\Babylon
Folder Found : C:\Users\JustADUit\AppData\Local\Ilivid Player
Folder Found : C:\Users\JustADUit\AppData\Local\Wajam
Folder Found : C:\Users\JustADUit\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\JustADUit\AppData\Roaming\Babylon
Folder Found : C:\Users\JustADUit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
Folder Found : C:\ProgramData\Babylon
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\Program Files (x86)\Wajam
Folder Found : C:\Program Files (x86)\Yontoo
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

***** [Registry] *****

Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\Ask.com.tmp
Key Found : HKCU\Software\APN
Key Found : HKCU\Software\Wajam
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\Babylon
Key Found : HKLM\SOFTWARE\Wajam
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
[x64] Key Found : HKCU\Software\Ask.com
[x64] Key Found : HKCU\Software\Ask.com.tmp
[x64] Key Found : HKCU\Software\APN
[x64] Key Found : HKCU\Software\Wajam
[x64] Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
[x64] Key Found : HKLM\SOFTWARE\Tarma Installer
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
[x64] Key Found : HKLM\SOFTWARE\Classes\S
[x64] Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO
[x64] Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
[x64] Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
[x64] Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v11.0 (de)

Profile name : default-1344342359944 [Profil par défaut]
File : C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\prefs.js

Found : user_pref("extensions.toolbar@ask.com.install-event-fired", true);

-\\ Google Chrome v21.0.1180.77

File : C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found :                "scriptable_host": [ "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*.childrenschorus.[...]
Found :                   "matches": [ "*://*.google.com/*", "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*[...]
Found :                "update_url": "hxxp://apnmedia.ask.com/media/toolbar/supertoolbar/chrome/manifest.php[...]
Found :                "explicit_host": [ "hxxp://*.wajam.com/*", "hxxp://*/*", "hxxps://*/*" ],
Found :                "name": "Wajam",
Found :                "permissions": [ "hxxp://*.wajam.com/*", "bookmarks", "tabs", "hxxp://*/*", "hxxps://[...]
Found :                "update_url": "hxxp://www.wajam.com/update/Chrome/chrome_addon_updates.xml",
Found :          "name": "Wajam",
Found :          "name": "Wajam"

*************************

AdwCleaner[R1].txt - [12372 octets] - [14/08/2012 16:34:39]
AdwCleaner[R2].txt - [11372 octets] - [15/08/2012 09:11:29]

########## EOF - C:\AdwCleaner[R2].txt - [11501 octets] ##########
         

Sehr gut!

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Der Laptop noch ein bischen langsam beim Hochfahren, ist das normal? Der war vorher immer schneller, aber ansonsten laeuft der gut!

Logfile fuer Emisoft Anti-Malware:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 15-Aug-12 3:28:03 PM

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	15-Aug-12 3:30:16 PM

c:\program files (x86)\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\addins 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\action 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\firearms 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\gearbox 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\tfc 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\aq2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\battle 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\chaosdm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\freeze 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gloom 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gxmod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\holywars 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\jail 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\kots 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lfiredm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lithium2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lmctf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\pball 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\q2comp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\qpong 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\ra2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\sconfig 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\tourney 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\alliance 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\beryllium 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\instagib 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\jailbreak 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\matchmod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\osp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3comp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3f 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3ut2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\rocketarena3 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\wfa 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\arena 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ch 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfb 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfplus 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\fr 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\mt 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\open cal 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\rpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\tac 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\rocketarena 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\swat 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\icons 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\portraits 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_common 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_demospy 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_fplanet 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gnews 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gspyder 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins\(default3) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\classic 	gefunden: Trace.File.gamespy arcade!E1
c:\users\justaduit\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\arcres.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\4dca9208.dat 	gefunden: Trace.File.gamespy arcade!E1
c:\users\justaduit\desktop\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\dat.bmp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\aphex.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_bannerbg.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_loading.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_logo.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_news.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade - debug.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade website.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\fpupdate.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade help.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy.com gaming's homepage.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsapak.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsws.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gslan.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\install.log 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\register gamespy arcade.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\pw32.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\readme.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\rptcrash.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab+.tga 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\ws_default.html 	gefunden: Trace.File.gamespy arcade!E1
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring 	gefunden: Trace.Registry.gamespy arcade!E1
C:\Program Files (x86)\PowerUp Software\Pinnacle Game Profiler\pinnacle.exe 	gefunden: Backdoor.Win32.Silby!E2
C:\HP\Bin\EndProcess.exe 	gefunden: Riskware.Win32.KillApp!E1

Gescannt	601361
Gefunden	122

Scan Ende:	15-Aug-12 11:19:28 PM
Scan Zeit:	7:49:12

C:\HP\Bin\EndProcess.exe	Quarantäne Riskware.Win32.KillApp!E1
C:\Program Files (x86)\PowerUp Software\Pinnacle Game Profiler\pinnacle.exe	Quarantäne Backdoor.Win32.Silby!E2
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir	Quarantäne Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname	Quarantäne Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring	Quarantäne Trace.Registry.gamespy arcade!E1
c:\program files (x86)\gamespy arcade	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\addins	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike\frontline	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\action	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\cstrike	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\firearms	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\frontline	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\gearbox	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\tfc	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\aq2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\battle	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\chaosdm	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\duel	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\freeze	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gloom	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gxmod	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\holywars	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\jail	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\kots	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lfiredm	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lithium2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lmctf	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\pball	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\q2comp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\qpong	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\ra2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\requiem	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\sconfig	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\tourney	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wf	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wod	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\alliance	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\beryllium	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\excessive	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\instagib	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\jailbreak	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\matchmod	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\osp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3comp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3f	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3ut2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\requiem	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\rocketarena3	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\wfa	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\arena	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ch	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctf	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfb	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfplus	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dd	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dm	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\duel	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\fr	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\mt	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\open cal	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\rpg	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\tac	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\excessive	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\rocketarena	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\swat	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\icons	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\portraits	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles\(default)	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_common	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_demospy	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_fplanet	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gnews	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gspyder	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins\(default3)	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\(default)	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\classic	Quarantäne Trace.File.gamespy arcade!E1
c:\users\justaduit\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\arcres.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\4dca9208.dat	Quarantäne Trace.File.gamespy arcade!E1
c:\users\justaduit\desktop\gamespy arcade.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\dat.bmp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\aphex.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.gif	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.html	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_bannerbg.jpg	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_loading.gif	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_logo.jpg	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_news.html	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade - debug.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade website.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\fpupdate.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade help.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy.com gaming's homepage.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsapak.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsws.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gslan.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\install.log	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\register gamespy arcade.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\pw32.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\readme.html	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\rsrc.dir	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\rptcrash.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab.psd	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab+.tga	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\rsrc.dir	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\service_tab.psd	Quarantäne Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\ws_default.html	Quarantäne Trace.File.gamespy arcade!E1

Quarantäne	122
         

Und fuer ADW Cleaner:

# AdwCleaner v1.608 - Logfile created 08/15/2012 at 15:04:12
# Updated 27/05/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : JustADUit - JUSTADUIT-HP
# Running from : C:\Users\JustADUit\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : WajamUpdater

***** [Files / Folders] *****

Folder Deleted : C:\Users\JustADUit\AppData\Local\Babylon
Folder Deleted : C:\Users\JustADUit\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\JustADUit\AppData\Local\Wajam
Folder Deleted : C:\Users\JustADUit\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\JustADUit\AppData\Roaming\Babylon
Folder Deleted : C:\Users\JustADUit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Program Files (x86)\Wajam
Folder Deleted : C:\Program Files (x86)\Yontoo
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

***** [Registry] *****

Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\Ask.com.tmp
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Wajam
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\Wajam
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
[x64] Key Deleted : HKLM\SOFTWARE\Tarma Installer
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v11.0 (de)

Profile name : default-1344342359944 [Profil par défaut]
File : C:\Users\JustADUit\AppData\Roaming\Mozilla\Firefox\Profiles\wm43cqbf.default-1344342359944\prefs.js

Deleted : user_pref("extensions.toolbar@ask.com.install-event-fired", true);

-\\ Google Chrome v21.0.1180.79

File : C:\Users\JustADUit\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted :                "scriptable_host": [ "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*.childrenschorus.[...]
Deleted :                   "matches": [ "*://*.google.com/*", "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*[...]
Deleted :                "update_url": "hxxp://apnmedia.ask.com/media/toolbar/supertoolbar/chrome/manifest.php[...]
Deleted :                "explicit_host": [ "hxxp://*.wajam.com/*", "hxxp://*/*", "hxxps://*/*" ],
Deleted :                "name": "Wajam",
Deleted :                "permissions": [ "hxxp://*.wajam.com/*", "bookmarks", "tabs", "hxxp://*/*", "hxxps://[...]
Deleted :                "update_url": "hxxp://www.wajam.com/update/Chrome/chrome_addon_updates.xml",
Deleted :          "name": "Wajam",
Deleted :          "name": "Wajam"

*************************

AdwCleaner[R1].txt - [12372 octets] - [14/08/2012 16:34:39]
AdwCleaner[R2].txt - [11409 octets] - [15/08/2012 09:11:29]
AdwCleaner[S1].txt - [8753 octets] - [15/08/2012 15:04:12]

########## EOF - C:\AdwCleaner[S1].txt - [8881 octets] ##########
         

Sehr gut!

Lasse die Funde loeschen, dann:

Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

So das habe ich bekommen

ESET LOG:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c0726bd113fecb41a8587504b73903a0
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-18 08:31:46
# local_time=2012-08-18 03:31:46 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 8164105 8164105 0 0
# compatibility_mode=5893 16776574 100 94 54074371 96859032 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=190271
# found=1
# cleaned=1
# scan_time=6324
C:\Documents and Settings\JustADUit\Desktop\Alte Firefox-Daten\extensions\plugin@yontoo.com\content\overlay.js	Win32/Adware.Yontoo application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 6 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Das habe ich bekommen:


PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
Chrome 21.0.1180.83 ist aktuell
Flash 11,3,31,230 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version!

Java (1,7,0,6) ist aktuell.
undefined

Bei Google Chrome bekomme ich das hier:

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
Chrome 21.0.1180.83 ist aktuell
Flash 11,3,31,230 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version!

Java (1,7,0,6) ist aktuell.
undefined



Aber bei Mozilla Firefox bekomme ich das hier:


PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,6) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.


PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,6) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.


PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,6) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.


PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,6) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.



PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,6) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.

eimal haette auch gereicht.


Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Uninstall.
• Bestätige mit Ja.

Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

• Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
• Speichere es auf Deinem Desktop.
• Doppelklick auf OTL.exe um das Programm auszuführen.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Klicke auf den Button "Bereinigung"
• OTL fragt eventuell nach einem Neustart.
  Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

• Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
• temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?

Sorry mein Laptop hat gespinnt und wusste nich wie ich das wieder loeschen konnte. Vielen Dank fuer die Hilfe! Laeuft alles wieder bestens!!