Hallo zusammen,

nach verschiedenen Downloads aus dem Internet hatte ich eine neue Startseite im Mozilla Firefox:
hxxp://www.searchplusnetwork.com/?sp=st3

Ich habe diese zurück geändert und auch den Suchdienst in den Systemsteuerungen/Netzwerk und Internet/Add-Ons entfernt.

Spätestens nach dem Neustart des PC´s war die unerwünschte Startseite wieder vorhanden. Zudem startet und läuft der PC extrem langsam.

Bei der Suche im Internet bin ich auf dieses Forum gestoßen und habe den vorgeschlagenen Scan mit Malwarebytes Anti-Malware durchgeführt.

Das logfile dazu habe ich angehängt. Bei dem Versuch alle gefundenen Einträge zu entfernen, hat das Programm nicht mehr geantwortet.

Falls jemand helfen kann - im Voraus vielen Dank!

Hallo und

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

• Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
  
  
• Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
  
  
• Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
  
  
• Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
  
  
• Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.

Das logfile dazu habe ich angehängt. Bei dem Versuch alle gefundenen Einträge zu entfernen, hat das Programm nicht mehr geantwortet.

Versuch es bitte mal im abgesicherten Modus mit Netzwerktreibern:


Abgesicherter Modus zur Bereinigung

• Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
• Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:
  
  

Hallo Cosinus,

ich habe den Scan im abgesicherten Modus nochmal laufen lassen und die infizierten Dateien konnten auch entfernt werden (unten das logfile).

Die Browser-Start-Seite "searchplusnetwork" erstellt sich weiterhin von selbst.


Logfile:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.07.07

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Werner :: Melanie-PC [Administrator]

07.11.2012 20:22:47
mbam-log-2012-11-07 (20-22-47).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 1158249
Laufzeit: 3 Stunde(n), 21 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 3
C:\Users\Werner.Melanie-PC\AppData\LocalLow\bbrs_002.tb (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Werner.Melanie-PC\AppData\LocalLow\bbrs_002.tb\content (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Werner.Melanie-PC\AppData\LocalLow\bbrs_002.tb\content\cache (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 12
C:\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2010-08-23\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2010-08-25\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2010-09-08\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2010-11-07\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2010-11-08\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2011-06-26\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2012-05-17\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2012-05-17\c\Users\Werner.Melanie-PC\Downloads\SoftonicDownloader_fuer_pazera-free-mov-to-avi-converter.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2012-09-19\c\Program Files\DVBViewerTE\SkystarIR.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2012-09-19\c\Users\Werner.Melanie-PC\AppData\Local\Temp\is1373634743\IWantThis_ROW.exe (Adware.GamePlayLabs) -> Erfolgreich gelöscht und in Quarantäne gestellt.
H:\Backup\2012-09-19\c\Users\Werner.Melanie-PC\Downloads\SoftonicDownloader_fuer_pazera-free-mov-to-avi-converter.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Bitte nun Logs mit GMER (<<< klick für Anleitung) und aswMBR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur aswMBR aus.

aswMBR-Download => aswMBR.exe - speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Hallo,

hat soweit beides geklappt...

GMER.exe
(habe ich als Anhang, da in Code-Tags eine Fehlermeldung wg. der Länge kam)

aswMBR.exe

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-10 13:18:55
-----------------------------
13:18:55.399    OS Version: Windows 6.0.6002 Service Pack 2
13:18:55.400    Number of processors: 2 586 0x170A
13:18:55.401    ComputerName: MELANIE-PC  UserName: Werner
13:18:57.946    Initialize success
13:24:06.074    AVAST engine defs: 12111001
13:24:37.577    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
13:24:37.580    Disk 0 Vendor: ST932032 0303 Size: 305245MB BusType: 3
13:24:37.608    Disk 0 MBR read successfully
13:24:37.612    Disk 0 MBR scan
13:24:37.624    Disk 0 unknown MBR code
13:24:37.631    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
13:24:37.649    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       147501 MB offset 20973568
13:24:37.685    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       143872 MB offset 323055616
13:24:37.722    Disk 0 Partition 4 00     12  Compaq diag NTFS         3630 MB offset 617705472
13:24:37.734    Disk 0 scanning sectors +625139712
13:24:37.828    Disk 0 scanning C:\Windows\system32\drivers
13:25:02.956    Service scanning
13:25:36.514    Modules scanning
13:25:43.612    Disk 0 trace - called modules:
13:25:43.650    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys 
13:25:43.657    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x875e6968]
13:25:43.664    3 CLASSPNP.SYS[8b3a28b3] -> nt!IofCallDriver -> [0x86b01260]
13:25:43.672    5 acpi.sys[806a06bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86580028]
13:25:44.903    AVAST engine scan C:\Windows
13:25:51.247    AVAST engine scan C:\Windows\system32
13:30:34.692    AVAST engine scan C:\Windows\system32\drivers
13:30:55.375    AVAST engine scan C:\Users\Werner.Melanie-PC
14:14:02.310    AVAST engine scan C:\ProgramData
14:18:44.510    Scan finished successfully
14:30:50.467    Disk 0 MBR has been saved successfully to "C:\Users\Werner.Melanie-PC\Desktop\MBR.dat"
14:30:50.475    The log file has been saved successfully to "C:\Users\Werner.Melanie-PC\Desktop\aswMBR.txt"
         

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Suche.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Hallo cosinus,

hier das logfile...

# AdwCleaner v2.007 - Datei am 11/11/2012 um 22:21:17 erstellt
# Aktualisiert am 06/11/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Werner - Melanie-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Werner.Melanie-PC\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****

Gefunden : Browser Manager

***** [Dateien / Ordner] *****

Datei Gefunden : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gefunden : C:\user.js
Ordner Gefunden : C:\Program Files\BabylonToolbar
Ordner Gefunden : C:\Program Files\Claro LTD
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\Browser Manager
Ordner Gefunden : C:\ProgramData\Tarma Installer
Ordner Gefunden : C:\Users\WERNER.MEL\AppData\Local\Temp\BabylonToolbar

***** [Registrierungsdatenbank] *****

Daten Gefunden : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\browse~1\24897~1.175\{61d8b~1\browse~1.dll
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Savings Sidekick
Schlüssel Gefunden : HKCU\Software\BabylonToolbar
Schlüssel Gefunden : HKCU\Software\Claro LTD
Schlüssel Gefunden : HKCU\Software\Cr_Installer
Schlüssel Gefunden : HKCU\Software\DataMngr
Schlüssel Gefunden : HKCU\Software\DataMngr_Toolbar
Schlüssel Gefunden : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\claro
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Savings Sidekick
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\Software\BabylonToolbar
Schlüssel Gefunden : HKLM\Software\BrowserCompanion
Schlüssel Gefunden : HKLM\Software\Claro LTD
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\wit4ie.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\b
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{05340575-7D2A-4266-9A84-7EEBDC476884}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022502260}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97C47A30-3CFB-474B-94E3-6019A7EE0610}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE4FC43F-84CE-4E20-88C2-2188525B47FB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0005060.BHO
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0005060.Sandbox
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0005060.Sandbox.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066506660}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gefunden : HKLM\Software\DataMngr
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{60295942-9E5F-4EE8-B785-3A655904D24F}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\claro
Schlüssel Gefunden : HKLM\Software\Tarma Installer
Schlüssel Gefunden : HKU\S-1-5-21-867037389-2716403915-2899764991-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{9E131A93-EED7-4BEB-B015-A0ADB30B5646}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D0F4A166-B8D4-48b8-9D63-80849FE137CB}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchplusnetwork.com/?sp=st3
[HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] = hxxp://www.claro-search.com/?affID=114508&tt=4512_6&babsrc=HP_clro&mntrId=5870fbac00000000000000216b0e8fb4

-\\ Mozilla Firefox v16.0.2 (de)

*************************

AdwCleaner[R1].txt - [11264 octets] - [11/11/2012 22:21:17]

########## EOF - C:\AdwCleaner[R1].txt - [11325 octets] ##########
         

Versuch bitte alle im adwCleaner-Log erwähnten Einträge (wie zB Babylon oder Tarma) über die Systemsteuerung zu deinstallieren, danach ein neues Suchlog mit dem adwCleaner machen.
Reste und was sich nicht deinstallieren lassen will machen wir mit dem adwCleaner weg.

Hallo,

Babylon war die einzige SW, welche sich über Systemsteuerung deinstallieren ließ. Beim Löschen des Rests über adwCleaner blieb das Programm zunächst hängen; im abgesicherten Modus hat´s dann funktioniert. Die Startseite des Browsers wurde auch auf google.com geändert.

Nach dem Neustart des PC´s wird die Startseite (in Firefox) jedoch wieder auf hxxp://www.searchplusnetwork.com/?sp=st3 zurückgeändert.

Anschließender Suchlauf:

# AdwCleaner v2.007 - Datei am 12/11/2012 um 21:35:42 erstellt
# Aktualisiert am 06/11/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Werner - MELANIE-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Werner.Melanie-PC\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchplusnetwork.com/?sp=st3

-\\ Mozilla Firefox v16.0.2 (de)
         

Nochmal bereinigt (diesmal normal gebootet) und hier das logfile:
(Interessanertweise findet er den searchplusnetwork-Wert aber nicht bei Firefox, meinem Standard-Browser):

# AdwCleaner v2.007 - Datei am 12/11/2012 um 21:44:43 erstellt
# Aktualisiert am 06/11/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Werner - MELANIE-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Werner.Melanie-PC\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchplusnetwork.com/?sp=st3 --> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.2 (de)

*************************

AdwCleaner[R1].txt - [11395 octets] - [11/11/2012 22:21:17]
AdwCleaner[R2].txt - [6076 octets] - [12/11/2012 20:42:05]
AdwCleaner[R3].txt - [6006 octets] - [12/11/2012 20:50:33]
AdwCleaner[R4].txt - [1116 octets] - [12/11/2012 21:12:53]
AdwCleaner[R5].txt - [1176 octets] - [12/11/2012 21:22:33]
AdwCleaner[R6].txt - [1296 octets] - [12/11/2012 21:35:42]
AdwCleaner[R7].txt - [1357 octets] - [12/11/2012 21:44:31]
AdwCleaner[S1].txt - [436 octets] - [12/11/2012 20:44:36]
AdwCleaner[S2].txt - [5845 octets] - [12/11/2012 20:51:05]
AdwCleaner[S3].txt - [1215 octets] - [12/11/2012 21:13:18]
AdwCleaner[S5].txt - [1326 octets] - [12/11/2012 21:44:43]

########## EOF - C:\AdwCleaner[S5].txt - [1386 octets] ##########
         

Eine Kontrolle mit OTL bitte:

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in CODE-Tags in den Thread.

Hallo cosinus,

hier die beiden logfiles...

OTL.Txt:

OTL logfile created on: 13.11.2012 22:17:39 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Werner.Melanie-PC\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 46,94% Memory free
6,19 Gb Paging File | 4,62 Gb Available in Paging File | 74,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 93,14 Gb Free Space | 64,66% Space Free | Partition Type: NTFS
Drive D: | 140,50 Gb Total Space | 81,16 Gb Free Space | 57,77% Space Free | Partition Type: NTFS
Drive H: | 465,64 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: FAT32
 
Computer Name: MELANIE-PC | User Name: Werner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Werner.Melanie-PC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (Adobe Systems, Inc.)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion\tbhcn.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Users\WERNER.MEL\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
PRC - C:\Programme\TechniSat DVB\bin\Server4PC.exe (TechniSat Digital, S.A.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\ACER\Mobility Center\MobilityService.exe ()
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion\tbhcn.exe ()
MOD - C:\Programme\WISO\Steuersoftware 2012\wgui12.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\wcore12.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\wauff12.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\wfvie12.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\wreli12.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\wsteu12.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\rsguiwinapi47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\rscorewinapi47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe ()
MOD - C:\Programme\WISO\Steuersoftware 2012\rsodbc47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\rsdcom47.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtsqlrs47.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtcluceners47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\phononrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtwebkitrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qttestrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtscriptrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtsvgrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtguirs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qt3supportrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtnetworkrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtxmlrs47.dll ()
MOD - C:\Programme\WISO\Steuersoftware 2012\qtcorers47.dll ()
MOD - C:\Programme\Google\Google Desktop Search\gzlib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3010.0__4df5dcab8860d239\Framework.Utility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3010.0__3036420f80dd6947\Framework.Library.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3010.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll ()
MOD - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ShowErrMsg.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll ()
MOD - C:\Programme\TechniSat DVB\bin\libbz2.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Programme\Cyberlink\Shared files\richvideops.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AVGIDSAgent) -- C:\Programme\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avgwd) -- C:\Programme\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (eDataSecurity Service) -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (IAANTMON) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (MobilityService) -- C:\ACER\Mobility Center\MobilityService.exe ()
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (CCALib8) -- C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (VcommMgr) -- System32\Drivers\VcommMgr.sys File not found
DRV - (VComm) -- system32\DRIVERS\VComm.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IvtBtBUs) -- System32\Drivers\IvtBtBus.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (BtHidBus) -- System32\Drivers\BtHidBus.sys File not found
DRV - (Btcsrusb) -- System32\Drivers\btcusb.sys File not found
DRV - (BT) -- system32\DRIVERS\btnetdrv.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (L1E) -- C:\Windows\System32\drivers\L1E60x86.sys (Atheros Communications, Inc.)
DRV - (btnetBUs) -- C:\Windows\System32\drivers\btnetBus.sys ()
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (A310) -- C:\Windows\System32\drivers\AVerA310USB.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (BDASwCap) -- C:\Windows\System32\drivers\AVerA310Cap.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (SKYNETU2) -- C:\Windows\System32\drivers\SkyNETU2.sys (TechniSat Digital, S.A.)
DRV - (WSVD) -- C:\Windows\System32\drivers\WSVD.sys (CyberLink)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (FDLUBASE) -- C:\Windows\System32\drivers\fdlubase.sys (AVM Berlin)
DRV - (AVMDSLPPPOE) -- C:\Windows\System32\drivers\avmdsloe.sys (AVM GmbH)
DRV - (AVMNDSL) -- C:\Windows\System32\drivers\avmndsl.sys (AVM GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchplusnetwork.com/?sp=st3
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 98 FB 08 64 E9 B4 CD 01  [binary data]
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.searchplusnetwork.com/?sp=st3&q={searchTerms}
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rlz=1I7ACAW_de&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = hxxp://127.0.0.1:4664/search&s=vp5LyZxbxiWw2TMrYjeklBFLn0Q?q={searchTerms}
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Plus! Network"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.searchplusnetwork.com/?sp=st3"
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.27 15:16:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.27 15:16:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.11.04 22:06:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{dfefbe51-ca52-484b-adf0-6b158b05262d}: C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\FirefoxExtension
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.27 15:16:39 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.27 15:16:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.11.04 22:06:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2010.10.06 20:29:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Werner.Melanie-PC\AppData\Roaming\mozilla\Extensions
[2010.10.06 20:29:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Werner.Melanie-PC\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.11.12 21:21:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Werner.Melanie-PC\AppData\Roaming\mozilla\Firefox\Profiles\kg92xptu.default\extensions
[2012.11.13 15:07:33 | 000,002,790 | ---- | M] () -- C:\Users\Werner.Melanie-PC\AppData\Roaming\mozilla\firefox\profiles\kg92xptu.default\searchplugins\Plusnetwork.xml
[2012.10.27 15:16:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.10.27 15:16:33 | 000,000,000 | ---D | M] (BlueSoleil Extension) -- C:\Programme\Mozilla Firefox\extensions\{231D7D17-4F1B-4933-AB61-E502DB82FD11}
[2009.06.26 08:15:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.10.27 15:16:39 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.27 13:50:10 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.15 10:53:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.31 08:19:38 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.05.15 10:53:34 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.05.15 10:53:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.05.15 10:53:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.05.15 10:53:34 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.09.29 11:16:28 | 000,000,054 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-867037389-2716403915-2899764991-1000..\Run: [ALBATTTOOL] C:\Program Files\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe File not found
O4 - HKU\S-1-5-21-867037389-2716403915-2899764991-1000..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Users\Werner.Melanie-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk = C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion\tbhcn.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2AEAD417-50F6-4167-9945-2CC761DF5CF0}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3118D1D9-7D16-469D-9DCD-5447DA48A25D}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3AF28EFE-94B7-431B-B73C-85C3903CA838}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9EF74698-6EBC-4131-A93C-73EBD19FB2D1}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B17F99B0-ADD5-42CE-8177-B2ECC911DC7F}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D21B06EC-EDA8-4C2F-8B05-C28560212C27}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DD9E0AD0-D419-4C92-9E17-FD1AFF81B5FD}: DhcpNameServer = 0.0.0.0
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk H:\
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.13 22:15:30 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Werner.Melanie-PC\Desktop\OTL.exe
[2012.11.10 13:18:12 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Werner.Melanie-PC\Desktop\aswMBR.exe
[2012.11.10 10:13:35 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Local\Avg2013
[2012.11.06 20:56:52 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Roaming\Malwarebytes
[2012.11.06 20:56:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.11.06 20:56:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.06 20:56:25 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.11.06 20:56:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.11.06 20:22:17 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Roaming\DriverCure
[2012.11.06 20:22:15 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Roaming\SpeedyPC Software
[2012.11.06 20:21:58 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedyPC Software
[2012.11.06 16:57:34 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Roaming\TuneUp Software
[2012.11.06 16:55:17 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2012.11.06 16:51:26 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.11.06 16:51:26 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Local\MFAData
[2012.11.06 16:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012.11.06 12:23:39 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Local\Savings Sidekick
[2012.11.06 12:22:15 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion
[2012.11.06 12:22:14 | 000,000,000 | ---D | C] -- C:\Program Files\GinyasBrowserCompanion
[2012.11.04 22:06:16 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2012.11.03 17:03:29 | 000,000,000 | ---D | C] -- C:\Users\Werner.Melanie-PC\AppData\Local\{2259DC03-1556-4A8B-A056-F8D7CD02716E}
[2012.10.27 15:16:32 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\Users\Werner.Melanie-PC\Desktop\*.tmp files -> C:\Users\Werner.Melanie-PC\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.13 22:15:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Werner.Melanie-PC\Desktop\OTL.exe
[2012.11.13 22:03:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.13 21:34:50 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.13 21:34:50 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.13 15:28:12 | 000,623,280 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.13 15:28:12 | 000,591,320 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.13 15:28:12 | 000,125,378 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.13 15:28:12 | 000,103,194 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.13 15:03:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.13 14:57:43 | 000,129,421 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.11.13 13:35:22 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2012.11.13 13:34:49 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat
[2012.11.13 13:34:31 | 3215,843,328 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.12 21:01:50 | 000,008,268 | ---- | M] () -- C:\Users\Werner.Melanie-PC\AppData\Local\d3d9caps.dat
[2012.11.12 20:44:38 | 000,000,046 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2012.11.12 12:27:00 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.11.11 22:20:22 | 000,541,569 | ---- | M] () -- C:\Users\Werner.Melanie-PC\Desktop\adwcleaner.exe
[2012.11.10 21:37:55 | 004,971,307 | ---- | M] () -- C:\Users\Werner.Melanie-PC\Desktop\Dünnfilmschmierung.zip
[2012.11.10 14:56:28 | 000,057,765 | ---- | M] () -- C:\Users\Werner.Melanie-PC\Desktop\Gmer.zip
[2012.11.10 14:30:50 | 000,000,512 | ---- | M] () -- C:\Users\Werner.Melanie-PC\Desktop\MBR.dat
[2012.11.10 13:18:34 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Werner.Melanie-PC\Desktop\aswMBR.exe
[2012.11.09 21:53:21 | 000,302,592 | ---- | M] () -- C:\Users\Werner.Melanie-PC\Desktop\v6mscxl2.exe
[2012.11.08 20:20:47 | 000,000,862 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012.11.06 20:56:31 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.06 16:37:06 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.11.06 16:37:06 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.11.06 12:22:17 | 000,002,232 | ---- | M] () -- C:\Users\Werner.Melanie-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk
[2012.11.06 12:22:17 | 000,000,043 | ---- | M] () -- C:\END
[1 C:\Users\Werner.Melanie-PC\Desktop\*.tmp files -> C:\Users\Werner.Melanie-PC\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.12 21:03:27 | 3215,843,328 | -HS- | C] () -- C:\hiberfil.sys
[2012.11.12 20:44:38 | 000,000,046 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2012.11.11 22:20:21 | 000,541,569 | ---- | C] () -- C:\Users\Werner.Melanie-PC\Desktop\adwcleaner.exe
[2012.11.10 21:37:55 | 004,971,307 | ---- | C] () -- C:\Users\Werner.Melanie-PC\Desktop\Dünnfilmschmierung.zip
[2012.11.10 14:56:28 | 000,057,765 | ---- | C] () -- C:\Users\Werner.Melanie-PC\Desktop\Gmer.zip
[2012.11.10 14:30:50 | 000,000,512 | ---- | C] () -- C:\Users\Werner.Melanie-PC\Desktop\MBR.dat
[2012.11.09 21:53:20 | 000,302,592 | ---- | C] () -- C:\Users\Werner.Melanie-PC\Desktop\v6mscxl2.exe
[2012.11.06 20:56:31 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.06 16:57:35 | 000,000,862 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012.11.06 12:22:17 | 000,002,232 | ---- | C] () -- C:\Users\Werner.Melanie-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk
[2012.11.06 12:22:17 | 000,000,043 | ---- | C] () -- C:\END
[2012.05.12 14:06:36 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2012.02.19 21:44:27 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2011.10.12 08:33:00 | 000,000,000 | ---- | C] () -- C:\Users\Werner.Melanie-PC\AppData\Local\{2B231397-8F08-4D13-973B-82B09234CA6F}
[2011.05.10 09:37:07 | 000,000,090 | ---- | C] () -- C:\Windows\combit.ini
[2011.05.09 20:26:10 | 000,000,907 | ---- | C] () -- C:\Windows\CMBTLL.ini
[2011.05.09 20:25:48 | 000,000,278 | ---- | C] () -- C:\Windows\CMBTCTL.INI
[2011.05.09 20:21:19 | 000,002,848 | ---- | C] () -- C:\Windows\WINNOTE.INI
[2011.05.09 20:20:51 | 000,673,376 | ---- | C] () -- C:\Windows\System32\highedit.dll
[2011.05.09 20:20:51 | 000,076,608 | ---- | C] () -- C:\Windows\System32\hertf.dll
[2011.05.09 20:20:51 | 000,049,776 | ---- | C] () -- C:\Windows\System32\hedlg.dll
[2011.05.09 20:20:51 | 000,038,032 | ---- | C] () -- C:\Windows\System32\hetools.dll
[2011.05.09 20:20:51 | 000,030,160 | ---- | C] () -- C:\Windows\System32\heicon.dll
[2011.05.09 20:20:51 | 000,027,488 | ---- | C] () -- C:\Windows\System32\heimgman.dll
[2011.05.09 20:20:50 | 000,007,008 | ---- | C] () -- C:\Windows\System32\Setupkit.dll
[2011.05.09 20:20:28 | 000,000,095 | ---- | C] () -- C:\Windows\ESSKW.DLL
[2011.04.08 20:12:12 | 049,541,632 | R--- | C] () -- C:\Users\Werner.Melanie-PC\6633DAD4AF1F4EB8862016EFDA19AE48.0.pps
[2009.12.28 16:54:37 | 000,000,552 | ---- | C] () -- C:\Users\Werner.Melanie-PC\AppData\Local\d3d8caps.dat
[2009.08.04 21:44:04 | 000,001,074 | RH-- | C] () -- C:\Users\Werner.Melanie-PC\XrxWm.ini
[2009.08.04 21:44:04 | 000,000,522 | RH-- | C] () -- C:\Users\Werner.Melanie-PC\xw45cpdy.dyc
[2009.06.09 16:59:46 | 000,008,268 | ---- | C] () -- C:\Users\Werner.Melanie-PC\AppData\Local\d3d9caps.dat
[2009.02.25 22:18:03 | 000,129,421 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.02.25 22:14:46 | 000,129,421 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.02.22 21:04:23 | 000,211,456 | ---- | C] () -- C:\Users\Werner.Melanie-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
         

Extras.Txt:

OTL Extras logfile created on: 13.11.2012 22:17:39 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Werner.Melanie-PC\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 46,94% Memory free
6,19 Gb Paging File | 4,62 Gb Available in Paging File | 74,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 93,14 Gb Free Space | 64,66% Space Free | Partition Type: NTFS
Drive D: | 140,50 Gb Total Space | 81,16 Gb Free Space | 57,77% Space Free | Partition Type: NTFS
Drive H: | 465,64 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: FAT32
 
Computer Name: MELANIE-PC | User Name: Werner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\PPMate\ppmate.exe" = C:\Program Files\PPMate\ppmate.exe:*:Enabled:PPMate
"C:\Program Files\PPMate\ppmnet.exe" = C:\Program Files\PPMate\ppmnet.exe:*:Enabled:PPMate
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036D70D1-DF15-4B00-AA16-D4BA38776F8A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{110A1110-6477-4189-A07B-46E6A9D29EA1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{12829719-1A8D-4EA9-9ABA-4AD31B3717A0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{1D642FB7-FAB6-4992-BEC2-48A0B1312C28}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{2147401E-2162-4599-AA2E-8FAD682557AF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{235225F0-33BD-4B4E-9EE8-FC1EC5DA999E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{24A91DB8-D9C2-43EE-8789-A9DF0EA9F018}" = rport=138 | protocol=17 | dir=out | app=system | 
"{26D39B30-8107-4A9C-A084-77877701FD62}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{272AD2D4-0219-435E-88BA-2048116BCBF6}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{2F335023-3F30-4972-8F2A-FFC090AD4E2E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3BCDD3CF-32ED-44AE-AA7F-37CCD35FB974}" = rport=445 | protocol=6 | dir=out | app=system | 
"{4457CA15-696D-4EEB-A299-9769295DB9CC}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{4473F167-0AB9-4215-B7E2-2443B60B4270}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{45C8113A-9106-4525-9277-BFC8DB1B009E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{61D63516-B360-435B-A87A-FA31D2A37060}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6DC38F96-403F-4A98-A698-610EEF5A78BC}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9091AF20-47C0-4B4A-9F70-58B82959EA59}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{96656C03-D904-4C7D-8D5B-01288C45127F}" = lport=138 | protocol=17 | dir=in | app=system | 
"{A44C6BA5-8F17-4EF1-803F-4E356177A49A}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{A8C221FF-80B8-4470-875E-8FB0C5CEE5D1}" = lport=137 | protocol=17 | dir=in | app=system | 
"{C8A33A00-2589-40B6-822A-4978B280F1A1}" = lport=445 | protocol=6 | dir=in | app=system | 
"{D002423D-58D3-450A-8667-08222917E81C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{D1EB9908-99FE-4FEC-AF89-87839F4C0BF2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D54B8A1A-9B16-456A-9D34-A3FCA4CDB5C6}" = rport=139 | protocol=6 | dir=out | app=system | 
"{DE8EE842-27A2-4A11-B116-FB42F4C84BB1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E01152F7-ECAA-4FCD-99C8-289E7B1A9177}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E10444E5-D929-4C86-81E2-4DEBB39CC14B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E84D1D8B-D0E4-48BD-8495-BE46974662A3}" = rport=137 | protocol=17 | dir=out | app=system | 
"{EAD9DD92-C718-4C2C-90CA-B26D89B1CA8A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{061C83BF-0832-4AAF-9F07-BE813377493C}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{07774A46-222E-4FF0-83B2-4A48CBF934B0}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{085EB1A1-066A-40BD-90A7-0CC023A42C15}" = dir=in | app=c:\users\werner.mel\appdata\local\temp\ibtmpf30f532\component_567 | 
"{136854FE-8BD9-4DD2-A370-70F8EB9AC751}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{140E3806-DF45-42D8-BB4C-5A7DC28DF8B9}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | 
"{148B3A7E-57B5-4EA4-8308-039A1058130F}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | 
"{1C5C5C78-5EC1-4995-BD79-6ADBF7E29FED}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | 
"{1E2146F6-35E8-479D-8E92-B7F7F3ABEF66}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{243AD159-7946-45A3-8E34-8706D0157B36}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe | 
"{27D67D5B-6839-4ADD-96CE-E65506F21D8B}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe | 
"{2ECB4E8B-F80C-49FC-A3F9-11103CAD2E28}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{2FA472A3-3C83-4941-8CDE-DF263991D4CE}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{309544B4-5089-4550-A278-8AADDB83277C}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{3942F869-D327-450B-AB0C-35E8D0EA0673}" = protocol=6 | dir=out | app=system | 
"{3BE5473D-7C67-474F-9BC8-627E6687B9A6}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{4317A114-C8CB-4711-A964-E903EE20B27D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{43D194AB-61F4-42B7-A933-100E496D6AE1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{43DCC056-8400-481A-9D36-5A38E57764A1}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{463440D0-C136-4363-BB4B-6BAE6AAD4B2C}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | 
"{473D7271-CDCD-4D61-A60D-7C82EC0F52A5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4B3B2CB8-E638-49BC-95B7-D384834C5EE2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{50EC080D-61BB-44E4-A351-BB99C6092169}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{526F995D-A6C6-433D-8846-CE61A09453A1}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{56CADE48-5F5C-42CE-8481-64A3CDA533AF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{5ECD0B7E-9235-4E42-9472-84C8562C4CB8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{609E7FC4-272D-4B6A-9401-78E3F4A41E6D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{67C52B50-7FBC-4537-A760-1AEEA4068131}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{688F8013-2B3F-435A-BD8F-F402ACAB16D4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7803D87D-0CF2-428D-B405-94D0F03A0E60}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{812BF962-6FDE-45E1-BC43-2E4BB85D4017}" = dir=in | app=c:\users\werner.mel\appdata\local\temp\ibtmpf30f532\component_552.decrpt | 
"{8300484D-B674-4635-9F1C-4A760380D801}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{86D24BD9-3A52-4A6D-808A-611CF7EA8472}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{89D8DF63-F49D-4E87-BB1A-37F19F1E507B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8E9A6CD4-2DBD-4AF9-B502-2A251C0A520C}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{926DCBAE-E62D-41B4-AA2E-A20786721E4A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{92D93B01-C1FB-4ED9-884B-9EE546C3C3C2}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{93743082-45EF-4495-9A79-98037023CCBE}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{9400CCEB-6645-4B9C-9F09-8A30E873ECA4}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{9A8F0E47-64DF-4349-A9BD-7D1EAFC982C8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A112F16A-862C-4D4B-AC07-71FE1E6B7821}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{A66B705C-0DBF-414E-BB39-291917264C7A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{AA6452B2-4CE2-4F00-AC91-EE0A5BDF2CE4}" = protocol=17 | dir=in | app=c:\users\werner.melanie-pc\downloads\sweetimsetup.exe | 
"{B3CB58A8-E2B1-4627-8287-FD6815F8C002}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{BDFDE122-1C6D-4E6C-A88D-8C89C264B1AF}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{C03B7782-C3E0-46A4-AA59-C9FAEC707ABA}" = protocol=6 | dir=in | app=c:\users\werner.melanie-pc\downloads\sweetimsetup.exe | 
"{C1CF9554-9D54-44C7-9F76-FCE849912332}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{D1DC00D1-1A7A-4192-AF3F-4408C213F9A9}" = dir=in | app=c:\users\werner.mel\appdata\local\temp\ibtmpf30f532\component_558 | 
"{D7733B63-C177-433F-9B00-33A8A8809B76}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{DD94DB9D-CA95-4FEC-80AF-CE7C74422DC3}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe | 
"{DE199934-73A3-442A-9DB7-CBD9E4DC6173}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe | 
"{FE79CFC5-5A94-4C9A-B727-1A31B1101BBA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FFD944AB-87D8-4BDF-8CB9-E4C55BC81CB4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{1CA57BE6-91BF-4735-9590-0D179FF83BE7}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe | 
"TCP Query User{2B61726A-50C0-4B89-8AC7-0C6B0635B196}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{4D6633AD-48A8-4F56-BE3D-12783DA608B5}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{648B9227-55BC-4872-912E-5018C450ABCA}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{7A86646B-4400-469A-A78A-D9A444EA054C}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{7DB9F826-57DB-41D3-AB0A-2429B4FD25A5}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{82FF5E34-A72F-4B44-AC8B-1E7713F1E2CA}C:\program files\dvbviewerte\skystarir.exe" = protocol=6 | dir=in | app=c:\program files\dvbviewerte\skystarir.exe | 
"TCP Query User{8F704FE5-77CB-4F0F-ADA0-C4A710377492}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 
"TCP Query User{97300908-A9ED-4BB1-9AAC-65CF0EEB1F91}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{9E4A47A1-2E9A-4A62-A38C-2685C0835E51}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{A5ACD582-A79E-4832-A76B-DF195A14D4F2}C:\program files\ppmate\ppmnet.exe" = protocol=6 | dir=in | app=c:\program files\ppmate\ppmnet.exe | 
"TCP Query User{AAFEBBA9-ABCB-42A9-9200-833DD7D64415}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"TCP Query User{AD8388CB-10DA-49D8-96D5-24B2F652B7D8}C:\program files\dvbviewerte\skystarir.exe" = protocol=6 | dir=in | app=c:\program files\dvbviewerte\skystarir.exe | 
"TCP Query User{D0B8D4F9-2EE2-49D2-9D24-BC7EFFEEB354}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{01F07FF8-938D-4A51-97AE-735CE91FD556}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe | 
"UDP Query User{293B5481-9BF9-456C-B023-D54282BC0395}C:\program files\dvbviewerte\skystarir.exe" = protocol=17 | dir=in | app=c:\program files\dvbviewerte\skystarir.exe | 
"UDP Query User{4A891EE8-CBEF-4315-9E18-20684201C171}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{6C6DE649-5E78-48A4-AFE4-0E7CECC613FA}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 
"UDP Query User{8C217B85-D120-4892-93F3-36AF153809E1}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"UDP Query User{A21B5802-E275-4619-9B76-03F24562E16E}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{B0F4AC60-DFE9-4AB6-8DF3-E25BC539F86A}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{B30130C2-AF19-4B1E-9B90-1869985E63C3}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{C29C38D4-D303-4ECC-BCC7-295452286B85}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{CCA9DFA4-0916-4826-8983-230BA4880E6D}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{D7ABCC4D-B521-4921-B99E-1D482D621351}C:\program files\ppmate\ppmnet.exe" = protocol=17 | dir=in | app=c:\program files\ppmate\ppmnet.exe | 
"UDP Query User{E01BC571-C57B-43A8-B865-F5BC7DFE9352}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{E1FC2A36-1DD6-4B8A-BDC1-E849EA778490}C:\program files\dvbviewerte\skystarir.exe" = protocol=17 | dir=in | app=c:\program files\dvbviewerte\skystarir.exe | 
"UDP Query User{E8556C4E-D631-43B7-B643-4D0747AB6CD8}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{059A00AC-1205-423C-91C7-7E6168D804DA}" = MainConcept DTV Decoder Standard
"{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Camera Window DS
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{10F498FF-5392-4DF3-8F73-FE172A9F3800}" = Winbond CIR Device Drivers
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{134007CC-7026-46C2-B46F-40D9FD2AF385}" = Technisat DVB-VC80 Redistributable Modules
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{15DEF2B6-5C24-46D3-B79D-18B3B4A03385}" = EasyProfil
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FCB34FE-8BDA-4664-A231-A07A120159B0}" = CoCreate Modeling Personal Edition 3.0
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{40255140-E947-46E1-A841-C1F27AB309CB}" = AVG 2013
"{42442BC6-5A92-4BC2-9E0C-3D359D548A21}_is1" = Pazera Free MP4 to AVI Converter 1.6
"{46B70DEB-97B3-4E38-B746-EC16905E6A8F}" = WISO Sparbuch 2010
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DBBF091-FACD-422C-B43C-786335BD5398}" = MovieEdit Task
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Camera Window DVC
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Camera Window MC
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{810FB87E-B3F8-40E2-B1CD-0B138EE896A2}_is1" = TOPP Vorlagen-Druckstudio (5578)
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111872660}" = Diner Dash Flo on the Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = PhotoStitch
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Camera Access Library
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93973C6B-F862-4C16-84D1-7B675D650103}" = CANON iMAGE GATEWAY Task
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Camera Window DVC
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = RAW Image Task 2.2
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BD136CE7-6666-4273-A056-8D92F8625AAB}" = Sun ODF Plugin for Microsoft Office 3.2
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX (G)
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D032A7F0-8B5C-4603-8B46-235025D5F9C1}" = TechniSat DVB-PC TV Star
"{D0E8C34D-19D2-49FD-A900-88DEB788FF86}" = Internet Library
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG" = AVG 2013
"Avira AntiVir Desktop" = Avira Free Antivirus
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DeInst_d2vexcrd C:/Program Files/WR50" = WR50 Viewer basierend auf Geogrid®-Viewer Version 3.0
"dm-Fotowelt" = dm-Fotowelt
"DVBViewer_is1" = DVBViewer Technisat Edition
"FreePDF_XP" = FreePDF XP (Remove only)
"Geogrid_DPV" = Geogrid® DPV
"GinyasBrowserCompanion" = GinyasBrowserCompanion
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"GPL Ghostscript 8.64" = GPL Ghostscript 8.64
"GridVista" = Acer GridVista
"InstallShield_{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Canon Camera Window DSLR 5 for ZoomBrowser EX
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{4DBBF091-FACD-422C-B43C-786335BD5398}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"InstallShield_{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Canon Camera Window MC 6 for ZoomBrowser EX
"InstallShield_{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Canon Camera Access Library
"InstallShield_{93973C6B-F862-4C16-84D1-7B675D650103}" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D0E8C34D-19D2-49FD-A900-88DEB788FF86}" = Canon Internet Library for ZoomBrowser EX
"LiveUpdate" = LiveUpdate 2.6 (Symantec Corporation)
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Mediaport" = Mediaport
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Nussknacker 3" = Nussknacker 3
"Nussknacker 4" = Nussknacker 4
"Nussknacker Lehrersoftware" = Nussknacker Lehrersoftware
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"Ravensburger tiptoi" = Ravensburger tiptoi
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SopCast" = SopCast 3.2.4
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.4.9.1
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 2.0.1
"WinLiveSuite" = Windows Live Essentials
"ZDFmediathek_is1" = ZDFmediathek Version 1.4.3
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Sparbuch 2009
"{A1973A71-BC23-4A8C-A0A0-2B0497B7EAF4}" = WISO Sparbuch 2008
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 11.11.2012 03:20:12 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 04:01:17 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 15:34:54 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 15:50:02 | Computer Name = Melanie-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 12.11.2012 15:50:58 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 16:05:11 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 16:16:24 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 16:28:00 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.11.2012 16:47:55 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.11.2012 08:36:16 | Computer Name = Melanie-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 14.03.2010 08:03:41 | Computer Name = Melanie-PC | Source = MCUpdate | ID = 0
Description = Es konnte nicht auf den MCUpdate-Mutex gewartet werden. Ausnahme: 
'Der Wartezustand wurde aufgrund eines abgebrochenen Mutex beendet.'.
 
[ System Events ]
Error - 12.11.2012 16:16:25 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 12.11.2012 16:28:00 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7003
Description = 
 
Error - 12.11.2012 16:28:00 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 12.11.2012 16:28:00 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 12.11.2012 16:47:55 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7003
Description = 
 
Error - 12.11.2012 16:47:55 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 12.11.2012 16:47:55 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 13.11.2012 08:36:17 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7003
Description = 
 
Error - 13.11.2012 08:36:17 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 13.11.2012 08:36:17 | Computer Name = Melanie-PC | Source = Service Control Manager | ID = 7026
Description = 
 
 
< End of report >
         

Beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
MOD - C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion\tbhcn.exe ()
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.searchplusnetwork.com/?sp=st3&q={searchTerms}
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=vp5LyZxbxiWw2TMrYjeklBFLn0Q?q={searchTerms}
IE - HKU\S-1-5-21-867037389-2716403915-2899764991-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchplusnetwork.com/?sp=st3
FF - prefs.js..browser.search.selectedEngine: "Plus! Network"
FF - prefs.js..browser.startup.homepage: "http://www.searchplusnetwork.com/?sp=st3"
O4 - Startup: C:\Users\Werner.Melanie-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk = C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion\tbhcn.exe ()
[2009.08.04 21:44:04 | 000,001,074 | RH-- | C] () -- C:\Users\Werner.Melanie-PC\XrxWm.ini
[2009.08.04 21:44:04 | 000,000,522 | RH-- | C] () -- C:\Users\Werner.Melanie-PC\xw45cpdy.dyc
:Files
C:\Users\Werner.Melanie-PC\AppData\Roaming\GinyasBrowserCompanion
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hallo cosinus,

ich habe OTL mit dem Fix laufen lassen. Das Programm brachte nach kurzer Zeit keine Rückmeldung. Nach einer Stunde habe ich das Runterfahren erzwungen. Ein logfile wurde auch nicht angezeigt.

Allerdings ist die Browser-Startseite seit bereits 2mal booten konstant bei google.de geblieben.

Gibt es aus Deiner Sicht noch was zu tun?

Starte Windows neu im abgesicherten Modus (mit Netzwerktreibern nach Möglichkeit), manchmal hakt das Fixen mit OTL im normalen Modus aber sehr oft funktioniert der Fix im abgesicherte Modus.

Der Fix ist im abgesicherten Modus durchgelaufen und nach dem neu booten kam folgendes logfile:

Files\Folders moved on Reboot...
File\Folder C:\Users\Werner.Melanie-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...