Hallo,

am Sonntag hab ich mir den ukash eingefangen. Ich hab mit Kaspersky Rescue Disk 10 den Rechner wieder soweit flott gemacht, dass ich zumindest wieder auf Windows zugreifen konnte. Danach Malwarebyte laufen lassen, der einiges entfernt hat, danach nochmal Deep Scan mit MSE, der einige JavaExploits gefunden hat, die nun entfernt sind. Jetzt meine Frage, inwieweit mein Rechner jetzt "sauber" ist.

System: Win Vista, 32 Bit, Laptop, MSE

Ich hab zunächst wie vorgeschrieben MSE abgeschaltet, mit defogger alles auf disable gesetzt und OTL laufen lassen. Unten noch das Logfile von Malwarebyte. Ältere Logfiles kann ich gerne posten, falls benötigt.

Logfile OTL.txt:

OTL logfile created on: 10.10.2012 11:32:00 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Martin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19328)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 42,90% Memory free
6,17 Gb Paging File | 4,88 Gb Available in Paging File | 79,17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,29 Gb Total Space | 12,65 Gb Free Space | 2,78% Space Free | Partition Type: NTFS
Drive D: | 10,47 Gb Total Space | 1,79 Gb Free Space | 17,07% Space Free | Partition Type: NTFS
Drive F: | 965,48 Mb Total Space | 965,47 Mb Free Space | 100,00% Space Free | Partition Type: FAT
 
Computer Name: LABTOP | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.10 11:14:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe
PRC - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.09.12 17:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.29 22:58:46 | 000,857,408 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.02.29 22:58:36 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2010.01.29 12:30:22 | 000,119,104 | ---- | M] (johnsadventures.com) -- C:\Programme\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.01.20 10:39:12 | 000,483,420 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe
PRC - [2009.01.20 10:38:46 | 000,249,938 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\stacsv.exe
PRC - [2009.01.20 10:37:30 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\AEstSrv.exe
PRC - [2008.12.23 17:18:20 | 000,365,952 | ---- | M] () -- C:\Programme\SMINST\BLService.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2005.03.09 20:50:18 | 000,018,944 | ---- | M] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\System32\libusbd-nt.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.19 18:49:22 | 001,801,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\18050fc0ebf2c4835d05ffd337aa1616\System.Deployment.ni.dll
MOD - [2012.06.19 18:33:40 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.19 18:33:21 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.10 03:46:51 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll
MOD - [2012.05.10 03:43:52 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012.05.10 03:41:14 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.10 03:38:59 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.10 03:38:39 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2011.02.09 02:56:38 | 000,296,448 | ---- | M] () -- C:\Programme\Notepad++\NppShell_04.dll
MOD - [2010.06.03 10:55:47 | 008,007,680 | ---- | M] () -- C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll
MOD - [2010.06.03 10:55:44 | 000,126,976 | ---- | M] () -- C:\Windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll
MOD - [2010.06.03 10:55:40 | 000,281,088 | ---- | M] () -- C:\Windows\assembly\GAC_32\Asz.Citavi.IEPicker\1.0.0.0__f59eabe05cc67589\Asz.Citavi.IEPicker.dll
MOD - [2009.03.30 06:42:12 | 000,413,696 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Deployment.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.09.23 17:21:22 | 000,066,856 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\common\MCEMediaStatus.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 -- (Norton Internet Security)
SRV - [2012.10.08 22:54:17 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.12 17:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.09.09 18:54:16 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.24 22:00:56 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2011.06.16 19:23:42 | 003,435,096 | ---- | M] () [Disabled | Stopped] -- c:\Programme\Common Files\Akamai\netsession_win_e877e12.dll -- (Akamai)
SRV - [2011.05.28 17:14:07 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.08.24 11:38:18 | 000,092,008 | ---- | M] (TomTom) [Disabled | Stopped] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2010.06.06 18:32:00 | 003,819,912 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2009.01.20 10:38:46 | 000,249,938 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\stacsv.exe -- (STacSV)
SRV - [2009.01.20 10:37:30 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\AEstSrv.exe -- (AESTFilters)
SRV - [2008.12.23 17:18:20 | 000,365,952 | ---- | M] () [Auto | Running] -- C:\Programme\SMINST\BLService.exe -- (Recovery Service for Windows)
SRV - [2008.02.03 13:00:00 | 000,129,992 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.01.19 13:54:14 | 000,097,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\MSN Messenger\usnsvc.exe -- (usnjsvc)
SRV - [2005.03.09 20:50:18 | 000,018,944 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Auto | Running] -- C:\Windows\System32\libusbd-nt.exe -- (libusbd)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\TMPassthru.sys -- (TMPassthruMP)
DRV - File not found [File_System | On_Demand | Stopped] --  -- (StarOpen)
DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS -- (SRTSPX)
DRV - File not found [File_System | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS -- (SRTSP)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS -- (NAVENG)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - [2012.08.30 22:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012.03.01 01:59:00 | 010,819,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.01.17 14:45:56 | 000,148,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2009.09.05 16:55:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.01.20 10:39:16 | 000,394,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008.12.23 13:47:52 | 000,138,240 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.01.21 04:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)
DRV - [2007.06.18 17:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2005.03.09 20:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {EE97B51A-20F2-4B92-BE28-538D5E0DADA1}
IE - HKLM\..\SearchScopes\{82BD1D8A-D6EB-48F9-A5B2-6DDEB211E69D}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\..\SearchScopes\{D5EAC5D9-65CD-4613-8C90-3DC7FF70176A}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{EE97B51A-20F2-4B92-BE28-538D5E0DADA1}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {EE97B51A-20F2-4B92-BE28-538D5E0DADA1}
IE - HKCU\..\SearchScopes\{82BD1D8A-D6EB-48F9-A5B2-6DDEB211E69D}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\..\SearchScopes\{D5EAC5D9-65CD-4613-8C90-3DC7FF70176A}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{EE97B51A-20F2-4B92-BE28-538D5E0DADA1}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "foxsearch"
FF - prefs.js..browser.search.order.1: "foxsearch"
FF - prefs.js..browser.search.selectedEngine: "foxsearch"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.68
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA@2020Technologies.com:5.0.94.0
FF - prefs.js..extensions.enabledAddons: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:2.0.7
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - user.js..browser.search.selectedEngine: "foxsearch"
FF - user.js..browser.search.order.1: "foxsearch"
FF - user.js..browser.search.defaultenginename: "foxsearch"
FF - user.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Martin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Martin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.07 20:09:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.07 22:55:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.11\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.07 20:09:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.07 20:09:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.07 22:55:44 | 000,000,000 | ---D | M]
 
[2010.12.23 11:52:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions
[2010.02.05 09:30:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.12.23 11:52:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012.10.10 09:49:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\y1rrgtiu.default\extensions
[2012.09.13 18:00:44 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\y1rrgtiu.default\extensions\2020Player_IKEA@2020Technologies.com
[2012.10.03 20:27:25 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\y1rrgtiu.default\extensions\foxyproxy@eric.h.jung
[2012.10.09 09:44:32 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\y1rrgtiu.default\extensions\https-everywhere@eff.org
[2012.10.10 09:49:23 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\y1rrgtiu.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.10.08 09:44:23 | 000,341,143 | ---- | M] () (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\y1rrgtiu.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2012.07.26 19:33:34 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\y1rrgtiu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.01.21 17:13:40 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\y1rrgtiu.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2010.02.16 09:13:26 | 000,004,153 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\y1rrgtiu.default\searchplugins\youtube.xml
[2012.10.07 17:21:50 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.06.03 10:55:56 | 000,000,000 | ---D | M] ("Citavi Picker") -- C:\Programme\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}
[2012.10.07 17:21:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.09.09 18:54:17 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.23 11:33:06 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.09 18:53:43 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.23 11:33:06 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.03.27 12:09:01 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src
[2012.06.23 11:33:06 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.23 11:33:06 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.23 11:33:06 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Martin\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Martin\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Martin\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Gutscheinmieze-Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npmieze.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Martin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.08.04 18:53:59 | 000,000,829 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1       www.suchmaschine.de
O1 - Hosts: 127.0.0.1       suchmaschine.de
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BackgroundSwitcher] C:\Program Files\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe (johnsadventures.com)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: &Citavi Picker... - C:\Program Files\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D61D277-0104-40B1-819C-AA18F512B714}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3A2B1B9-03AB-4EBF-91FA-418B70D2AFA7}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) -  File not found
O24 - Desktop WallPaper: C:\Users\Martin\AppData\Roaming\johnsadventures.com\Background Switcher\ActiveBackground.jpg
O24 - Desktop BackupWallPaper: C:\Users\Martin\AppData\Roaming\johnsadventures.com\Background Switcher\ActiveBackground.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0f6af035-badb-11de-b424-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{0f6af035-badb-11de-b424-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.bat
O33 - MountPoints2\{7a517519-0e6f-11e0-bd69-00238bfe89cb}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
O33 - MountPoints2\{b3db7868-5552-11df-8d10-00238bfe89cb}\Shell - "" = AutoRun
O33 - MountPoints2\{b3db7868-5552-11df-8d10-00238bfe89cb}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.10 11:14:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe
[2012.10.07 20:22:01 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.10.07 20:09:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.10.07 20:08:16 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2012.10.07 20:08:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.10.07 17:45:13 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.10.07 13:24:15 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Roaming
[2012.09.13 18:01:12 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\NVIDIA
[2012.03.17 09:28:12 | 002,585,872 | ---- | C] (Microsoft Corporation) -- C:\Users\Martin\WindowsInstaller-KB893803-v2-x86.exe
[2012.03.17 09:28:12 | 000,337,360 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Martin\setup.exe
[1 C:\Users\Martin\Desktop\*.tmp files -> C:\Users\Martin\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.10 11:36:02 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 11:36:02 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 11:30:56 | 000,000,000 | ---- | M] () -- C:\Users\Martin\defogger_reenable
[2012.10.10 11:28:44 | 000,050,477 | ---- | M] () -- C:\Users\Martin\Desktop\Defogger.exe
[2012.10.10 11:17:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1365937600-1429004060-754325389-1000UA.job
[2012.10.10 11:14:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe
[2012.10.10 10:53:59 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.10 09:38:55 | 000,000,247 | ---- | M] () -- C:\ProgramData\hpqp.ini
[2012.10.10 09:35:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.10 09:35:52 | 3186,544,640 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.09 22:27:56 | 000,129,536 | ---- | M] () -- C:\Users\Martin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.10.09 21:14:37 | 000,628,764 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.10.09 21:14:37 | 000,596,018 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.10.09 21:14:37 | 000,126,476 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.10.09 21:14:37 | 000,104,092 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.10.09 18:17:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1365937600-1429004060-754325389-1000Core.job
[2012.10.09 11:28:08 | 161,704,448 | ---- | M] () -- C:\Users\Martin\Desktop\moone_boy.1x05.hdtv_x264-fov.mp4
[2012.10.09 10:21:55 | 000,002,047 | ---- | M] () -- C:\Users\Martin\Desktop\Google Chrome.lnk
[2012.10.08 10:16:40 | 000,029,220 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\wklnhst.dat
[2012.10.07 20:23:52 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.10.07 11:33:19 | 734,740,480 | ---- | M] () -- C:\Users\Martin\Desktop\The_Story_of_Joanna-1975.avi
[2012.09.26 22:39:17 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.09.20 23:04:34 | 191,827,429 | ---- | M] () -- C:\Users\Martin\Desktop\parents.s01e02.hdtv.x264-tla.mp4
[1 C:\Users\Martin\Desktop\*.tmp files -> C:\Users\Martin\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.10 11:30:56 | 000,000,000 | ---- | C] () -- C:\Users\Martin\defogger_reenable
[2012.10.10 11:28:43 | 000,050,477 | ---- | C] () -- C:\Users\Martin\Desktop\Defogger.exe
[2012.10.09 11:14:46 | 161,704,448 | ---- | C] () -- C:\Users\Martin\Desktop\moone_boy.1x05.hdtv_x264-fov.mp4
[2012.10.07 20:23:52 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.10.07 20:23:52 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.10.07 17:12:41 | 3186,544,640 | -HS- | C] () -- C:\hiberfil.sys
[2012.10.07 10:12:01 | 734,740,480 | ---- | C] () -- C:\Users\Martin\Desktop\The_Story_of_Joanna-1975.avi
[2012.09.25 19:53:48 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.20 22:43:16 | 191,827,429 | ---- | C] () -- C:\Users\Martin\Desktop\parents.s01e02.hdtv.x264-tla.mp4
[2012.03.17 09:28:11 | 008,297,472 | ---- | C] () -- C:\Users\Martin\AcroPro.msi
[2012.03.17 09:28:11 | 000,076,288 | ---- | C] () -- C:\Users\Martin\1031.mst
[2012.03.17 09:28:11 | 000,074,752 | ---- | C] () -- C:\Users\Martin\1036.mst
[2012.03.17 09:28:11 | 000,003,584 | ---- | C] () -- C:\Users\Martin\1033.mst
[2012.03.17 09:28:11 | 000,001,772 | ---- | C] () -- C:\Users\Martin\ABCPY.INI
[2012.03.17 09:26:30 | 481,143,404 | ---- | C] () -- C:\Users\Martin\Data1.cab
[2012.03.09 21:29:16 | 000,077,824 | ---- | C] () -- C:\Windows\System32\DriveInfo.dll
[2012.02.06 20:20:23 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2012.01.10 23:24:45 | 000,000,552 | ---- | C] () -- C:\Windows\wiso.ini
[2011.04.26 21:44:35 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.03.22 18:57:34 | 000,000,036 | ---- | C] () -- C:\Users\Martin\AppData\Local\housecall.guid.cache
[2010.03.21 16:02:12 | 000,000,680 | ---- | C] () -- C:\Users\Martin\AppData\Local\d3d9caps.dat
[2009.10.20 20:29:52 | 000,029,220 | ---- | C] () -- C:\Users\Martin\AppData\Roaming\wklnhst.dat
[2009.10.19 08:29:36 | 000,129,536 | ---- | C] () -- C:\Users\Martin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.20 03:17:17 | 000,193,406 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.07.20 03:05:18 | 000,000,247 | ---- | C] () -- C:\ProgramData\hpqp.ini
[2009.07.20 03:01:31 | 000,193,406 | ---- | C] () -- C:\ProgramData\nvModes.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\Windows\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\Windows\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2010.09.26 10:15:52 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\.minecraft
[2010.06.03 12:49:25 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Academic Software Zurich
[2010.02.19 10:16:19 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\AnvSoft
[2012.01.10 23:25:51 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Buhl Data Service
[2009.11.18 22:14:05 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Canneverbe_Limited
[2010.06.21 20:13:14 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Canon
[2009.10.20 18:41:21 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\CoSoSys
[2011.05.28 17:11:47 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\DAEMON Tools Lite
[2012.05.06 19:09:30 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Dropbox
[2011.11.20 19:06:05 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\elsterformular
[2012.10.03 18:57:33 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\foobar2000
[2010.12.21 09:29:22 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Greenshot
[2012.01.19 10:16:25 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Gutscheinmieze
[2009.12.04 16:55:40 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\IrfanView
[2010.02.28 13:25:01 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\johnsadventures.com
[2010.06.11 15:06:34 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\My Games
[2011.08.27 11:22:26 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Notepad++
[2009.11.12 09:14:33 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\OpenOffice.org
[2010.11.18 22:01:08 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\ProtectDISC
[2012.10.07 13:24:15 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Roaming
[2011.08.15 21:30:11 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Simfy
[2010.02.05 09:30:10 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Thunderbird
[2010.12.23 11:52:47 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\TomTom
[2010.02.20 11:12:11 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\WildTangent
 
========== Purity Check ==========
 
 

< End of report >
         

Logfile Extras.txt

 OTL Extras logfile created on: 10.10.2012 11:32:00 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Martin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19328)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 42,90% Memory free
6,17 Gb Paging File | 4,88 Gb Available in Paging File | 79,17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,29 Gb Total Space | 12,65 Gb Free Space | 2,78% Space Free | Partition Type: NTFS
Drive D: | 10,47 Gb Total Space | 1,79 Gb Free Space | 17,07% Space Free | Partition Type: NTFS
Drive F: | 965,48 Mb Total Space | 965,47 Mb Free Space | 100,00% Space Free | Partition Type: FAT
 
Computer Name: LABTOP | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{13698DD2-D558-48E0-8DE9-A4F0DE3455A6}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{2A5C81B3-DEFE-4435-B184-55B12A742593}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{2ACA664B-2551-4011-98DD-46414BDD7906}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{4067AD66-32A0-468D-B798-4FB455C72B9E}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface | 
"{48B4587E-43C4-4234-A3B5-5FB3D561CA1A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4CAF49C5-55E2-43AD-8D72-D310F81F11BC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4E93CFBD-4787-47B5-8DAD-2C8DDFA4C391}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{519F0BDF-006D-4A7A-B39B-9F84517A92D0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{53747E91-3840-4829-9C5E-628A44572DFB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{79144861-9F21-46AB-BA6F-DAFBA02083DB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{8B3AFB12-249F-4971-8175-15012660EB87}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8C442F16-B5FA-4791-BFAD-BDC13ED0E4D4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BA3FDD23-7FE6-4B35-AC7C-E81CCAF803E7}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06792114-3194-4BFF-AF15-9CD6C3A3B7A8}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{108E5882-90A7-449A-966A-448A0213192F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 
"{10BD5889-EE24-4079-A0E1-727B3DC39BF0}" = protocol=6 | dir=out | app=c:\program files\rosetta stone\rosetta stone version 3\support\bin\win\rosettastoneltdservices.exe | 
"{16B61A5F-B4A3-434B-B6AA-6D2A78492A50}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{207C040C-AFB7-4CC0-9030-ECE787A4E254}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 
"{21AB0B0B-48AF-40D0-9BD2-90895294519B}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{2E4570B2-8601-4B66-B2B9-8711309E0E51}" = dir=in | app=c:\program files\rosetta stone\rosetta stone version 3\rosettastoneversion3.exe | 
"{2F8898BF-209E-4909-A4D7-597086697585}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{30477E00-E9FC-4369-919D-83B86A82E028}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 
"{359CB664-A287-43FF-8C7D-039350845EBF}" = protocol=6 | dir=in | app=c:\program files\gameforge4d\elsword_de_test\data\x2.exe | 
"{3819777D-0035-4FE7-808C-936A22AA5B52}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{3DFA0D2C-BC52-4AA8-878F-C9B82AB5E50F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{3E8AB056-5DDF-4C57-B126-BE5D7D3A7FEF}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\crusader kings ii\ck2game.exe | 
"{42CEA5A7-CDD2-49A0-AA45-4865375583EF}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 
"{44BDFC60-A347-4E13-B8CC-C9B942751CF0}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe | 
"{4A3C9A41-931D-4423-B5CE-03C8ECAC7038}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 
"{529084B6-C30F-4A49-AA31-BDC1FACE9880}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 
"{52E7258B-CF97-4B50-9DB2-C03E9BC7E030}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{58DB69E9-B366-458A-9ED1-C1FDA344D41C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5C64AA8D-4943-4A9E-8546-BA5C3DF26E77}" = protocol=6 | dir=out | app=c:\program files\rosetta stone\rosetta stone version 3\rosettastoneversion3.exe | 
"{5FDAA19F-4BC9-4069-94B5-781F5B71C247}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{604E307B-FD13-434C-B654-67EC93E029E3}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bastion demo\bastion.exe | 
"{6C7F19DF-4080-4B1F-8104-C9F591EADB66}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\crusader kings ii\ck2game.exe | 
"{77AA065C-51B3-4D05-9CD5-177D2C19E22F}" = dir=in | app=c:\program files\rosetta stone\rosetta stone version 3\support\bin\win\rosettastoneltdservices.exe | 
"{7F27DB69-3D57-4320-836F-C20A984C643F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8027D44E-287D-4F72-B4EB-ECCBCB5940E6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{90789F0F-EBFA-4403-BEFA-E07C5DF375AD}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 
"{96AAA72D-65E9-45E1-B600-B08151D3069D}" = protocol=6 | dir=out | app=system | 
"{997FF752-3EB0-49C8-9501-557D74D69379}" = protocol=17 | dir=in | app=c:\program files\gameforge4d\elsword_de_test\data\x2.exe | 
"{AFB7CCDB-B50B-4149-ADDE-05292D2F341B}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bastion demo\bastion.exe | 
"{B0EBD60F-D2B3-47FA-A023-DAD5EB8378E5}" = protocol=6 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\civilization4.exe | 
"{B5B9B243-AD31-44EB-9D32-0FDB116298D9}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bastion demo\bastion.exe | 
"{B6DDF907-3C66-4349-AD72-EC7C4A50F7E0}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{BA6F77CC-779C-40C5-8399-DCFACB09461C}" = protocol=17 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\civilization4.exe | 
"{BD046E2E-AB54-4376-9FB9-F1BC7D9780AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{BD60D0C0-AD06-4BD5-A289-08B558A8202D}" = protocol=6 | dir=in | app=c:\program files\gameforge4d\elsword_de\data\x2.exe | 
"{BE6F3BFB-80E3-4EE9-AEC7-41FB205B2B36}" = protocol=6 | dir=in | app=c:\users\martin\appdata\roaming\dropbox\bin\dropbox.exe | 
"{BF90C63E-5582-4E42-9761-EFFD6E71D6A7}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe | 
"{BFA48129-D64A-41F7-88A5-5BE710BBE55E}" = protocol=17 | dir=in | app=c:\users\martin\appdata\roaming\dropbox\bin\dropbox.exe | 
"{C24DEBA1-BF9E-48AC-8DC1-859B5BA605CB}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{C5312832-48D3-485B-A1F7-4923222E316B}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 
"{C6956082-5EA9-45B8-9AAD-5B5D62040D2E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D5532CCA-8F2A-4C71-BB28-394FAAE6F855}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{DB5736A4-31B2-4449-A856-B461B56B1F1D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\legend of grimrock\grimrock.exe | 
"{DE114BAF-44F1-44AA-BB8D-0F045192EBAE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{DF65F89A-B267-40E1-8BE0-80C3EBE8CCA0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E4818D40-E575-451D-A441-43B52B53A5CE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E65D9F59-7EE2-4FD4-BA45-071974164238}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\legend of grimrock\grimrock.exe | 
"{F063DC55-1523-4546-B321-55634AF296F6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bastion demo\bastion.exe | 
"{FCC01135-2D1C-43E8-9B71-8504A1A5CF27}" = protocol=17 | dir=in | app=c:\program files\gameforge4d\elsword_de\data\x2.exe | 
"TCP Query User{00B98AAE-3CB6-4396-8782-A468015AB801}C:\users\martin\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\martin\appdata\local\akamai\netsession_win.exe | 
"TCP Query User{26A97910-EFD5-4911-9C05-6B9EF325F180}C:\users\martin\programme\cryptload\routerclient.exe" = protocol=6 | dir=in | app=c:\users\martin\programme\cryptload\routerclient.exe | 
"TCP Query User{3F66199F-A9B5-4319-B6DC-A68AF48D5945}C:\program files\psi\psi.exe" = protocol=6 | dir=in | app=c:\program files\psi\psi.exe | 
"TCP Query User{82307128-3B45-44CE-8B77-163F2BE8B9DD}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=6 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"TCP Query User{8556E79E-FF91-49A0-B5CE-82611F015337}C:\typo3_4.6.0alpha3\apache\bin\apache.exe" = protocol=6 | dir=in | app=c:\typo3_4.6.0alpha3\apache\bin\apache.exe | 
"TCP Query User{877E3832-009B-4767-90BA-F75B39ECE759}C:\users\martin\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\martin\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{A1B999DC-F1FF-465C-A004-F9B75DA478DF}C:\program files\psi\psi.exe" = protocol=6 | dir=in | app=c:\program files\psi\psi.exe | 
"TCP Query User{B362E225-4752-4756-80DF-8D2CE9ED2A64}C:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe | 
"TCP Query User{B5221AF2-AF4F-43F3-B60C-BCAA27DAF969}C:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe | 
"TCP Query User{C19DD118-DAD2-46D9-AFA9-EF36F2CEECF9}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{DBE1BAC9-7C64-4582-9D26-578081210A4D}C:\program files\tera\tera-launcher.exe" = protocol=6 | dir=in | app=c:\program files\tera\tera-launcher.exe | 
"TCP Query User{DF5D6B85-48C1-451E-878D-ECA20A828EB2}C:\program files\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe | 
"TCP Query User{E8146FA1-D172-45EC-9915-0200E021ED27}C:\users\martin\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\martin\appdata\local\akamai\netsession_win.exe | 
"TCP Query User{F09C1B4E-5059-4971-B87B-D81765954E25}C:\users\martin\documents\downloads\starcraft_2_eu_en-gb.exe" = protocol=6 | dir=in | app=c:\users\martin\documents\downloads\starcraft_2_eu_en-gb.exe | 
"UDP Query User{0A567F18-CF13-4207-B60D-8F20B0A2D098}C:\program files\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{0C0BF6BC-DE23-4380-95E0-688F8B686AFA}C:\program files\psi\psi.exe" = protocol=17 | dir=in | app=c:\program files\psi\psi.exe | 
"UDP Query User{1D3C168E-E7A7-403C-B8AF-1EA431B0A840}C:\users\martin\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\martin\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{25A76BA2-2111-46B2-A420-E4550EBAA00C}C:\users\martin\documents\downloads\starcraft_2_eu_en-gb.exe" = protocol=17 | dir=in | app=c:\users\martin\documents\downloads\starcraft_2_eu_en-gb.exe | 
"UDP Query User{2BF26CE4-0544-455F-AAA2-0DE2E9FB0EB6}C:\users\martin\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\martin\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{3EBC0DF0-6F92-451E-856F-2BE97961E265}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{4916A7B7-85D9-4C74-A2D1-D15B1BF818CD}C:\program files\tera\tera-launcher.exe" = protocol=17 | dir=in | app=c:\program files\tera\tera-launcher.exe | 
"UDP Query User{4EE47C6C-1FF5-4EE3-9723-E0DDE5B22C82}C:\program files\psi\psi.exe" = protocol=17 | dir=in | app=c:\program files\psi\psi.exe | 
"UDP Query User{61B9CB17-9619-42F4-9267-CDAB9AD6BA03}C:\users\martin\programme\cryptload\routerclient.exe" = protocol=17 | dir=in | app=c:\users\martin\programme\cryptload\routerclient.exe | 
"UDP Query User{72501C0A-D3FA-4DF6-9D10-90CBB948150B}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=17 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"UDP Query User{74E932D2-C5EB-4B05-BED1-1B1942BAABE1}C:\typo3_4.6.0alpha3\apache\bin\apache.exe" = protocol=17 | dir=in | app=c:\typo3_4.6.0alpha3\apache\bin\apache.exe | 
"UDP Query User{76653E57-1DF6-4740-8C72-35A2A9F6A709}C:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe | 
"UDP Query User{95801B42-6FD9-4ED6-90F3-0FB36B3F3DFB}C:\users\martin\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\martin\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{E3F548C5-7040-47ED-9333-2DEB638D6549}C:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\jeandesesseintes\team fortress 2\hl2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0054A0F6-00C9-4498-B821-B5C9578F433E}" = HP Help and Support
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor
"{17050C48-16CB-4500-A102-CEAD750CE11E}" = HP User Guides 0138
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216035FF}" = Java(TM) 6 Update 35
"{279DB581-239C-4E13-97F8-0F48E40BE75C}" = Windows Live Messenger
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{32A3A4F4-B792-11D6-A78A-00B0D0160180}" = Java(TM) SE Development Kit 6 Update 18
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 M1
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4377F918-E6C9-4ECA-A7F5-754B310B7ED8}" = Sid Meier's Civilization 4
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D40F840-30CA-4747-B988-E86C4C5F3B12}" = A New Beginning
"{4D96D2F0-8FB4-45C2-9B80-2DCB88016316}_is1" = Machinarium
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{57A5AEC1-97FC-474D-92C4-908FCC2253D4}" = HP Customer Experience Enhancements
"{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0 SP1
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{732A3F80-008B-4350-BD58-EC5AE98707B8}" = HP Common Access Service Library
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{7CDBE27D-87EC-434E-AFE4-D0116AE876BB}" = Microsoft Works Suite-Add-Ins für Microsoft Word
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{911B0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95A747E0-DF19-46CB-A622-20A0107201BD}" = HP Total Care Setup
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{99011A6E-5200-11DE-BDB8-7ACD56D89593}" = Rosetta Stone Version 3
"{99A4344A-C723-4661-A507-D9D939480358}" = Cisco LEAP Module
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9BFD5911-93E3-42BB-BFCD-50E4BA5B8D67}" = Cisco EAP-FAST Module
"{A2S166A0-F031-4E27-A057-C69733219434}_is1" = TERA
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}" = Adobe Shockwave Player
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.12.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C4BEEB8C-B9D2-4CD9-A2AA-1F3A1F57DF21}" = Works Suite-Betriebssystem-Pack
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CD344FA5-6657-47CD-940F-8727EED35595}" = Cisco PEAP Module
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1" = John's Background Switcher 4.1
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E5E29403-3D25-40C6-892B-F9FEE2A95585}" = HP Wireless Assistant
"{E8020EC7-5DD8-80C9-7237-7B2E9BDA8CC6}" = muvee Reveal
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.07 beta
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"Akamai" = Akamai NetSession Interface
"Any Video Converter_is1" = Any Video Converter 3.0.3
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CDex" = CDex extraction audio
"CDisplay_is1" = CDisplay 1.8
"CHIP System-Check-Tool_is1" = CHIP System-Check-Tool 1.1.9.15
"Citavi" = Citavi 2.5
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2011-11-11
"ElsterFormular 12.4.0.7094p" = ElsterFormular
"Elsword_DE_Test_is1" = Elsword_DE_Test
"foobar2000" = foobar2000 v0.9.6.9
"Future Wars" = Future Wars
"Greenshot_is1" = Greenshot
"HijackThis" = HijackThis 2.0.2
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"IrfanView" = IrfanView (remove only)
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.10.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"Mozilla Thunderbird (3.0.11)" = Mozilla Thunderbird (3.0.11)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"Network Stumbler" = Network Stumbler 0.4.0 (remove only)
"Notepad++" = Notepad++
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"pdfsam" = pdfsam
"PhotoStitch" = Canon Utilities PhotoStitch
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Psi" = Psi (remove only)
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"StarCraft II" = StarCraft II
"Steam App 107110" = Bastion - Demo
"Steam App 203770" = Crusader Kings II
"Steam App 207170" = Legend of Grimrock
"Steam App 3590" = Plants vs. Zombies
"Steam App 440" = Team Fortress 2
"Steam App 520" = Team Fortress 2 Beta
"Steam App 550" = Left 4 Dead 2
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"TomTom HOME" = TomTom HOME 2.7.6.2056
"VLC media player" = VLC media player 1.0.2
"voxware_is1" = Voxware Audio decoder 1.6
"WildTangent hp Master Uninstall" = My HP Games
"Works2003Setup" = Microsoft Works 2003-Setup-Start
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 30.06.2011 00:33:07 | Computer Name = Labtop | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 30.06.2011 15:25:22 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.07.2011 12:14:08 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.07.2011 17:13:08 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.07.2011 03:51:19 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.07.2011 10:12:45 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 04.07.2011 00:54:15 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 04.07.2011 11:50:21 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 04.07.2011 13:15:07 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.07.2011 12:03:42 | Computer Name = Labtop | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 09.10.2012 16:33:06 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 09.10.2012 16:33:06 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 09.10.2012 16:33:07 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 09.10.2012 16:33:08 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 09.10.2012 16:33:08 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 09.10.2012 16:33:10 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 10.10.2012 03:36:14 | Computer Name = Labtop | Source = DCOM | ID = 10016
Description = 
 
Error - 10.10.2012 03:37:42 | Computer Name = Labtop | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.10.2012 03:37:42 | Computer Name = Labtop | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.10.2012 03:37:42 | Computer Name = Labtop | Source = Service Control Manager | ID = 7026
Description = 
 
 
< End of report >
         

Logfile Malwarebyte

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.07.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19328
Martin :: LABTOP [Administrator]

07.10.2012 17:31:32
mbam-log-2012-10-07 (17-31-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 560239
Laufzeit: 3 Stunde(n), 56 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Martin\ms.exe (Trojan.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Martin\AppData\Roaming\07F4HkiN.exe (Trojan.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\plugins\npmieze.dll (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Vielen Dank schon mal für die Hilfe,
Oskorei

Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

• "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
  - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
  - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
• Charakteristische Merkmale/Profilinformationen:
  - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
• Die Systemprüfung und Bereinigung:
  - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
• Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
• Innerhalb der Betreuungszeit:
  - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
• Die Reihenfolge:
  - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
• GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
• Ansonsten unsere Forumsregeln:
  - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
• Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen

► Hilfeleistung - geplante Vorgehensweise:

• Problemsuche
• Problembeseitigung/Systembereinigung
• Verwendete Programme deinstallieren/entfernen
• Thema abschließen: Tipps zur Computersicherheit

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:

• Download den CCleaner herunter
  
• Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
• starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
• ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw

gruß
kira

Hallo Kira,

vielen Dank schon mal für deine Hilfe!

Hier die Liste der installierten Programme von CClean:

7-Zip 9.07 beta		19.10.2009	3,28MB	
A New Beginning	Deep Silver	27.09.2010	2,80GB	0238
Activation Assistant for the 2007 Microsoft Office suites	Microsoft Corporation	20.07.2009	14,0MB	
Adobe AIR	Adobe Systems Incorporated	15.08.2011	30,1MB	2.7.1.19610
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	20.07.2009		10.0.12.36
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	08.10.2012		11.4.402.287
Adobe Photoshop Elements 2.0	Adobe Systems, Inc.	23.10.2009	97,4MB	2.0
Adobe Reader X (10.1.4) - Deutsch	Adobe Systems Incorporated	07.10.2012	120MB	10.1.4
Akamai NetSession Interface	Akamai Technologies, Inc	18.05.2011		
Akamai NetSession Interface		22.06.2012	13,2MB	
Any Video Converter 3.0.3	Any-Video-Converter.com	18.02.2010	63,9MB	
Apple Application Support	Apple Inc.	07.10.2012	61,0MB	2.1.7
Apple Software Update	Apple Inc.	03.09.2011	2,38MB	2.1.3.127
Atheros Client Installation Program	Atheros	26.09.2010	3,32MB	7.0
Atheros Driver Installation Program	Atheros	20.07.2009	1,07MB	5.0
Bastion - Demo	SUpergiant Games	31.08.2011	288MB	
Canon G.726 WMP-Decoder	Canon Inc.	23.10.2009	232KB	1.1.0.4
CANON iMAGE GATEWAY Task for ZoomBrowser EX	Canon Inc.	23.10.2009	51,9MB	1.5.0.3
Canon Internet Library for ZoomBrowser EX	Canon Inc.	23.10.2009	51,9MB	1.6.1.6
Canon MovieEdit Task for ZoomBrowser EX	Canon Inc.	23.10.2009	51,9MB	2.6.0.4
Canon RAW Image Task for ZoomBrowser EX	Canon Inc.	23.10.2009	184KB	0.9.3.9
Canon Utilities CameraWindow	Canon Inc.	23.10.2009	2,27MB	7.1.0.2
Canon Utilities CameraWindow DC	Canon Inc.	23.10.2009	5,62MB	7.1.0.7
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX	Canon Inc.	23.10.2009	17,2MB	6.4.2.16
Canon Utilities MyCamera	Canon Inc.	23.10.2009	14,3MB	6.4.0.5
Canon Utilities MyCamera DC	Canon Inc.	23.10.2009	14,2MB	7.0.1.8
Canon Utilities PhotoStitch	Canon Inc.	23.10.2009	6,14MB	3.1.21.45
Canon Utilities RemoteCapture Task for ZoomBrowser EX	Canon Inc.	23.10.2009	15,0MB	1.7.1.9
Canon Utilities ZoomBrowser EX	Canon Inc.	23.10.2009	51,9MB	6.1.0.20
Canon ZoomBrowser EX Memory Card Utility	Canon Inc.	23.10.2009	18,5MB	1.1.0.8
CCleaner	Piriform	24.09.2012	4,86MB	3.23
CDex extraction audio		29.10.2009	3,29MB	
CDisplay 1.8	dvd8n	27.01.2012	1,96MB	
CHIP System-Check-Tool 1.1.9.15	CHIP, Winfuture, Green Crystal Software	08.03.2012	1,86MB	
Cisco EAP-FAST Module	Cisco Systems, Inc.	26.09.2010	1,15MB	2.2.10
Cisco LEAP Module	Cisco Systems, Inc.	26.09.2010	488KB	1.0.16
Cisco PEAP Module	Cisco Systems, Inc.	26.09.2010	924KB	1.1.3
Citavi 2.5	Academic Software Zurich	03.06.2010	59,2MB	2.5.2.0
Combined Community Codec Pack 2011-11-11	CCCP Project	25.11.2011	22,2MB	2011.11.11.0
Company of Heroes	THQ Inc.	03.09.2010	3,46GB	1.0.0.99
Compatibility Pack für 2007 Office System	Microsoft Corporation	10.10.2012	64,0MB	12.0.6612.1000
Crusader Kings II	Paradox	13.07.2012	1,04GB	
CyberLink DVD Suite	CyberLink Corp.	27.02.2009	16,6MB	6.0.2424
CyberLink YouCam	CyberLink Corp.	20.07.2009	79,8MB	2.0.2512
Dropbox	Dropbox, Inc.	16.03.2012	23,9MB	1.2.52
ElsterFormular	Landesfinanzdirektion Thüringen	13.01.2012	165MB	13.0.0.8086
Elsword_DE_Test		19.12.2011	1,70GB	
foobar2000 v0.9.6.9	Peter Pawlowski	19.11.2009	7,23MB	0.9.6.9
Future Wars		01.03.2010	378MB	
Google Chrome	Google Inc.	05.03.2011	352MB	22.0.1229.92
Greenshot		20.12.2010	1,61MB	
HijackThis 2.0.2	TrendMicro	04.04.2010	404KB	2.0.2
HP Active Support Library	Hewlett-Packard	27.02.2009	20,5MB	3.1.9.1
HP Customer Experience Enhancements	Hewlett-Packard	27.02.2009	0,98MB	5.7.0.2664
HP DVD Play 3.7	Hewlett-Packard	20.07.2009	74,7MB	3.7.0.5723
HP Help and Support	Hewlett-Packard Company	27.02.2009	30,6MB	2.1.3.0
HP Quick Launch Buttons 6.40 M1	Hewlett-Packard	27.02.2009	15,2MB	6.40 M1
HP Total Care Advisor	Hewlett-Packard	27.02.2009	21,7MB	2.4.5991.2847
HP Total Care Setup	Hewlett-Packard Company	27.02.2009		1.1.2413.2876
HP Update	Hewlett-Packard	09.09.2011	3,98MB	5.003.001.001
HP User Guides 0138	Hewlett-Packard	27.02.2009	153MB	1.01.0000
HP Wireless Assistant	Hewlett-Packard	27.02.2009	3,43MB	3.50 A6
IDT Audio	IDT	20.07.2009	34,3MB	1.0.6140.0
IrfanView (remove only)		03.12.2009	1,60MB	
Java DB 10.5.3.0	Sun Microsystems, Inc	16.03.2010	28,4MB	10.5.3.0
Java(TM) 6 Update 35	Oracle	07.10.2012	95,7MB	6.0.350
Java(TM) SE Development Kit 6 Update 18	Sun Microsystems, Inc.	16.03.2010	150MB	1.6.0.180
John's Background Switcher 4.1	johnsadventures.com	27.02.2010	2,25MB	4.1
LabelPrint	CyberLink Corp.	27.02.2009	241MB	2.5.1224
Left 4 Dead 2	Valve	26.06.2010	11,2GB	
Legend of Grimrock		01.07.2012	735MB	
LibUSB-Win32-0.1.10.1	LibUSB-Win32	27.06.2010	1,32MB	0.1.10.1
LightScribe System Software  1.14.17.1	LightScribe	20.07.2009	21,0MB	1.14.17.1
Machinarium	Daedalic Entertainment	20.10.2009	379MB	
Malwarebytes Anti-Malware Version 1.65.0.1400	Malwarebytes Corporation	07.10.2012	3,90MB	1.65.0.1400
Microsoft .NET Compact Framework 2.0 SP1	Microsoft Corporation	15.11.2010	91,0MB	2.0.6129
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU	Microsoft Corporation	19.10.2009	36,9MB	
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	17.10.2009	27,8MB	
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	25.06.2010	120MB	4.0.30319
Microsoft Office Live Add-in 1.5	Microsoft Corporation	22.04.2012	506KB	2.0.4024.1
Microsoft Office PowerPoint Viewer 2007 (German)	Microsoft Corporation	17.08.2012	88,9MB	12.0.6612.1000
Microsoft Security Essentials	Microsoft Corporation	26.09.2012	17,9MB	4.1.522.0
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	26.02.2012	294KB	8.0.61001
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022	Microsoft Corporation	03.06.2010	1,41MB	9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	17.10.2009	590KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	09.01.2012	590KB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	26.02.2012	594KB	9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	26.02.2012	11,1MB	10.0.40219
Microsoft Word 2002	Microsoft Corporation	23.04.2012	94,4MB	10.0.6626.0
Microsoft Works	Microsoft Corporation	10.10.2012	378MB	9.7.0621
Microsoft Works 2003-Setup-Start		20.10.2009	6,62MB	
Microsoft Works 7.0 	Microsoft Corporation	20.10.2009	185MB	07.02.0702
Microsoft Works Suite-Add-Ins für Microsoft Word	Microsoft Corporation	20.10.2009	36,9MB	2.0.0.0000
Mozilla Firefox 15.0.1 (x86 de)	Mozilla	09.09.2012	40,1MB	15.0.1
Mozilla Maintenance Service	Mozilla	09.09.2012	204KB	15.0.1
Mozilla Thunderbird (3.0.11)	Mozilla	18.12.2010	31,6MB	3.0.11 (de)
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	17.10.2009	1,27MB	4.20.9870.0
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	24.11.2009	1,33MB	4.20.9876.0
muvee Reveal	muvee Technologies Pte Ltd	20.07.2009	154MB	7.0.35.7918
My HP Games	WildTangent	20.07.2009	204MB	1.0.0.62
Network Stumbler 0.4.0 (remove only)		21.09.2010	760KB	
Notepad++		27.08.2011	11,5MB	5.9
NVIDIA 3D Vision Controller-Treiber 296.10	NVIDIA Corporation	11.04.2012	416KB	296.10
NVIDIA Grafiktreiber 296.10	NVIDIA Corporation	11.04.2012	43,4MB	296.10
NVIDIA HD-Audiotreiber 1.3.12.0	NVIDIA Corporation	11.04.2012	3,37MB	1.3.12.0
NVIDIA PhysX-Systemsoftware 9.12.0213	NVIDIA Corporation	11.04.2012	73,2MB	9.12.0213
NVIDIA Update 1.7.11	NVIDIA Corporation	11.04.2012	6,37MB	1.7.11
OpenOffice.org 3.1	OpenOffice.org	11.11.2009	355MB	3.1.9420
PDFCreator	Frank Heindörfer, Philip Chinery	26.04.2011	26,4MB	1.2.0
pdfsam		16.03.2010	14,1MB	2.1.0
Plants vs. Zombies	PopCap	23.07.2010	49,3MB	
Power2Go	CyberLink Corp.	27.02.2009	164MB	6.0.2423
PowerDirector	CyberLink Corp.	27.02.2009	467MB	7.0.2424
ProtectDisc Driver, Version 11	ProtectDisc Software GmbH	27.09.2010	92,0KB	11.0.0.14
Psi (remove only)		15.12.2010	56,7MB	
QuickTime	Apple Inc.	07.10.2012	73,2MB	7.72.80.56
Realtek 8169 8168 8101E 8102E Ethernet Driver	Realtek	20.07.2009	2,44MB	1.00.0000
Realtek USB 2.0 Card Reader	Realtek Semiconductor Corp.	20.07.2009	6,62MB	6.0.6000.20115
Rosetta Stone Version 3	Rosetta Stone Ltd.	28.05.2011	120MB	3.4.5.0
Sid Meier's Civilization 4	Firaxis Games	11.06.2010	1,46GB	1.00.0000
StarCraft II	Blizzard Entertainment	31.07.2010	8,01GB	1.0.1.16195
Steam	Valve Corporation	26.06.2010	42,2MB	1.0.0.0
Synaptics Pointing Device Driver	Synaptics	20.07.2009	16,0MB	12.1.0.0
System Requirements Lab		11.04.2012	392KB	
Team Fortress 2	Valve	12.06.2011	815MB	
Team Fortress 2 Beta	Valve	12.06.2011		
TERA	Frogster Online Gaming GmbH	06.05.2012	15,3GB	16.04
TomTom HOME 2.7.6.2056	TomTom	22.12.2010	48,8MB	2.7.6.2056
TomTom HOME Visual Studio Merge Modules	TomTom International B.V.	22.12.2010	1,88MB	1.0.2
VLC media player 1.0.2	VideoLAN Team	19.10.2009	74,7MB	1.0.2
Voxware Audio decoder 1.6		03.12.2009	796KB	1.6.0
Windows Live Messenger	Microsoft Corporation	27.02.2009	29,0MB	8.1.0178.00
WISO Steuer-Sparbuch 2012	Buhl Data Service GmbH	09.01.2012	465MB	19.00.7303
         

Systemreinigung und Prüfung:

► Wenn Du nun alle Schritte erledigt hast, melde dich mit die gewünschten Ergebnisse zurück!
Nur bei Probleme inzwischen melden!

1.
Windows Defender:
Parallel zu ein AV-Programm nicht Empfehlenswert aktiv laufen lassen, weil dadurch können sich in die Quere kommen. Bitte dich ihn so zu deaktivieren: -> Aktivieren und Deaktivieren von Windows Defender
Windows Defender komplett deaktivieren

Start => Systemsteuerung => Klassische Ansicht => Windows Defender oder
Windows Defender starten (C:\Programme\Windows Defender\MSASCui.exe)

Extras => Optionen => Automatische Überprüfung => Haken bei "Computer automatisch überprüfen" entfernen.
Extras => Optionen => Echtzeitschutz => Haken bei "Echtzeitschutz aktivieren" entfernen.
Extras => Optionen => Administrator => Haken bei "Dieses Programm verwenden" entfernen.

Start => services.msc ins Suchfeld eingeben.
Es öffnet sich das Fenster der Dienste
Doppelklick auf den Dienst "Windows Defender"
Starttyp auf "Manuell" umstellen.
Dienststatus beenden, falls der Dienst noch gestartet ist.
► Nach einem Neustart (falls noch existirt) unter "Start-> ausführen-> "msconfig" (reinschreiben ohne ""-> OK -> Systemstart kontrolliere, ob mitläuft?! - ggf Häckhen rausnehmen
► Unter Dienste:
Start -> Ausführen -> "Services.msc" -> (reinschreiben ohne ""-> OK" - "Eigenschaften"-> "Stop" -> Starttyp "Deaktiviert" auswählen

2.

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTL

• Starte die OTL.exe.
• Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
• Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht - (also beginnend mit :OTL und am Ende [emptytemp]), alles was in der Codebox steht (ohne "code"!) :

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 -- (Norton Internet Security)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {EE97B51A-20F2-4B92-BE28-538D5E0DADA1}
IE - HKLM\..\SearchScopes\{82BD1D8A-D6EB-48F9-A5B2-6DDEB211E69D}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\..\SearchScopes\{D5EAC5D9-65CD-4613-8C90-3DC7FF70176A}: "URL" = http://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{EE97B51A-20F2-4B92-BE28-538D5E0DADA1}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {EE97B51A-20F2-4B92-BE28-538D5E0DADA1}
IE - HKCU\..\SearchScopes\{82BD1D8A-D6EB-48F9-A5B2-6DDEB211E69D}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\..\SearchScopes\{D5EAC5D9-65CD-4613-8C90-3DC7FF70176A}: "URL" = http://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{EE97B51A-20F2-4B92-BE28-538D5E0DADA1}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
FF - prefs.js..browser.search.defaultenginename: "foxsearch"
FF - prefs.js..browser.search.order.1: "foxsearch"
FF - prefs.js..browser.search.selectedEngine: "foxsearch"
FF - prefs.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - user.js..browser.search.selectedEngine: "foxsearch"
FF - user.js..browser.search.order.1: "foxsearch"
FF - user.js..browser.search.defaultenginename: "foxsearch"
FF - user.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Martin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Martin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
[2011.03.27 12:09:01 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0f6af035-badb-11de-b424-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{0f6af035-badb-11de-b424-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.bat
O33 - MountPoints2\{7a517519-0e6f-11e0-bd69-00238bfe89cb}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
O33 - MountPoints2\{b3db7868-5552-11df-8d10-00238bfe89cb}\Shell - "" = AutoRun
O33 - MountPoints2\{b3db7868-5552-11df-8d10-00238bfe89cb}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
[2012.10.10 11:17:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1365937600-1429004060-754325389-1000UA.job
[2012.10.09 18:17:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1365937600-1429004060-754325389-1000Core.job

:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         

• und füge es hier ein:
• Schließe alle Programme.
• Klicke auf den Fix Button.
• Klick auf .
• OTL verlangt einen Neustart. Bitte zulassen.
• Nach dem Neustart findest Du ein Textdokument.
  Kopiere den Inhalt hier in Deinen Thread.

3.
Hast du es denn in der Hosts selbst eingetragen bzw absichtlich zugefügt? Wenn ja, warum?

O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1       www.suchmaschine.de
O1 - Hosts: 127.0.0.1       suchmaschine.de
         

4.
Java aktualisieren- über Systemsteuerung-> Nach Update suchen...
oder:
Downloade nun die Offline-Version von Java "Empfohlen Version Java(TM) 7 Update 7 " von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.
Tipp: -> Java-Updates konfigurieren

5.
Alle Programme/Fenster schliessen
Java-Cache leeren

Start => Systemsteuerung => Java => Allgemein => Temporäre Internet-Dateien "Einstellungen" => Dateien löschen => Haken bei "Anwendungen und Applets" sowie bei "Verfolgungs- und Protokolldateien" setzen => OK
-> Wie leere ich den Java-Cache?
-> Java-Cache leeren
-> Kurze Videoanleitung wie man unter Windows 7 und XP den JAVA Cache löschen kann.

6.
Java :
Ältere Update-Versionen falls noch existieren, deinstallieren
► Die alte Java-Versionen verbleiben auf dem PC...aus Sicherheitsgründen müssen entfernt werden,auch in Zukunft darauf achten!

7.
Tipps - Der Internet Explorer von Microsoft gehört zur Grundausstattung unter Windows, somit wie alle andere installierte Software muss gepflegt werden! Auch bei Nicht-Verwendung!:
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8
-> Wie kann ich den Cache im Internet Explorer leeren?

8.
Aktualisieren: Alte Version deinstallieren und neue herunterladen:-> -> Firefox Kostenloser Download

Mozilla Thunderbird
         

aber Achtung!:
bei Bedarf, vorher für dich wichtige (Benutzerdefinierte) Einstellungen zu speichern:-> Mozilla Firefox Backup erstellen
Info:-> Firefox auf die letzte Version aktualisieren

9.
ALTE VERSION!!!:

Logfile of HijackThis 2.0.2 
         

Die neue Version gibt es hier:
also lösche/deinstalliere HijackThis "2.0.2." und lade Dir erneut von hier HijackThis v2.0.4 herunter

10.
Alle Programme/Fenster schliessen
reinige dein System mit CCleaner:

• "CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
• "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
• Starte dein System neu auf

11.
Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während der Online-Scans deaktivieren:
  Anti-Virus-Programm und Firewall.
• Internet Explorer starten => im Menü unter Extras => Internetoption => Datenschutz => den Haken bei "Popupblocker einschalten" entfernen und
• unter dem Reiter "Sicherheit" => die Sicherheitsstufe ggfs. auf "Mittelhoch" herabsetzen.
  Nicht vergessen, sie hinterher wieder einzuschalten bzw. die Internetoptionen wie zuvor einzustellen..
• Während der Online-Scans auf andere Online-Aktivitäten verzichten.
• Du musst das Herunterladen und Installieren von ActiveX-Steuerelementen (Controls) zulassen.
• 
  
  .

Den PC NUR online scannen und NICHT ein zweites Antivirenprogramm installieren!!!

• Eset Online Scanner (NOD32)
  • Unterstützte Betriebssysteme: Microsoft Windows 7 - Vista - XP - 2000 - NT.
  • Anmerkung für Vista und Windows 7-User: Bitte den Browser unbedingt als Administrator starten.
  • Dein Anti-Virus-Programm während des Scans deaktivieren.
  • Button "ESET Online Scanner" drücken.
  • IE-User müssen das Installieren eines ActiveX Elements erlauben.
  • Einen Haken bei "YES, I accept the Terms of Use." machen und auf den Button "Start" drücken.
  • Einen Haken bei "Remove found threads" und "Scan archives" machen.
  • Start drücken.
  • Signaturen werden heruntergeladen.
  • Der Scan beginnt automatisch.
  • Wenn fertig, das Protokoll speichern und mir posten.
    -> List of found threats
    -> Export to text file
    -> Back
    -> Delete quarantäne files
  • Finish drücken.
  • Browser schließen.
  • Deinstallation nachdem das Protokoll mir gepostet hast: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

12.
erneut einen Scan mit OTL:

• Doppelklick auf die OTL.exe
• Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
• Oben findest Du ein Kästchen mit Ausgabe.
  Wähle bitte Standard-Ausgabe
• Unter Extra-Registrierung wähle bitte Benutze SafeList.
• Mache Häckchen bei LOP- und Purity-Prüfung.
• Klicke nun auf Scan links oben.
• Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
  Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
• Poste die Logfiles in Code-Tags hier in den Thread.

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?