Ich vermute TR/Jorik.SpyEyes.AB auf meinem System

Castor Troy · 29.08.2012, 11:02

Guten Tag zusammen!

Ich benötige Hilfe! Seit zwei Tagen kommt aus meinen PC Lautsprechern Musik, Mausklicken und ähnliches ohne mein zutun. Nach einer Suche im Internet bin ich der Meinung, dass es TR/Jorik.SpyEyes.AB sein könnte. Ganz sicher bin ich mir natürlich nicht, zumal weder Avira noch Malwarebytes etwas finden kann.

Evtl. könnte sich ja jemand meiner annehmen und mir bitte zur Seite stehen?

Zitat:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.29.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Homebase :: HOMEBASE-PC [Administrator]

Schutz: Deaktiviert

29.08.2012 11:55:05
mbam-log-2012-08-29 (11-55-05).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 192704
Laufzeit: 1 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg · 29.08.2012, 11:24

hi
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Castor Troy · 29.08.2012, 11:52

Hallo markusg,

vielen Dank für die schnelle Antwort. Ich hat OTL nach Deinen Angaben laufen lassen, hier die Log´s:
OTL.txt:

Code:

ATTFilter

OTL logfile created on: 29.08.2012 12:36:09 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Homebase\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,94 Gb Total Physical Memory | 4,41 Gb Available Physical Memory | 55,54% Memory free
15,87 Gb Paging File | 10,20 Gb Available in Paging File | 64,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 192,29 Gb Free Space | 41,30% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 71,87 Mb Free Space | 71,87% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 235,76 Gb Free Space | 50,62% Space Free | Partition Type: NTFS
Drive K: | 7,39 Gb Total Space | 3,39 Gb Free Space | 45,90% Space Free | Partition Type: FAT32
Drive L: | 29,77 Gb Total Space | 29,42 Gb Free Space | 98,81% Space Free | Partition Type: FAT32
 
Computer Name: HOMEBASE-PC | User Name: Homebase | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.29 11:52:51 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Homebase\Downloads\OTL.exe
PRC - [2012.07.31 13:46:54 | 004,407,808 | ---- | M] (Luis Cobian, CobianSoft) -- C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe
PRC - [2012.07.31 13:46:50 | 001,131,008 | ---- | M] (Luis Cobian, CobianSoft) -- C:\Program Files (x86)\Cobian Backup 11\cbService.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.18 18:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.05.05 16:51:00 | 000,025,600 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\Ctxfihlp.exe
PRC - [2010.05.05 16:46:12 | 001,212,928 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
PRC - [2009.02.23 11:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.01.30 02:41:12 | 004,254,560 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2009.03.26 14:46:42 | 000,148,480 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.08.22 22:17:15 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.04 00:34:09 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2012.08.03 14:26:10 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2012.07.31 13:46:50 | 001,131,008 | ---- | M] (Luis Cobian, CobianSoft) [Auto | Running] -- C:\Program Files (x86)\Cobian Backup 11\cbService.exe -- (CobianBackup11)
SRV - [2012.07.31 12:12:32 | 000,067,584 | ---- | M] (CobianSoft, Luis Cobian) [Auto | Running] -- C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe -- (cbVSCService11)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.14 02:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.02.23 11:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP4c\WNt500x64\Sandra.sys -- (SANDRA)
DRV:64bit: - [2012.07.18 18:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.18 18:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.18 18:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.05.05 18:37:46 | 001,561,688 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.05.05 18:37:36 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.05.05 18:37:28 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.05.05 18:37:20 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.05.05 18:37:14 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.05.05 18:37:06 | 000,686,808 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.05.05 18:36:56 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.05.05 18:36:46 | 001,417,304 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.05.05 18:36:46 | 001,417,304 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:64bit: - [2010.05.05 18:36:36 | 000,094,808 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:64bit: - [2010.05.05 18:36:36 | 000,094,808 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:64bit: - [2010.05.05 18:36:28 | 000,202,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:64bit: - [2010.05.05 18:36:28 | 000,202,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:64bit: - [2009.10.05 16:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.05 19:12:30 | 000,286,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1e6232e.sys -- (e1express)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb178?a=6R8CQWxtO2&i=26
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6R8CQWxtO2&i=26
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.de/"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.03 14:47:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.08.03 15:09:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.08.03 14:47:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Homebase\AppData\Roaming\mozilla\Extensions
[2012.08.28 11:32:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Homebase\AppData\Roaming\mozilla\Firefox\Profiles\h55l2vur.default\extensions
[2012.08.03 14:47:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Cobian Backup 11 interface] C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe (Luis Cobian, CobianSoft)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{586F42D8-89C5-4067-B017-6521EA204691}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: APSDaemon - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.29 12:31:44 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.08.29 12:30:53 | 000,000,000 | ---D | C] -- C:\Users\Homebase\Documents\Simply Super Software
[2012.08.29 12:30:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.08.29 12:30:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2012.08.29 12:30:48 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Simply Super Software
[2012.08.29 12:30:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.08.29 11:51:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.29 11:51:23 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.29 11:51:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.28 10:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cobian Backup 11
[2012.08.23 20:23:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2012.08.23 20:23:36 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012.08.23 13:40:22 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Malwarebytes
[2012.08.23 13:40:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.20 21:09:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.08.20 21:09:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.08.20 21:08:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Oracle
[2012.08.20 21:08:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.08.20 17:49:59 | 000,000,000 | ---D | C] -- C:\Users\Homebase\Application Data
[2012.08.17 14:00:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DiskSpeed32
[2012.08.13 22:59:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2012.08.13 22:59:56 | 000,000,000 | ---D | C] -- C:\Program Files\Recuva
[2012.08.13 21:36:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
[2012.08.13 21:31:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.08.13 21:31:32 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.08.13 21:29:01 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2012.08.12 18:43:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ActivePerl 5.14.2 Build 1402 (64-bit)
[2012.08.12 18:43:43 | 000,000,000 | ---D | C] -- C:\Perl64
[2012.08.10 02:23:56 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\AnvSoft
[2012.08.10 01:51:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EASEUS
[2012.08.10 01:48:03 | 000,000,000 | -HSD | C] -- C:\Boot
[2012.08.10 01:44:56 | 000,000,000 | ---D | C] -- C:\ProgramData\explauncher
[2012.08.10 01:44:55 | 000,000,000 | ---D | C] -- C:\ProgramData\launcher
[2012.08.10 01:44:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paragon Software
[2012.08.08 21:12:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniTool Partition Wizard Home Edition 7.5
[2012.08.08 21:12:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MiniTool Partition Wizard Home Edition 7.5
[2012.08.08 16:17:21 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Blender Foundation
[2012.08.08 16:16:42 | 000,000,000 | ---D | C] -- C:\Users\Homebase\.thumbnails
[2012.08.08 16:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Blender Foundation
[2012.08.08 11:14:34 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID
[2012.08.05 12:43:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2012.08.05 12:03:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012.08.04 15:22:28 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\NVIDIA
[2012.08.04 15:18:55 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2012.08.04 15:18:00 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.08.04 15:13:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.08.04 15:07:59 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Adobe
[2012.08.04 14:58:56 | 000,000,000 | ---D | C] -- C:\Users\Homebase\Documents\MAGIX Downloads
[2012.08.04 14:58:56 | 000,000,000 | ---D | C] -- C:\Users\Homebase\Documents\MAGIX
[2012.08.04 14:56:51 | 000,663,552 | ---- | C] (MAGIX AG) -- C:\Windows\SysWow64\mgxoschk.dll
[2012.08.04 14:53:38 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\MAGIX
[2012.08.04 14:53:36 | 000,000,000 | ---D | C] -- C:\Users\Homebase\Documents\MAGIX_MusicEditor
[2012.08.04 14:53:35 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Xara
[2012.08.04 14:53:32 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\MAGIX
[2012.08.04 14:53:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MAGIX Shared
[2012.08.04 14:52:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MAGIX
[2012.08.04 14:52:07 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.08.04 14:52:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MAGIX Services
[2012.08.04 00:38:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2012.08.04 00:38:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2012.08.04 00:38:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.08.04 00:29:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
[2012.08.04 00:29:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012.08.04 00:28:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2012.08.04 00:28:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.08.04 00:28:06 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012.08.04 00:28:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework
[2012.08.04 00:28:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2012.08.04 00:25:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2012.08.04 00:25:15 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.08.04 00:24:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2012.08.04 00:24:03 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Microsoft Help
[2012.08.04 00:23:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2012.08.04 00:23:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012.08.04 00:23:36 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012.08.03 19:01:43 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Apple Computer
[2012.08.03 18:21:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cobian Backup 11
[2012.08.03 17:00:53 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Thunderbird
[2012.08.03 17:00:53 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Thunderbird
[2012.08.03 15:44:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.08.03 15:25:58 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Apple Computer
[2012.08.03 15:20:55 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Avira
[2012.08.03 15:14:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.08.03 15:14:42 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.08.03 15:14:42 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.08.03 15:14:42 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.08.03 15:14:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.08.03 15:14:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.08.03 15:13:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.08.03 15:13:28 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2012.08.03 15:13:03 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.08.03 15:13:02 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.08.03 15:13:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.08.03 15:13:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.08.03 15:13:02 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012.08.03 15:12:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012.08.03 15:12:36 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Apple
[2012.08.03 15:11:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JDownloader
[2012.08.03 15:11:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2012.08.03 15:11:03 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012.08.03 15:11:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2012.08.03 15:10:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2012.08.03 15:10:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2012.08.03 15:10:18 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Skype
[2012.08.03 15:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.08.03 15:10:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.08.03 15:10:11 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012.08.03 15:10:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.08.03 15:09:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.08.03 15:08:31 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\WinRAR
[2012.08.03 15:08:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.08.03 15:08:30 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.08.03 15:08:12 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.08.03 15:07:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\uTorrent
[2012.08.03 15:07:10 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\uTorrent
[2012.08.03 15:07:09 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.08.03 15:06:58 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.08.03 15:06:37 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Macromedia
[2012.08.03 15:06:37 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Macromedia
[2012.08.03 15:06:37 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Adobe
[2012.08.03 15:06:32 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.08.03 15:06:29 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.08.03 15:06:28 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.08.03 14:54:52 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.08.03 14:47:14 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Mozilla
[2012.08.03 14:47:14 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Mozilla
[2012.08.03 14:47:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.08.03 14:47:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.08.03 14:47:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.08.03 14:26:15 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Creative Installation Information
[2012.08.03 14:26:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative
[2012.08.03 14:26:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
[2012.08.03 14:26:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative Labs Shared
[2012.08.03 14:26:05 | 000,000,000 | ---D | C] -- C:\Program Files\Creative
[2012.08.03 14:26:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative
[2012.08.03 14:26:01 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.08.03 14:26:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012.08.03 14:25:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Creative
[2012.08.03 14:25:27 | 000,466,520 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2012.08.03 14:25:27 | 000,445,016 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2012.08.03 14:25:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenAL
[2012.08.03 14:25:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\data
[2012.08.03 14:25:19 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\data
[2012.08.03 14:23:41 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.08.03 14:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012.08.03 14:05:26 | 000,000,000 | R--D | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.08.03 14:05:26 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Searches
[2012.08.03 14:05:26 | 000,000,000 | R--D | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.08.03 14:05:19 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Identities
[2012.08.03 14:05:17 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Contacts
[2012.08.03 14:05:16 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\VirtualStore
[2012.08.03 14:05:13 | 000,000,000 | --SD | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Videos
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Saved Games
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Pictures
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Music
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Links
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Favorites
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Downloads
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Documents
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\Desktop
[2012.08.03 14:05:13 | 000,000,000 | R--D | C] -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Vorlagen
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\AppData\Local\Verlauf
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\AppData\Local\Temporary Internet Files
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Startmenü
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\SendTo
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Recent
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Netzwerkumgebung
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Lokale Einstellungen
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Documents\Eigene Videos
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Documents\Eigene Musik
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Eigene Dateien
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Documents\Eigene Bilder
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Druckumgebung
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Cookies
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\AppData\Local\Anwendungsdaten
[2012.08.03 14:05:13 | 000,000,000 | -HSD | C] -- C:\Users\Homebase\Anwendungsdaten
[2012.08.03 14:05:13 | 000,000,000 | -H-D | C] -- C:\Users\Homebase\AppData
[2012.08.03 14:05:13 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Temp
[2012.08.03 14:05:13 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Local\Microsoft
[2012.08.03 14:05:13 | 000,000,000 | ---D | C] -- C:\Users\Homebase\AppData\Roaming\Media Center Programs
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Programme
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.08.03 14:05:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.08.03 14:04:58 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.08.03 13:55:59 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.08.03 13:55:26 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[1 C:\Users\Homebase\Desktop\*.tmp files -> C:\Users\Homebase\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.29 12:32:08 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.29 12:32:08 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.29 12:32:08 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.29 12:32:08 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.29 12:32:08 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.29 10:45:55 | 000,007,605 | ---- | M] () -- C:\Users\Homebase\AppData\Local\Resmon.ResmonCfg
[2012.08.29 09:00:06 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.29 09:00:06 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.29 08:52:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.29 08:52:35 | 2095,517,695 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.29 00:05:23 | 000,061,616 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000004-00000000-00000004-00001102-00000005-60021102}.rfx
[2012.08.29 00:05:23 | 000,061,616 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000004-00000000-00000004-00001102-00000005-60021102}.rfx
[2012.08.29 00:05:23 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000004-00000000-00000004-00001102-00000005-60021102}.rfx
[2012.08.23 08:39:28 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.16 15:26:37 | 005,134,936 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.10 01:53:45 | 000,001,225 | -H-- | M] () -- C:\Windows\EPMBatch.ept
[2012.08.05 20:28:56 | 000,000,132 | ---- | M] () -- C:\Users\Homebase\AppData\Roaming\Adobe PNG Format CS6 Prefs
[2012.08.04 00:34:09 | 000,008,192 | ---- | M] () -- C:\Windows\SysWow64\srvany.exe
[2012.08.03 14:28:55 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.08.03 14:28:55 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012.08.03 14:25:27 | 000,466,520 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2012.08.03 14:25:27 | 000,445,016 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2012.08.03 14:25:27 | 000,000,159 | RH-- | M] () -- C:\Windows\ctfile.rfc
[2012.08.03 13:59:27 | 000,177,271 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.08.03 13:59:27 | 000,177,271 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.08.03 13:58:15 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_AuxiliaryDisplayEnhancedDriver_01_09_00.Wdf
[2012.08.03 13:57:37 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[1 C:\Users\Homebase\Desktop\*.tmp files -> C:\Users\Homebase\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.29 12:30:49 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll
[2012.08.29 12:30:49 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2012.08.17 14:00:11 | 000,001,081 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskSpeed32.lnk
[2012.08.10 02:04:25 | 000,383,786 | RHS- | C] () -- C:\bootmgr
[2012.08.10 01:52:45 | 000,001,225 | -H-- | C] () -- C:\Windows\EPMBatch.ept
[2012.08.08 18:34:35 | 000,007,605 | ---- | C] () -- C:\Users\Homebase\AppData\Local\Resmon.ResmonCfg
[2012.08.05 20:28:56 | 000,000,132 | ---- | C] () -- C:\Users\Homebase\AppData\Roaming\Adobe PNG Format CS6 Prefs
[2012.08.04 15:18:46 | 000,001,075 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2012.08.04 15:18:04 | 000,001,037 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2012.08.04 15:16:26 | 000,001,353 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2012.08.04 15:16:22 | 000,001,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2012.08.04 00:38:29 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.08.04 00:34:41 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2012.08.03 15:12:36 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012.08.03 15:11:48 | 000,002,001 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
[2012.08.03 15:11:48 | 000,001,945 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
[2012.08.03 15:11:48 | 000,001,924 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
[2012.08.03 15:09:34 | 000,002,098 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.08.03 15:06:30 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.03 14:47:09 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.08.03 14:38:50 | 000,061,616 | ---- | C] () -- C:\Windows\SysNative\BMXStateBkp-{00000004-00000000-00000004-00001102-00000005-60021102}.rfx
[2012.08.03 14:38:50 | 000,061,616 | ---- | C] () -- C:\Windows\SysNative\BMXState-{00000004-00000000-00000004-00001102-00000005-60021102}.rfx
[2012.08.03 14:38:50 | 000,000,788 | ---- | C] () -- C:\Windows\SysNative\DVCState-{00000004-00000000-00000004-00001102-00000005-60021102}.rfx
[2012.08.03 14:28:55 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.08.03 14:28:55 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.08.03 14:26:29 | 000,007,062 | ---- | C] () -- C:\Windows\SysWow64\audiopid.vxd
[2012.08.03 14:25:27 | 000,190,976 | ---- | C] () -- C:\Windows\SysNative\APOMgr64.DLL
[2012.08.03 14:25:27 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.08.03 14:25:27 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\CmdRtr64.DLL
[2012.08.03 14:25:27 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.08.03 14:25:27 | 000,000,159 | RH-- | C] () -- C:\Windows\ctfile.rfc
[2012.08.03 14:06:12 | 000,001,405 | ---- | C] () -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.08.03 14:06:06 | 000,001,439 | ---- | C] () -- C:\Users\Homebase\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.08.03 13:59:17 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.08.03 13:59:09 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.08.03 13:58:15 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_AuxiliaryDisplayEnhancedDriver_01_09_00.Wdf
[2012.08.03 13:57:37 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.08.03 13:55:26 | 2095,517,695 | -HS- | C] () -- C:\hiberfil.sys
 
========== LOP Check ==========
 
[2012.08.10 02:23:56 | 000,000,000 | ---D | M] -- C:\Users\Homebase\AppData\Roaming\AnvSoft
[2012.08.08 16:17:21 | 000,000,000 | ---D | M] -- C:\Users\Homebase\AppData\Roaming\Blender Foundation
[2012.08.04 14:58:58 | 000,000,000 | ---D | M] -- C:\Users\Homebase\AppData\Roaming\MAGIX
[2012.08.29 12:30:48 | 000,000,000 | ---D | M] -- C:\Users\Homebase\AppData\Roaming\Simply Super Software
[2012.08.03 17:00:53 | 000,000,000 | ---D | M] -- C:\Users\Homebase\AppData\Roaming\Thunderbird
[2012.08.22 22:26:24 | 000,000,000 | ---D | M] -- C:\Users\Homebase\AppData\Roaming\uTorrent
[2009.07.14 07:08:49 | 000,014,238 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.08.03 16:24:43 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.08.10 02:04:25 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.08.03 14:05:03 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.08.10 01:53:28 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2012.08.12 18:45:40 | 000,000,000 | ---D | M] -- C:\Perl64
[2012.08.22 22:22:59 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.08.29 12:30:48 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.08.29 12:31:44 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.08.03 14:05:03 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.08.03 14:05:03 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.08.29 12:37:37 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.08.03 14:05:10 | 000,000,000 | R--D | M] -- C:\Users
[2012.08.23 13:57:20 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2010.11.21 05:23:55 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2011.10.07 16:26:42 | 000,022,016 | R--- | M] () MD5=4C1735CDCD709F4C6BD42260E2B7EAD0 -- C:\Perl64\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.21 05:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.21 05:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.08.29 12:44:59 | 001,310,720 | -HS- | M] () -- C:\Users\Homebase\ntuser.dat
[2012.08.29 12:44:59 | 000,262,144 | -HS- | M] () -- C:\Users\Homebase\ntuser.dat.LOG1
[2012.08.03 14:05:13 | 000,000,000 | -HS- | M] () -- C:\Users\Homebase\ntuser.dat.LOG2
[2012.08.03 14:09:42 | 000,065,536 | -HS- | M] () -- C:\Users\Homebase\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2012.08.03 14:09:42 | 000,524,288 | -HS- | M] () -- C:\Users\Homebase\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2012.08.03 14:09:42 | 000,524,288 | -HS- | M] () -- C:\Users\Homebase\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2012.08.10 01:09:40 | 000,065,536 | -HS- | M] () -- C:\Users\Homebase\ntuser.dat{a663a55b-e276-11e1-b54c-001d09275fb8}.TM.blf
[2012.08.10 01:09:40 | 000,524,288 | -HS- | M] () -- C:\Users\Homebase\ntuser.dat{a663a55b-e276-11e1-b54c-001d09275fb8}.TMContainer00000000000000000001.regtrans-ms
[2012.08.10 01:09:40 | 000,524,288 | -HS- | M] () -- C:\Users\Homebase\ntuser.dat{a663a55b-e276-11e1-b54c-001d09275fb8}.TMContainer00000000000000000002.regtrans-ms
[2012.08.03 14:05:13 | 000,000,020 | -HS- | M] () -- C:\Users\Homebase\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >

und Extras.txt:

Code:

ATTFilter

OTL Extras logfile created on: 29.08.2012 12:36:09 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Homebase\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,94 Gb Total Physical Memory | 4,41 Gb Available Physical Memory | 55,54% Memory free
15,87 Gb Paging File | 10,20 Gb Available in Paging File | 64,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 192,29 Gb Free Space | 41,30% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 71,87 Mb Free Space | 71,87% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 235,76 Gb Free Space | 50,62% Space Free | Partition Type: NTFS
Drive K: | 7,39 Gb Total Space | 3,39 Gb Free Space | 45,90% Space Free | Partition Type: FAT32
Drive L: | 29,77 Gb Total Space | 29,42 Gb Free Space | 98,81% Space Free | Partition Type: FAT32
 
Computer Name: HOMEBASE-PC | User Name: Homebase | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Scan with Trojan Remover] -- C:\Program Files (x86)\Trojan Remover\rmvtrjan.exe /d "%1" (Simply Super Software)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Scan with Trojan Remover] -- C:\Program Files (x86)\Trojan Remover\rmvtrjan.exe /d "%1" (Simply Super Software)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05696725-E954-44F1-9780-D0438141F1DA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{124D9BC4-D63B-46AA-A77A-9043BB5C649D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{27C3CBAC-ECBF-4A16-A469-BD41CF1350CE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2BCBA1A4-9892-4DC1-AC58-797328751C7C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
"{2BF89CDA-6D61-46D1-AEB1-BB2A3FB47C37}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{30F5BD29-C617-49C6-8C6C-ADD296908A6D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{31B1C234-F5CE-4D86-B12E-BDD9C4EFD7A5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{40F60740-6D85-43CD-A0E7-A9B910CD55B2}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{417076AB-7A78-47B3-A8DF-BD9FC5CB947C}" = lport=445 | protocol=6 | dir=in | app=system | 
"{4205090A-A9BD-402E-875D-70A5D974CAB9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6248DD89-7913-453F-84E0-7783CA821933}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{63010D9A-002D-47AD-A974-781717C81F5B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6AC25FCE-C042-4D30-B19A-745ADF6B7695}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{73F7E38D-C0CF-49D6-8FD4-34818A25DF85}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{803AE6EB-0E46-44D5-BB24-67DA2B7FC93D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{80464BA0-0905-4C3F-B1A7-8516F2AD909C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8FF8B63A-8F4D-4BFB-ACB8-5A828EE6BCF9}" = rport=138 | protocol=17 | dir=out | app=system | 
"{95CA5644-C617-4A4A-9121-B79C51C125FB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{98DBE46E-5A1D-4C72-9C83-A93AF275C447}" = rport=139 | protocol=6 | dir=out | app=system | 
"{D0E7B357-6DC9-4ECE-A555-2F8250C58FD3}" = lport=137 | protocol=17 | dir=in | app=system | 
"{DF4719BE-9DA9-4182-9AF9-C32F7B140C5B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{F3F369B8-532F-4492-85D9-F1787C281A9F}" = rport=137 | protocol=17 | dir=out | app=system | 
"{F8CB4C58-E0C5-43DB-A662-3DCF21BD6500}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FC56DBB7-F1B9-460D-9FA0-F1F786DDEC58}" = rport=445 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01A96E0C-003A-4299-AB71-8E879C14F182}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{0866166D-6B2B-4409-9488-925F80E2737C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{137AB8F0-5AEF-4327-9ECA-7A43EFC153CF}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{279F8EE9-D237-49CA-9F41-30345740556D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{2812A328-3CA9-426E-B99D-1F207B3B71A6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3038EF5B-7492-45ED-A8AA-70A2CB7689A4}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{30B55370-DB57-4BA3-B1D4-F78394FBC796}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) | 
"{34D0EC69-6033-47B3-8E62-A686926361C1}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{39B4CC2C-F7F3-4A66-B908-F15BF4C8DF64}" = protocol=1 | dir=in | name=sisoftware deployment agent service (icmp-in) | 
"{4443382C-C2AF-4026-9652-BC5005B39A1B}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{44C02DD8-80FB-4CF4-8059-4C4A14B38234}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{49091565-3309-4F23-BA46-89D6305E5844}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4DFC986C-85D1-4C63-86FC-0BAC65042794}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{50988D14-C9AE-483D-B8AD-EEF14615D04F}" = protocol=6 | dir=out | app=system | 
"{57C9FCD5-ADE6-483C-BDA1-D613506ADA1F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{58307770-D695-40CA-B40A-107CBD4EDEE5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{5B0E03E9-72B2-4522-8471-56DDFC2C1D9D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{5CD64E76-75C4-4F3E-81E6-614F705ADE84}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{632B4A03-0B48-4098-A9A6-3F6E642E195B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{63A4695E-1B6D-4F11-8CD4-8CDCAE45996E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{67EC485D-D9B8-46C2-9B34-573C5B1D23FE}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{795ECEEA-ACDB-4F09-B06A-C4C64633F853}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{88751E25-3060-4D1C-9838-888E803801D4}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{8C2F70C0-6083-4FF2-979B-1D669E77566D}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{8E32843E-CF88-460B-A10A-B1347E9BD848}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{A01C47BA-41F3-4A5B-94FD-26472F4C5AE3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A047E0D4-F6B0-4F81-AB40-5218549CE08F}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{B4136E8E-9A3B-400B-B2FC-CCB2ED923765}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D8386B60-7DFD-48D9-9A21-238E7070AA08}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{DAEC45C7-D325-4B41-8B03-699DEED365F1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{DC9959F5-12CD-4AC7-A559-F3D39CC6444C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F632EDCE-33DA-48B4-ADE6-74D8C11FDE40}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F99A64AE-FC07-4CDB-860B-C6CBECCF41EC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FEC313ED-4900-4287-8D35-085B587DAACD}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"TCP Query User{6124FB9D-89F1-48B5-8EA1-7F8D04942E69}C:\program files (x86)\jdownloader\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jdownloader\jre\bin\javaw.exe | 
"UDP Query User{0570D1AF-51A8-4F7A-89B7-62C461D7F4D8}C:\program files (x86)\jdownloader\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jdownloader\jre\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417006FF}" = Java 7 Update 6 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4FC945A7-D54E-4F00-BE32-90553F80FCE8}" = ActivePerl 5.14.2 Build 1402 (64-bit)
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Recuva" = Recuva
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0479FEB9-A04A-4DF1-B220-930E561C2ADA}" = MAGIX Screenshare
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{77555CD4-FBF8-415E-B5D0-39CB79497E0A}" = MAGIX Speed burnR (MSI)
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{E77FF215-69B6-475A-82D7-27E3FDF7D252}" = MAGIX Video Pro X3 Download-Version
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AudioCS" = Creative Audio-Systemsteuerung
"Avira AntiVir Desktop" = Avira Free Antivirus
"CobBackup11" = Cobian Backup 11 Gravity
"Console Launcher" = Creative Konsole Starter
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DiskSpeed32" = DiskSpeed32
"MAGIX_MSI_Videodeluxe17_pro" = MAGIX Video Pro X3 Download-Version
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OpenAL" = OpenAL
"Revo Uninstaller" = Revo Uninstaller 1.94
"Trojan Remover_is1" = Trojan Remover 6.8.4
"uTorrent" = µTorrent
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.08.2012 02:50:26 | Computer Name = Homebase-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 28.08.2012 11:29:50 | Computer Name = Homebase-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 28.08.2012 11:29:50 | Computer Name = Homebase-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15584
 
Error - 28.08.2012 11:29:50 | Computer Name = Homebase-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15584
 
Error - 28.08.2012 13:06:14 | Computer Name = Homebase-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 28.08.2012 13:06:14 | Computer Name = Homebase-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5800148
 
Error - 28.08.2012 13:06:14 | Computer Name = Homebase-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5800148
 
Error - 28.08.2012 17:20:59 | Computer Name = Homebase-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 29.08.2012 02:54:28 | Computer Name = Homebase-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 29.08.2012 04:46:12 | Computer Name = Homebase-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 14.0.4762.1000 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 13e4    Startzeit: 01cd85c1deba8caf    Endzeit: 0    Anwendungspfad: 
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE    Berichts-ID: f4a0f23d-f1b5-11e1-b60a-001d09275fb8

 
[ System Events ]
Error - 03.08.2012 17:26:40 | Computer Name = Homebase-PC | Source = Server | ID = 2505
Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht
 \Device\NetBT_Tcpip_{586F42D8-89C5-4067-B017-6521EA204691} vom Serverdienst nicht
 gebunden werden. Der Serverdienst konnte nicht gestartet werden.
 
Error - 05.08.2012 06:49:27 | Computer Name = Homebase-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?05.?08.?2012 um 12:47:04 unerwartet heruntergefahren.
 
Error - 05.08.2012 16:21:27 | Computer Name = Homebase-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 09.08.2012 19:05:29 | Computer Name = Homebase-PC | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Avira Echtzeit Scanner" wurde mit folgendem dienstspezifischem
 Fehler beendet: %%306.
 
Error - 09.08.2012 20:07:14 | Computer Name = Homebase-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "\\?\Volume{564dba57-e27f-11e1-918f-806e6f6e6963}"
 wurde während der Ermittlung abgebrochen.
 
Error - 13.08.2012 15:50:53 | Computer Name = Homebase-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 
Error - 17.08.2012 07:01:52 | Computer Name = Homebase-PC | Source = WMPNetworkSvc | ID = 866300
Description = 
 
Error - 19.08.2012 11:32:48 | Computer Name = Homebase-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 26.08.2012 17:03:16 | Computer Name = Homebase-PC | Source = Server | ID = 2505
Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht
 \Device\NetBT_Tcpip_{586F42D8-89C5-4067-B017-6521EA204691} vom Serverdienst nicht
 gebunden werden. Der Serverdienst konnte nicht gestartet werden.
 
Error - 27.08.2012 12:34:32 | Computer Name = Homebase-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst ShellHWDetection erreicht.
 
 
< End of report >

Vielen Dank schon mal!

markusg · 29.08.2012, 14:31

download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

Castor Troy · 29.08.2012, 14:57

Gesagt getan:

TDSS Killer installiert und scan laufen lassen.

Hier das Log:

Code:

ATTFilter

15:55:08.0231 4724  wercplsupport - ok
15:55:08.0231 4724  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
15:55:08.0262 4724  WerSvc - ok
15:55:08.0278 4724  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
15:55:08.0309 4724  WfpLwf - ok
15:55:08.0309 4724  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
15:55:08.0324 4724  WIMMount - ok
15:55:08.0324 4724  WinDefend - ok
15:55:08.0340 4724  WinHttpAutoProxySvc - ok
15:55:08.0356 4724  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
15:55:08.0387 4724  Winmgmt - ok
15:55:08.0449 4724  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll
15:55:08.0527 4724  WinRM - ok
15:55:08.0543 4724  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUSB.SYS
15:55:08.0558 4724  WinUsb - ok
15:55:08.0605 4724  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll
15:55:08.0652 4724  Wlansvc - ok
15:55:08.0652 4724  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
15:55:08.0668 4724  WmiAcpi - ok
15:55:08.0683 4724  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
15:55:08.0730 4724  wmiApSrv - ok
15:55:08.0730 4724  WMPNetworkSvc - ok
15:55:08.0761 4724  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
15:55:08.0761 4724  WPCSvc - ok
15:55:08.0777 4724  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
15:55:08.0792 4724  WPDBusEnum - ok
15:55:08.0792 4724  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
15:55:08.0824 4724  ws2ifsl - ok
15:55:08.0824 4724  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
15:55:08.0870 4724  wscsvc - ok
15:55:08.0870 4724  WSearch - ok
15:55:08.0948 4724  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
15:55:09.0058 4724  wuauserv - ok
15:55:09.0058 4724  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
15:55:09.0089 4724  WudfPf - ok
15:55:09.0104 4724  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
15:55:09.0167 4724  WUDFRd - ok
15:55:09.0229 4724  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
15:55:09.0260 4724  wudfsvc - ok
15:55:09.0260 4724  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll
15:55:09.0307 4724  WwanSvc - ok
15:55:09.0323 4724  ================ Scan global ===============================
15:55:09.0323 4724  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
15:55:09.0323 4724  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
15:55:09.0338 4724  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
15:55:09.0338 4724  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
15:55:09.0370 4724  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
15:55:09.0370 4724  [Global] - ok
15:55:09.0370 4724  ================ Scan MBR ==================================
15:55:09.0385 4724  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
15:55:09.0479 4724  \Device\Harddisk0\DR0 - ok
15:55:09.0479 4724  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
15:55:09.0853 4724  \Device\Harddisk1\DR1 - ok
15:55:09.0853 4724  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk6\DR6
15:55:12.0365 4724  \Device\Harddisk6\DR6 - ok
15:55:12.0365 4724  ================ Scan VBR ==================================
15:55:12.0365 4724  [ E7BC4D5742F59238D858AF456DA3ECFF ] \Device\Harddisk0\DR0\Partition1
15:55:12.0365 4724  \Device\Harddisk0\DR0\Partition1 - ok
15:55:12.0365 4724  [ 3B81C410D5DE08FBB82EEDF9C79FAD5D ] \Device\Harddisk1\DR1\Partition1
15:55:12.0365 4724  \Device\Harddisk1\DR1\Partition1 - ok
15:55:12.0396 4724  [ 9D7480123602B6474BE391C22B89A603 ] \Device\Harddisk1\DR1\Partition2
15:55:12.0396 4724  \Device\Harddisk1\DR1\Partition2 - ok
15:55:12.0396 4724  [ E3D12217DD91CA8A38A0E245F10BAC5C ] \Device\Harddisk6\DR6\Partition1
15:55:12.0396 4724  \Device\Harddisk6\DR6\Partition1 - ok
15:55:12.0396 4724  ============================================================
15:55:12.0396 4724  Scan finished
15:55:12.0396 4724  ============================================================
15:55:12.0412 3704  Detected object count: 6
15:55:12.0412 3704  Actual detected object count: 6
15:55:23.0909 3704  cbVSCService11 ( UnsignedFile.Multi.Generic ) - skipped by user
15:55:23.0909 3704  cbVSCService11 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:55:23.0909 3704  CobianBackup11 ( UnsignedFile.Multi.Generic ) - skipped by user
15:55:23.0909 3704  CobianBackup11 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:55:23.0909 3704  Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
15:55:23.0909 3704  Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:55:23.0909 3704  CTAudSvcService ( UnsignedFile.Multi.Generic ) - skipped by user
15:55:23.0909 3704  CTAudSvcService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:55:23.0909 3704  FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
15:55:23.0909 3704  FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:55:23.0909 3704  SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
15:55:23.0909 3704  SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip

Vielen Dank für die Mühe!!!!

markusg · 29.08.2012, 17:17

hi

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Castor Troy · 29.08.2012, 19:47

Guten Abend markusg,

Hier das Combofix Log:

Code:

ATTFilter

ComboFix 12-08-28.03 - Homebase 29.08.2012  20:19:06.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8126.5887 [GMT 2:00]
ausgeführt von:: c:\users\Homebase\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-07-28 bis 2012-08-29  ))))))))))))))))))))))))))))))
.
.
2012-08-29 18:28 . 2012-08-29 18:28	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-08-29 10:30 . 2003-02-02 17:06	153088	----a-w-	c:\windows\SysWow64\UNRAR3.dll
2012-08-29 10:30 . 2002-03-05 22:00	75264	----a-w-	c:\windows\SysWow64\unacev2.dll
2012-08-29 10:30 . 2012-08-29 10:31	--------	d-----w-	c:\program files (x86)\Trojan Remover
2012-08-29 10:30 . 2012-08-29 10:30	--------	d-----w-	c:\programdata\Simply Super Software
2012-08-29 09:51 . 2012-08-29 09:51	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-29 09:51 . 2012-07-03 11:46	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-08-23 18:23 . 2012-08-23 18:23	--------	d-----w-	c:\program files (x86)\VS Revo Group
2012-08-23 11:40 . 2012-08-23 11:40	--------	d-----w-	c:\programdata\Malwarebytes
2012-08-20 19:09 . 2012-08-20 19:09	--------	d-----w-	c:\program files (x86)\Common Files\Java
2012-08-20 19:08 . 2012-08-20 19:08	--------	d-----w-	c:\program files (x86)\Oracle
2012-08-20 19:08 . 2012-07-05 20:06	772544	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2012-08-20 19:08 . 2012-07-05 20:06	687544	----a-w-	c:\windows\SysWow64\deployJava1.dll
2012-08-20 19:08 . 2012-08-20 19:08	--------	d-----w-	c:\program files (x86)\Java
2012-08-20 18:54 . 2012-08-20 18:54	289768	----a-w-	c:\windows\system32\javaws.exe
2012-08-20 18:54 . 2012-08-20 18:54	189416	----a-w-	c:\windows\system32\javaw.exe
2012-08-20 18:54 . 2012-08-20 18:54	188904	----a-w-	c:\windows\system32\java.exe
2012-08-20 18:54 . 2012-08-20 18:54	108008	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2012-08-17 12:00 . 2012-08-17 12:00	--------	d-----w-	c:\program files (x86)\DiskSpeed32
2012-08-15 15:10 . 2012-05-05 08:36	503808	----a-w-	c:\windows\system32\srcore.dll
2012-08-15 15:10 . 2012-05-05 07:46	43008	----a-w-	c:\windows\SysWow64\srclient.dll
2012-08-15 15:10 . 2012-02-11 06:43	751104	----a-w-	c:\windows\system32\win32spl.dll
2012-08-15 15:10 . 2012-02-11 06:36	559104	----a-w-	c:\windows\system32\spoolsv.exe
2012-08-15 15:10 . 2012-02-11 06:36	67072	----a-w-	c:\windows\splwow64.exe
2012-08-15 15:10 . 2012-02-11 05:43	492032	----a-w-	c:\windows\SysWow64\win32spl.dll
2012-08-15 15:10 . 2012-07-04 22:16	73216	----a-w-	c:\windows\system32\netapi32.dll
2012-08-15 15:10 . 2012-07-04 22:13	59392	----a-w-	c:\windows\system32\browcli.dll
2012-08-15 15:10 . 2012-07-04 22:13	136704	----a-w-	c:\windows\system32\browser.dll
2012-08-15 15:10 . 2012-07-04 21:14	41984	----a-w-	c:\windows\SysWow64\browcli.dll
2012-08-15 15:10 . 2012-07-18 18:15	3148800	----a-w-	c:\windows\system32\win32k.sys
2012-08-15 15:10 . 2012-05-14 05:26	956928	----a-w-	c:\windows\system32\localspl.dll
2012-08-13 20:59 . 2012-08-27 15:37	--------	d-----w-	c:\program files\Recuva
2012-08-13 19:31 . 2012-08-13 19:31	--------	d-----w-	c:\program files\CCleaner
2012-08-13 19:29 . 2012-08-13 19:29	--------	d-----w-	c:\windows\system32\appmgmt
2012-08-12 16:43 . 2012-08-12 16:45	--------	d-----w-	C:\Perl64
2012-08-09 23:51 . 2012-08-09 23:51	--------	d-----w-	c:\program files (x86)\EASEUS
2012-08-09 23:48 . 2012-08-10 00:04	--------	d-----w-	C:\Boot
2012-08-09 23:44 . 2012-08-09 23:44	--------	d-----w-	c:\programdata\explauncher
2012-08-09 23:44 . 2012-08-09 23:44	--------	d-----w-	c:\programdata\launcher
2012-08-09 23:44 . 2012-08-09 23:44	--------	d-----w-	c:\program files (x86)\Paragon Software
2012-08-08 19:12 . 2012-08-09 23:54	--------	d-----w-	c:\program files (x86)\MiniTool Partition Wizard Home Edition 7.5
2012-08-08 14:15 . 2012-08-08 14:15	--------	d-----w-	c:\program files\Blender Foundation
2012-08-08 09:14 . 2012-08-08 09:14	--------	d-----w-	c:\program files\CPUID
2012-08-05 10:45 . 2007-03-12 14:42	4494184	----a-w-	c:\windows\system32\d3dx9_33.dll
2012-08-05 10:03 . 2012-08-05 10:03	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2012-08-04 13:18 . 2012-08-04 13:18	--------	d-----w-	c:\programdata\regid.1986-12.com.adobe
2012-08-04 13:18 . 2012-08-04 13:18	--------	d-----w-	c:\program files\Adobe
2012-08-04 13:13 . 2012-08-04 13:18	--------	d-----w-	c:\program files\Common Files\Adobe
2012-08-04 12:56 . 2007-01-04 09:02	663552	----a-w-	c:\windows\SysWow64\mgxoschk.dll
2012-08-04 12:53 . 2012-08-04 12:53	--------	d-----w-	c:\program files (x86)\Common Files\MAGIX Shared
2012-08-04 12:52 . 2012-08-13 19:36	--------	d-----w-	c:\program files (x86)\MAGIX
2012-08-04 12:52 . 2012-08-13 19:36	--------	d-----w-	c:\programdata\MAGIX
2012-08-04 12:52 . 2012-08-04 12:52	--------	d-----w-	c:\program files (x86)\Common Files\MAGIX Services
2012-08-03 22:38 . 2012-08-04 13:16	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2012-08-03 22:34 . 2012-08-03 22:34	8192	----a-w-	c:\windows\SysWow64\srvany.exe
2012-08-03 22:28 . 2012-08-03 22:28	--------	d-----w-	c:\program files (x86)\Microsoft Synchronization Services
2012-08-03 22:28 . 2012-08-03 22:28	--------	d-----w-	c:\windows\PCHEALTH
2012-08-03 22:28 . 2012-08-03 22:28	--------	d-----w-	c:\program files (x86)\Microsoft Sync Framework
2012-08-03 22:28 . 2012-08-03 22:28	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-08-03 22:25 . 2012-08-03 22:25	--------	d-----w-	c:\program files (x86)\Microsoft Visual Studio 8
2012-08-03 22:25 . 2012-08-03 22:25	--------	d-----w-	c:\program files\Microsoft Office
2012-08-03 22:24 . 2012-08-03 22:24	--------	d-----w-	c:\program files (x86)\Microsoft Analysis Services
2012-08-03 22:23 . 2012-08-03 22:31	--------	d-----w-	c:\programdata\Microsoft Help
2012-08-03 22:23 . 2012-08-09 23:53	--------	d-----r-	C:\MSOCache
2012-08-03 16:21 . 2012-08-28 08:47	--------	d-----w-	c:\program files (x86)\Cobian Backup 11
2012-08-03 13:52 . 2011-02-19 12:05	1139200	----a-w-	c:\windows\system32\FntCache.dll
2012-08-03 13:52 . 2011-02-19 12:04	902656	----a-w-	c:\windows\system32\d2d1.dll
2012-08-03 13:52 . 2011-02-19 06:30	739840	----a-w-	c:\windows\SysWow64\d2d1.dll
2012-08-03 13:44 . 2012-08-03 22:28	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2012-08-03 13:14 . 2012-07-18 16:04	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-08-03 13:14 . 2012-07-18 16:04	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-08-03 13:14 . 2012-07-18 16:04	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-08-03 13:14 . 2012-08-03 13:14	--------	d-----w-	c:\programdata\Avira
2012-08-03 13:14 . 2012-08-03 13:14	--------	d-----w-	c:\program files (x86)\Avira
2012-08-03 13:13 . 2012-08-03 13:13	--------	dc----w-	c:\windows\system32\DRVSTORE
2012-08-03 13:13 . 2009-05-18 11:17	34152	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-03 13:13 . 2008-04-17 10:12	126312	----a-w-	c:\windows\system32\GEARAspi64.dll
2012-08-03 13:10 . 2012-08-03 13:10	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2012-08-03 13:10 . 2012-08-03 13:10	--------	d-----r-	c:\program files (x86)\Skype
2012-08-03 13:10 . 2012-08-03 13:10	--------	d-----w-	c:\programdata\Skype
2012-08-03 13:09 . 2012-08-03 13:09	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2012-08-03 13:08 . 2012-08-03 13:08	--------	d-----w-	c:\program files\WinRAR
2012-08-03 13:07 . 2012-08-03 13:07	--------	d-----w-	c:\program files (x86)\uTorrent
2012-08-03 13:07 . 2012-08-20 18:54	916456	----a-w-	c:\windows\system32\deployJava1.dll
2012-08-03 13:07 . 2012-08-20 18:54	1034216	----a-w-	c:\windows\system32\npDeployJava1.dll
2012-08-03 13:07 . 2012-08-03 13:07	--------	d-----w-	c:\program files\Java
2012-08-03 13:06 . 2012-08-28 21:34	--------	d-sh--w-	c:\windows\Installer
2012-08-03 13:06 . 2012-08-03 13:06	--------	d-----w-	c:\programdata\McAfee
2012-08-03 13:06 . 2012-08-22 20:17	73416	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-03 13:06 . 2012-08-22 20:17	696520	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-03 13:06 . 2012-08-03 13:06	--------	d-----w-	c:\windows\SysWow64\Macromed
2012-08-03 13:06 . 2012-08-03 13:06	--------	d-----w-	c:\windows\system32\Macromed
2012-08-03 12:54 . 2012-08-13 19:32	--------	d-----w-	c:\windows\Panther
2012-08-03 12:47 . 2012-08-03 12:47	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-08-03 12:38 . 2012-08-03 12:38	--------	d-----w-	c:\windows\SysWow64\wbem\en-US
2012-08-03 12:38 . 2012-08-03 12:38	--------	d-----w-	c:\windows\system32\wbem\en-US
2012-08-03 12:30 . 2010-02-23 08:16	294912	----a-w-	c:\windows\system32\browserchoice.exe
2012-08-03 12:26 . 2012-08-15 21:06	62134624	----a-w-	c:\windows\system32\MRT.exe
2012-08-03 12:26 . 2003-06-12 21:25	7062	----a-w-	c:\windows\SysWow64\audiopid.vxd
2012-08-03 12:26 . 2012-08-03 12:26	--------	d--h--w-	c:\program files (x86)\Creative Installation Information
2012-08-03 12:26 . 2012-08-03 12:26	--------	d-----w-	c:\program files (x86)\Common Files\Creative
2012-08-03 12:26 . 2012-08-03 12:26	--------	d-----w-	c:\program files (x86)\Common Files\Creative Labs Shared
2012-08-03 12:26 . 2012-08-03 12:26	--------	d-----w-	c:\program files\Creative
2012-08-03 12:26 . 2012-08-03 12:58	--------	d-----w-	c:\program files (x86)\Creative
2012-08-03 12:26 . 2012-08-03 12:58	--------	d--h--w-	c:\program files (x86)\InstallShield Installation Information
2012-08-03 12:26 . 2012-08-03 12:26	--------	d-----w-	c:\program files (x86)\Common Files\InstallShield
2012-08-03 12:23 . 2012-08-03 12:23	--------	d-----w-	c:\programdata\NVIDIA Corporation
2012-08-03 12:23 . 2012-08-03 12:23	--------	d-----w-	c:\program files\NVIDIA Corporation
2012-08-03 12:22 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-08-03 12:22 . 2012-03-01 06:38	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-08-03 12:22 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-08-03 12:22 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-08-03 12:22 . 2012-03-01 05:37	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-08-03 12:22 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-08-03 12:22 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-08-03 12:19 . 2011-10-01 05:45	886784	----a-w-	c:\program files\Common Files\System\wab32.dll
2012-08-03 12:15 . 2011-11-17 06:41	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-08-03 12:15 . 2011-11-17 05:38	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-08-03 12:13 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2012-08-03 12:13 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-08-03 12:09 . 2008-05-07 17:59	99840	----a-w-	c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2012-08-03 12:08 . 2012-02-17 06:38	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-08-03 12:08 . 2012-02-17 05:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-08-03 12:08 . 2012-02-17 04:57	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-08-03 12:06 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"Cobian Backup 11 interface"="c:\program files (x86)\Cobian Backup 11\cbInterface.exe" [2012-07-31 4407808]
"TrojanScanner"="c:\program files (x86)\Trojan Remover\Trjscan.exe" [2012-08-29 1240848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-22 250568]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-08-03 79360]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2010-05-05 202840]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2010-05-05 1417304]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2010-05-05 94808]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-18 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-18 86224]
S2 cbVSCService11;Cobian Backup 11 Volume Shadow Copy Requester;c:\program files (x86)\Cobian Backup 11\cbVSCService11.exe [2012-07-31 67584]
S2 CobianBackup11;Cobian Backup 11 Gravity;c:\program files (x86)\Cobian Backup 11\cbService.exe [2012-07-31 1131008]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2010-05-05 202840]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2010-05-05 1417304]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2010-05-05 94808]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 20:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://mystart.incredibar.com/mb178?a=6R8CQWxtO2&i=26
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
FF - ProfilePath - c:\users\Homebase\AppData\Roaming\Mozilla\Firefox\Profiles\h55l2vur.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8CQWxtO2&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 5642402400000000000000271913f90e
FF - user.js: extensions.incredibar_i.instlDay - 15574
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1414:53
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef - 
FF - user.js: extensions.incredibar_i.dfltLng - 
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id - 
FF - user.js: extensions.incredibar_i.upn2 - 6R8CQWxtO2
FF - user.js: extensions.incredibar_i.upn2n - 92824924703296810
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10643
FF - user.js: extensions.incredibar_i.ppd - 1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-08-29  20:41:00 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-08-29 18:40
.
Vor Suchlauf: 6 Verzeichnis(se), 189.674.938.368 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 189.592.203.264 Bytes frei
.
- - End Of File - - 21B8956DB3F2057AB7F2092522AA19A8

Viel Spaß damit...

markusg · 30.08.2012, 12:05

hi
malwarebytes bitte updaten, vollständiger scan, funde löschen log posten

Castor Troy · 30.08.2012, 21:30

Hallo markusg,

heute etwas später aber ich bleib am Ball:

Danke für Deine Hilfe - alles erledigt, hier der log:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.30.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Homebase :: HOMEBASE-PC [Administrator]

Schutz: Deaktiviert

30.08.2012 20:20:45
mbam-log-2012-08-30 (20-20-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 442769
Laufzeit: 1 Stunde(n), 52 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\adobe.photoshop.cs6-patch.exe (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Homebase\Downloads\Adobe Photoshop CS6 13.0 Final  Multilanguage (patch-PainteR) [ChingLiu]\patch - PainteR\adobe.photoshop.cs6-patch.exe (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
E:\Downloads 2012-08-26 17;05;29 (Incremental)\Adobe Photoshop CS6 13.0 Final  Multilanguage (patch-PainteR) [ChingLiu]\patch - PainteR\adobe.photoshop.cs6-patch.exe (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg · 06.09.2012, 17:23

war gesundheitlich angeschlagen, da du keygens nutzt, was strafbar ist, bekommst du hier nur hilfe beim neu aufsetzen
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:

deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
Bilder, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
recovery cd oder recovery partition.
falls dies ein fertig pc ist, nenne hersteller + typ.
Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

Ich vermute TR/Jorik.SpyEyes.AB auf meinem System

Log-Analyse und Auswertung: Ich vermute TR/Jorik.SpyEyes.AB auf meinem System