Hallo,

ich habe auch den GVU Virus/Trojaner. Computer ist gesperrt, ich soll 100 € zahlen und links oben ist das Bild meiner Webcam.

Mit dem Kaspersky Windows Unlocker und der Anleitung von chip.de habe ich leider erfolglos probiert, das Problem zu lösen.

Bisher habe ich:
> mit F8 im abgesicherten Modus die Kaspersky Rescue Disk runtergeladen
> mir die Kaspersky Rescue Disk gebrannt & damit gebootet
> über den Textmodus den Unlocker ausgeführt -> ein paar Meldungen mit "Registry wurde geöffnet" sind angezeigt worden
> auch im Textmodus alle Partitionen meiner Festplatte überprüft & neu gebootet
Leider ist direkt nach dem der Computer hochgefahren war, wieder mit dem gleichen Bild der Computer gesperrt worden.

Bevor ich das Thema erstellt habe, habe ich wie in der Anleitung beschrieben, noch folgendes gemacht:

1. Defogger ausgeführt (ohne Fehlermeldung)
2. OTL Quickscan ausgeführt (Logs s.u.)
3. 64Bit-System --> Gmer nicht ausgeführt

OTL.txt

OTL logfile created on: 14.11.2012 23:16:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***Username\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,75 Gb Total Physical Memory | 3,23 Gb Available Physical Memory | 86,10% Memory free
7,50 Gb Paging File | 7,01 Gb Available in Paging File | 93,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 3,74 Gb Free Space | 7,66% Space Free | Partition Type: NTFS
Drive F: | 117,19 Gb Total Space | 21,73 Gb Free Space | 18,54% Space Free | Partition Type: NTFS
Drive G: | 57,77 Gb Total Space | 50,97 Gb Free Space | 88,24% Space Free | Partition Type: NTFS
 
Computer Name: ***PCName | User Name: ***Username | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.14 23:13:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***Username\Desktop\OTL.exe
PRC - [2011.02.12 10:27:53 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWOW64\rpcnet.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.06.29 18:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.03.02 19:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe -- (AESTFilters)
SRV - [2012.11.11 13:00:49 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.16 18:06:12 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.10.16 17:57:04 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Online\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.28 17:31:12 | 000,692,432 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Office\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate)
SRV - [2012.01.18 13:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.02.12 10:27:53 | 000,058,288 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\SysWOW64\rpcnet.exe -- (rpcnet)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009.07.16 10:59:00 | 000,648,432 | ---- | M] (SoftThinks) [Auto | Stopped] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)
SRV - [2009.06.29 18:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe -- (STacSV)
SRV - [2009.06.24 16:31:22 | 002,368,776 | ---- | M] (Sensible Vision ) [Auto | Stopped] -- C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FAService.exe -- (FAService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.03.02 19:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe -- (AESTFilters)
SRV - [2008.12.18 20:05:28 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Stopped] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2007.05.31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.12.19 17:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe -- (EpsonBidirectionalService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.04 12:07:05 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.09.13 15:52:59 | 000,099,248 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.06.29 18:39:46 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.06.29 18:39:46 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.09 00:32:08 | 000,769,816 | ---- | M] (www.ext2fsd.com) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ext2fsd.sys -- (Ext2Fsd)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.04 20:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.08.12 11:07:50 | 000,350,952 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2010.06.07 15:45:00 | 000,174,848 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2010.04.29 05:55:42 | 000,032,768 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\androidusb.sys -- (androidusb)
DRV:64bit: - [2009.10.24 00:49:46 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.08.05 20:37:04 | 000,046,792 | ---- | M] (GBM Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GRemoteJoy64.sys -- (GRemoteJoy)
DRV:64bit: - [2009.08.05 20:37:04 | 000,027,336 | ---- | M] (GBM Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GRemoteBus64.sys -- (GRemoteBus)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.06.29 18:44:38 | 000,487,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.06.27 00:55:10 | 000,083,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.06.26 18:23:30 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.24 15:43:54 | 000,059,392 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\itecir.sys -- (itecir)
DRV:64bit: - [2009.03.08 16:06:00 | 000,319,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\OA001Vid.sys -- (OA001Vid)
DRV:64bit: - [2009.03.06 06:33:58 | 000,159,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV:64bit: - [2008.12.23 18:11:38 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2008.12.23 18:11:34 | 000,036,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2008.12.23 18:11:32 | 000,133,672 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2008.12.23 18:11:30 | 000,095,784 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2008.11.11 21:05:30 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2008.11.11 21:05:28 | 000,062,976 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2008.11.11 21:05:26 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2008.09.25 02:36:14 | 000,238,848 | ---- | M] (Sensible Vision ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\facap.sys -- (FACAP)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.06.24 20:19:48 | 000,146,928 | ---- | M] (CyberLink Corp.) [2009/12/23 18:13:32] [Kernel | Auto | Stopped] -- C:\Program Files (x86)\Video\CyberLink\PowerDVD DX\000.fcl -- ({1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7})
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=DLCDF7&pc=MDDC&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = file://G:/Musik/Temp/RT/WebRip/profile/rrproxy_ie_5065ca11.pac
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.controllingportal.de/"
FF - prefs.js..extensions.enabledAddons: jl@leimbach-it.de:2.5
FF - prefs.js..extensions.enabledAddons: youtube2mp3@mondayx.de:1.2.3
FF - prefs.js..extensions.enabledAddons: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:2.0.7
FF - prefs.js..extensions.enabledAddons: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.15
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.6
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.1
FF - prefs.js..extensions.enabledItems: jl@leimbach-it.de:2.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..network.proxy.type: 2
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Multimedia\Sony Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.3: C:\Program Files (x86)\Media-Player\VideoLAN\npvlc.dll (the VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\***Username\AppData\Roaming\Move Networks\plugins\071803000001\npqmp071803000001.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\***Username\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{5FE7198A-5950-4068-9FBF-1A60395CC4E9}: C:\Program Files (x86)\Multimedia\1&1 SoftPhone\Firefox [2011.09.22 17:18:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Online\Mozilla Firefox\components [2012.08.05 11:16:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Online\Mozilla Firefox\plugins [2012.07.11 22:34:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Office\Mozilla Thunderbird\components [2012.07.12 18:08:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Office\Mozilla Thunderbird\plugins [2010.07.04 16:57:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Sunbird\Extensions\\{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}: C:\Program Files (x86)\Office\BirdieSync\Sunbird Service [2010.01.13 22:12:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}: C:\Program Files (x86)\Office\BirdieSync\Thunderbird Service [2010.01.13 22:12:19 | 000,000,000 | ---D | M]
 
[2009.12.23 17:09:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\Extensions
[2009.12.10 21:24:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.10.24 20:36:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\Firefox\Profiles\mb3ab5xj.default\extensions
[2010.03.25 21:22:13 | 000,000,000 | ---D | M] (GutscheinRausch.de) -- C:\Users\***Username\AppData\Roaming\mozilla\Firefox\Profiles\mb3ab5xj.default\extensions\jl@leimbach-it.de
[2011.12.16 22:19:42 | 000,011,510 | ---- | M] () (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\extensions\youtube2mp3@mondayx.de.xpi
[2012.08.23 16:24:39 | 000,341,143 | ---- | M] () (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2012.09.13 17:17:41 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2011.04.25 11:23:02 | 000,001,782 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\searchplugins\blindsearch.xml
[2011.04.25 11:23:02 | 000,003,485 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\searchplugins\cutlistat.xml
[2011.04.25 11:23:02 | 000,006,224 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\searchplugins\otr-searchcom.xml
 
O1 HOSTS File: ([2011.05.16 19:53:28 | 000,000,996 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1 im.adtech.de
O1 - Hosts: 127.0.0.1 adserver.adtech.de
O1 - Hosts: 127.0.0.1 adtech.de
O1 - Hosts: 127.0.0.1 atwola.com
O1 - Hosts: 127.0.0.1 adserver.71i.de
O1 - Hosts: 127.0.0.1 adicqserver.71i.de
O1 - Hosts: 127.0.0.1 71i.de
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (FAIESSOHelper Class) - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FAIESSO.dll (Sensible Vision )
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FAStartup]  File not found
O4 - HKLM..\Run: [FATrayAlert] C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FATrayMon.exe (Sensible Vision )
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKCU..\Run: [TrayBackup] C:\Program Files (x86)\Sicherheit\TrayBackup\traybackup.exe ((C) Michael Schiel)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe (Softthinks)
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation)
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk =  File not found
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrayIt!.lnk = C:\Program Files (x86)\System\TrayIt\trayit!.exe (Igor Nys)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\***Username\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\Office\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\***Username\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\Office\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @C:\Program Files (x86)\Office\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Office\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D9CB218-DF4D-4049-89F7-DE75453B9A9A}: NameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F18E17F4-FD72-442E-93A2-2E916F6E9E34}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\cdo - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\FastAccess: DllName - (C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FALogNot.dll) - C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FALogNot.dll ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f852b626-99f6-11e1-87f0-00225ff7ce9d}\Shell - "" = AutoRun
O33 - MountPoints2\{f852b626-99f6-11e1-87f0-00225ff7ce9d}\Shell\AutoRun\command - "" = D:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.14 23:13:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***Username\Desktop\OTL.exe
[2012.11.13 21:04:55 | 000,000,000 | ---D | C] -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
[2012.11.13 21:00:10 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe
[2012.11.04 20:43:27 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.11.04 10:46:37 | 000,000,000 | ---D | C] -- F:\Eigene Dateien\Programmieren
[2012.11.04 10:43:07 | 000,000,000 | ---D | C] -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programmieren
[2012.11.04 09:39:55 | 000,000,000 | ---D | C] -- C:\Users\***Username\AppData\Roaming\Avira
[2012.11.04 09:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.11.04 09:37:48 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.11.04 09:37:48 | 000,099,248 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.11.04 09:37:48 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.11.04 09:37:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.11.04 09:37:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.14 23:13:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***Username\Desktop\OTL.exe
[2012.11.14 23:08:43 | 000,000,000 | ---- | M] () -- C:\Users\***Username\defogger_reenable
[2012.11.14 23:08:13 | 000,050,477 | ---- | M] () -- C:\Users\***Username\Desktop\Defogger.exe
[2012.11.14 22:29:41 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.14 22:29:41 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.14 22:29:41 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.14 22:29:41 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.14 22:29:41 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.14 22:25:12 | 000,017,408 | ---- | M] () -- C:\Windows\SysNative\rpcnetp.exe
[2012.11.14 22:25:10 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWow64\rpcnet.dll
[2012.11.14 22:25:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.14 22:25:02 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.14 22:24:14 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.11.14 22:23:38 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.14 21:49:02 | 000,001,132 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.13 21:02:27 | 604,572,920 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.11.13 21:00:16 | 000,000,828 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.11.13 19:21:43 | 000,010,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.13 19:21:43 | 000,010,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.04 20:39:13 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.11.04 20:39:12 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
 
========== Files Created - No Company Name ==========
 
[2012.11.14 23:08:43 | 000,000,000 | ---- | C] () -- C:\Users\***Username\defogger_reenable
[2012.11.14 23:08:12 | 000,050,477 | ---- | C] () -- C:\Users\***Username\Desktop\Defogger.exe
[2012.11.13 21:02:27 | 604,572,920 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.11.13 21:00:16 | 000,000,828 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.11.13 21:00:13 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.11.04 20:39:13 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.11.04 20:39:12 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.09.28 14:58:42 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.22 13:36:10 | 000,000,890 | ---- | C] () -- C:\Windows\wiso.ini
[2011.10.07 19:15:11 | 000,017,408 | ---- | C] () -- C:\Users\***Username\AppData\Local\WebpageIcons.db
[2010.12.29 16:27:34 | 000,233,542 | ---- | C] () -- C:\Windows\SysWow64\vcdll.dll
[2010.12.29 16:27:34 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\GkSui20.EXE
[2010.12.29 16:26:42 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\astro32.dll
[2009.12.31 10:37:39 | 000,025,600 | ---- | C] () -- C:\Users\***Username\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.23 17:28:07 | 000,002,342 | ---- | C] () -- C:\Users\***Username\AppData\Local\Win7_tmp1.htm
[2009.12.20 16:57:14 | 000,009,347 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML
[2009.12.16 22:41:47 | 000,038,447 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
[2009.12.15 01:56:57 | 000,030,446 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2009.10.18 20:15:27 | 000,000,000 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\wklnhst.dat
[2008.10.30 10:49:34 | 000,000,022 | ---- | C] () -- C:\ProgramData\8f01a90e-7eb3-48d3-93b1-50d88fd146fb
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.09.22 17:21:40 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\1&1
[2011.07.30 21:10:43 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\ASCON Installer
[2012.05.09 17:57:42 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\BirdieSync
[2012.01.22 13:37:55 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Buhl Data Service
[2009.12.30 20:33:00 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\COWON
[2010.12.25 14:19:12 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.09.24 20:27:43 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Epson
[2009.12.23 17:09:37 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\EssentialPIM
[2010.07.26 22:09:19 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\FileZilla
[2010.06.30 09:11:17 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Foxit Software
[2011.11.30 23:04:11 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\FreePDF
[2010.01.03 11:04:46 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\GBM Software
[2012.11.11 15:57:24 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\ICQ
[2009.12.23 17:09:38 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\ImgBurn
[2011.01.25 23:37:36 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\LibreOffice
[2011.01.13 21:50:40 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\MAGIX
[2009.12.26 13:48:10 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Mp3tag
[2012.11.12 22:08:43 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\MyPhoneExplorer
[2011.04.23 11:23:52 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\OCS
[2009.12.23 17:09:44 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\OpenOffice.org
[2011.04.23 11:23:54 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Opera
[2009.12.25 23:15:30 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\RapidSolution
[2012.09.28 17:58:53 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Sony
[2011.09.11 21:56:56 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Template
[2009.12.23 17:09:46 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Thunderbird
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 143 bytes -> C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML:OECustomProperty
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:302A9871

< End of report >
         

Extras.txt

OTL Extras logfile created on: 14.11.2012 23:16:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***Username\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,75 Gb Total Physical Memory | 3,23 Gb Available Physical Memory | 86,10% Memory free
7,50 Gb Paging File | 7,01 Gb Available in Paging File | 93,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 3,74 Gb Free Space | 7,66% Space Free | Partition Type: NTFS
Drive F: | 117,19 Gb Total Space | 21,73 Gb Free Space | 18,54% Space Free | Partition Type: NTFS
Drive G: | 57,77 Gb Total Space | 50,97 Gb Free Space | 88,24% Space Free | Partition Type: NTFS
 
Computer Name: ***PCName | User Name: ***Username | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Online\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{17233E4E-5257-4B01-A814-F32473E71B7D}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{191FA77D-442E-4453-9B3B-13C5849A982C}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{1FAADFE4-ECE3-484F-B5A3-F8F5D59370A1}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2485D6E1-E351-44DF-BC76-C3EBC967030C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{2798C2D9-3DC5-44AD-8750-8A57F9AF1368}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{2ECE6BE7-CEF8-4AA7-BA2B-061147EABC6C}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{3EB5DCBC-4D0B-4835-AFCE-951F99E49BCF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{48D57AA1-A9F2-4DCE-B724-A64018BAF8F6}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{535BCFB7-B564-4E33-9E76-008FCADC0A10}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5650C46C-5BC0-42BA-8A2A-7A3F233BD1CC}" = rport=138 | protocol=17 | dir=out | app=system | 
"{61812BAA-5E0B-47EC-B540-8C0E20E19B04}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{61FD1420-13E2-4C07-BA7E-388A8FE070B0}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{64EE3BDF-6F96-44D2-A0F4-B65A5342EA98}" = lport=58927 | protocol=6 | dir=in | app=c:\program files (x86)\office\birdiesync\birdiesync.exe | 
"{6501E33F-A1DA-428C-AAFC-BD207168531F}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{6AE5A3C1-3426-4806-90E7-BE4E0658BE43}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{6FBE38F2-E01C-4180-A8D7-1AFF4D4F22E3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{775F35C9-1F1A-4B71-8380-C9742D3F98AD}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{77D50C52-BFAA-488C-8F37-375CC31780F7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{7C0852B4-6CD9-448A-A1EF-C42BA833227E}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{816D0516-72E5-4B91-9AA9-CBD2B3514C18}" = rport=445 | protocol=6 | dir=out | app=system | 
"{858535CC-244E-4BEC-A92D-E5528885C5C9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{869585AA-50BF-4C75-8251-4D1EA22257C4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{8A1E4731-64ED-4153-8C3D-DE68AE6DCE11}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8C50CEBE-4E01-4334-8568-5D6C4AA819D0}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{962664D8-AEEB-481B-B192-E264EF7F6BEE}" = rport=139 | protocol=6 | dir=out | app=system | 
"{96BCAC0A-8983-40BB-AA92-83812DDCC903}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{9D8E505D-82BF-482D-8DF2-EAF1FFFE4EC2}" = lport=139 | protocol=6 | dir=in | app=system | 
"{A158B2AE-04D6-4DB1-B882-D565AE3AB315}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A84FEBF1-FF13-402D-B788-57DE0C8FBBA5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A86ED0DD-3FDF-4F1E-A73D-38C8BEDEC363}" = lport=5656 | protocol=17 | dir=in | name=gremoteserver udp port | 
"{B37DEFF7-749E-4E26-9168-3BF34B7CDBF3}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B53C561F-A498-42C5-A30C-0EB9EACD1E81}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B5955F7E-F3D3-4934-BCF3-659D8FA256A4}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{C0910BAA-C263-4D17-BD9F-DB3CE56E9D68}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{C1366744-2AB7-49CC-8460-0992DF5B5A95}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{C3E78876-8443-4046-BAD6-73E93A8597A3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CA1594AA-9A4E-4942-8352-B1615514572D}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{CC2F63EE-C5BD-437A-9117-0DD43CC3188E}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{CEA96809-7F00-4DF7-A97E-D2FEA95ED4B4}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CEFD0DEB-2B13-45E0-B857-DFBA6E3166F4}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D1BAE988-323E-467C-BB38-A1566EF8E54B}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{E90981ED-2778-486E-BDA8-B86502E0DD74}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{FBFB0F25-4540-45A1-B8C6-53286D5999CC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01624781-C976-4B69-A4C1-477EC77ED15D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{04D19486-F586-45CF-AFB7-A7897E7FA455}" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"{05798A42-8B96-401B-AF99-26C41B54D6C3}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{072C4D5D-BA18-4E83-A38F-E73EDDFF479F}" = protocol=6 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\ouservice\starmoneyonlineupdate.exe | 
"{0F92CF40-E1BC-4484-A63C-C08AAA395CDB}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{11DC5F00-0E1E-4B5F-AFE8-E6865FFFF543}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{147F70FF-7E40-42B0-8C62-2E3959AD22D6}" = protocol=17 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\ouservice\starmoneyonlineupdate.exe | 
"{168B5C71-042E-4C7F-B70A-8F52C66AD5AC}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{1E1EF038-B6B7-4508-A3D9-BD5C04638280}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{223155F0-7393-485D-B84F-208C88E561E6}" = dir=in | app=c:\program files (x86)\online\skype\phone\skype.exe | 
"{24A9E62C-1A57-4E5C-BAF7-89B217F874E4}" = dir=in | app=c:\program files (x86)\video\cyberlink\powerdvd dx\powerdvd.exe | 
"{26E107BC-8EDE-4D94-8F6B-D987CC154C1E}" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"{3153B669-B4F4-41C9-8627-7C902A22F2AB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{33354798-D9EA-43BF-97A1-EF4837800147}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{39DB4859-7CDF-4D82-A264-21FCA400AEF5}" = protocol=17 | dir=in | app=c:\program files (x86)\epsonnet\epsonnet setup\tool10\eneasyapp.exe | 
"{3A62A98B-F155-44CA-ADC1-AD22B1014E82}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{3C1EB222-975C-44B5-8615-EF3096F6F62D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{3EF459A2-CD49-419B-8180-F27303B90C3F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{415E1F6E-CCFD-4D22-A0EF-5176D13720DB}" = protocol=17 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\app\starmoney.exe | 
"{46C97196-2722-4770-8BA1-5F834523E883}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{47280596-4F01-4B11-882C-A783D1393CD5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{476831B7-20B7-4162-A4BE-EF6D216C6547}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{494020F4-250A-4AF5-9E38-ECCF270BDAB3}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4B99A9BB-997A-48C6-884F-DC61BFD204D8}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5140136F-93C9-4E96-B452-DB77CE6A6A10}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{53830BEC-6B70-47A0-8A65-A4E9F2906682}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{5880A7F0-F84D-47A7-97E0-D34DC4FE3EA8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{593705D5-C9D3-4DFD-B6B3-9C8464C9DE2B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5C6B5CBA-7E4D-422D-83EA-FD1B54811073}" = protocol=6 | dir=in | app=c:\program files (x86)\epsonnet\epsonnet setup\tool10\eneasyapp.exe | 
"{5EE8E3DC-DA5E-424D-9861-51B152FFEF37}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{5FA9EF2A-8E05-490F-94D2-F2892D0385E1}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6D669035-5777-475D-8AD6-183CD04602B5}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{6E856B5E-BCAC-4962-B74C-EB39FD70E5EC}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{6EBDB818-91EA-4EAB-82F9-B52D941BC9DF}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{710C2244-DD54-40CB-AE72-1FDBDB270784}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{71BACBA6-69EF-433C-9852-43679F17A6AA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{728FF455-F8E0-4EBB-B360-D8570A8B29F4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{7886C0FF-CA6D-4058-9FCD-142307325B21}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7A7AB98C-8101-4F24-A5E7-FB967837A31E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{7E77FB2D-CD13-4E0A-9F3F-BD5440FED80A}" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"{7F853F03-6F5B-4223-8D60-1CF68B09BC86}" = dir=in | app=c:\program files (x86)\video\cyberlink\powerdvd dx\pdvddxsrv.exe | 
"{8048EF02-AA64-4080-ADE5-87880C09A0A2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{87ED95C0-B278-4A4B-A6BF-6BC2A2D65D91}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{8F2E2DA1-C448-43A4-89AA-0699C1024510}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{93565783-83F1-43D2-939B-94E64D9CAE06}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{965A333A-9677-4131-B528-2D1CC527203A}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{9D9E9806-EE5A-4C20-917E-EA63E2785273}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{9DEECF1B-0C12-412D-BC9F-1DEF6376573E}" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"{A6ED0468-2172-4469-8A97-DC2B2BF1C913}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A7048A63-2BC9-4268-9CFF-9E63DF9D5F8B}" = protocol=6 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\app\starmoney.exe | 
"{A7F6613E-660C-4E1B-97CA-0AB4652F010F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A89DCACE-C30B-4679-BBBC-A2555581BF0F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{AF845DC7-8F70-4CC6-9AFB-EE7CA4CA6A70}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{BDE91CF0-7799-4CC1-AC95-874B1ED7007F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{C6C63B1D-B8AE-400A-8E47-3A3E22CB70F7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{C7431933-BF58-4138-9D4C-4A7C23B0E2FE}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{C8FD4036-DED6-428C-9BBE-5706294FFCA3}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{CA946333-C1A8-4BFB-980A-2DC981445CDB}" = protocol=6 | dir=out | app=system | 
"{CC5E4BBC-C72B-452E-8AAE-CCA757E4BAEF}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{CDA0E7A0-92D6-4CE8-8D17-E8612269C2DC}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{CE024D0E-9804-4FE5-8A36-2443C171A597}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{CFF76665-CA9F-4CB2-BF2D-23E7EB68F19E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{D40F6629-A3ED-400B-A15F-E75EFF8E4869}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{D60A7915-EF06-4E79-A536-69B8A1EBAC7B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D75E1999-EEF9-4F43-A8EA-137C79923EAA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DFD5CFFF-4533-42F7-84BA-3755C8EF795A}" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"{E183440D-1990-4763-AF28-6235DA1EDE8A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E729489A-6B77-4EC5-895E-3647EB127D79}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{F634F111-015C-456A-A2C9-DD1BD4E86B31}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FA8EBE58-A063-40FF-8FC1-BEDDF6B206AB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{FD8445B1-3FA7-4AB1-B622-40287F7859A3}" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"TCP Query User{2295ABC3-B3C5-44DD-BFB2-964A6CD01F5B}E:\windows\dsassistant\dsassistant.exe" = protocol=6 | dir=in | app=e:\windows\dsassistant\dsassistant.exe | 
"TCP Query User{2E368572-ACE2-4D30-AC09-664263927BC3}C:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe | 
"TCP Query User{4686A310-6522-4983-89A7-E305B2323494}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=6 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"TCP Query User{5EF05458-7072-4936-A0C1-56D310CE12A2}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=6 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"TCP Query User{68BDD28E-4571-48E8-8159-2404D5C1D1DD}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"TCP Query User{695D8E55-4516-4CB2-AB38-60D952355F04}C:\program files (x86)\handy\gremote\gremoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"TCP Query User{7211E9AC-A256-410C-8F6D-EFBEC1F6421A}C:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe | 
"TCP Query User{73EAA63E-3FBB-4824-96BC-5227B75ABB34}C:\program files (x86)\handy\gremote pro\gremoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"TCP Query User{7CF3075E-B88B-48D2-99A4-ED1065EC0083}C:\program files (x86)\video\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files (x86)\video\tvants\tvants.exe | 
"TCP Query User{7D08C9D2-24F4-4705-90A1-19C7F74534F6}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"TCP Query User{7F88EB5A-07E8-4810-B7C1-3E147BAEF8A0}C:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe | 
"TCP Query User{8C24C7E8-E1E6-45E6-99E0-7B6D6FE1655F}C:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"TCP Query User{A1A73229-6580-4AFC-8572-43639D21F7E3}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"TCP Query User{AADA3FC2-D86E-45EA-903A-0073211E2062}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=6 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"TCP Query User{BC90EA98-7088-4720-982C-ADD2E4A42B51}C:\program files (x86)\netzwerk\synology assistant\dsassistant.exe" = protocol=6 | dir=in | app=c:\program files (x86)\netzwerk\synology assistant\dsassistant.exe | 
"TCP Query User{BD73B45E-60D0-4DB1-BEC8-147DA1A2176C}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{C0FB2EFA-7E13-42A6-AB39-7EF0C62E980B}C:\program files (x86)\media-player\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\media-player\winamp\winamp.exe | 
"TCP Query User{C32C48D0-529C-4F22-8845-0EB92A3D62C0}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=6 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"TCP Query User{C91A3819-C5F4-48BD-BD6F-522F020B9C1F}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"TCP Query User{CB6E718C-711E-4E23-A2EC-4BFBAFB092E7}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"UDP Query User{04140D95-6A12-4C66-996E-C0558BBC3518}C:\program files (x86)\netzwerk\synology assistant\dsassistant.exe" = protocol=17 | dir=in | app=c:\program files (x86)\netzwerk\synology assistant\dsassistant.exe | 
"UDP Query User{250F1C3A-7D73-4A72-BD2E-44E67F47FF77}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"UDP Query User{30173F94-D3D6-453E-87CA-97FCD76AC25D}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"UDP Query User{37B5821F-D210-4FFB-A419-8925619A73F6}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=17 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"UDP Query User{40FAE7E4-D11D-4F2C-8367-88E55D05C7FE}C:\program files (x86)\media-player\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\media-player\winamp\winamp.exe | 
"UDP Query User{4C198F28-3BB1-4470-B6B5-F0B3FA43C4D8}C:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe | 
"UDP Query User{5D474EE9-71E1-4D04-B3DC-F5ED05520E42}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=17 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"UDP Query User{693C5AD4-243F-4194-A5B3-83A3102535B5}C:\program files (x86)\handy\gremote pro\gremoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"UDP Query User{6D1B2DCD-7E97-480F-B206-F83EA76E027D}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"UDP Query User{7A65BB26-734E-4398-9762-FE480A43A1B9}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=17 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"UDP Query User{8192F374-7E64-414F-8675-E15643E247C9}E:\windows\dsassistant\dsassistant.exe" = protocol=17 | dir=in | app=e:\windows\dsassistant\dsassistant.exe | 
"UDP Query User{9069E265-8468-4C60-BA64-BEFCAE0D2505}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"UDP Query User{924D6205-1576-4C82-A60A-5F151B2732CD}C:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"UDP Query User{B0BA44A7-A167-4401-8A5B-9D4E591CFAF2}C:\program files (x86)\video\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files (x86)\video\tvants\tvants.exe | 
"UDP Query User{B9940188-883D-4BAB-B454-AAFF6D0F2E9E}C:\program files (x86)\handy\gremote\gremoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"UDP Query User{BE6D5633-CA1A-40A6-A231-61540852E627}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=17 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"UDP Query User{CAE4A98C-B1D6-487F-AEA6-20A8F5A1B89F}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{D0E3FFD6-8D26-4E15-AEF4-2125A46B1F90}C:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe | 
"UDP Query User{E05390CF-726F-4A3C-8CB7-69EBCF8599D0}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"UDP Query User{EF8221A2-4BF1-46F1-8030-971D00FCE0BC}C:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86416013FF}" = Java(TM) 6 Update 13 (64-bit)
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{64A3A4F4-B792-11D6-A78A-00B0D0170070}" = Java SE Development Kit 7 Update 7 (64-bit)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = Windows Mobile-Gerätecenter: Treiberupdate
"{ACE2E009-67B9-4CE9-A743-18A8D06910BA}" = FastAccess
"{E464702F-5433-46EC-8F65-159276C0A54F}" = WIDCOMM Bluetooth Software 6.2.0.6600
"{E60B7350-EA5F-41E0-9D6F-E508781E36D2}" = Dell Dock
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Creative OA001" = Integrated Webcam Driver (1.06.03.0309)  
"EPSON BX620FWD Series" = EPSON BX620FWD Series Printer Uninstall
"Ext2Fsd_is1" = Ext2Fsd 0.51
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SynTPDeinstKey" = Dell Touchpad
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}" = Epson Event Manager
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{095B1DCF-5E8B-47EC-9B18-481918A731DB}" = Microsoft Default Manager
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.5 Build #5238 Banner Remover 1.0
"{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}" = Epson FAX Utility
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{0E806605-5B82-4A4F-BC31-AA4FADA03C42}" = t@x 2012
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = LizardTech DjVu Control
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java(TM) 6 Update 13
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{2BF9702B-52EE-4841-83C4-B5E640B6C97A}" = Media Go
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{310C1558-F6B5-4889-98B0-7471966BA7F2}" = Epson Easy Photo Print 2
"{31877B1E-6950-4E76-BBE7-ACD612586F8E}" = MAGIX Screenshare
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3E0E4F57-8FE0-4812-840B-56EB8CC3DB7B}" = MAGIX Online Druck Service
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52306338-9945-41A5-A021-25739C852B58}" = StarMoney
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B23E5AD-23E2-45C8-A24C-97D3A23FB6EE}" = Carcassonne
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{625C2964-B137-4BA4-9C56-FC8F12185212}" = StarMoney 8.0 
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8CCA4800-152A-4C51-8569-5803FBD67CC9}" = LibreOffice 3.3
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA5A9B8-2AB6-4CE6-ACAA-8AAE727A87FD}" = Radiotracker
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C450606-ED24-4958-92BA-B8940C99D441}" = PixiePack Codec Pack
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A4F094CE-9B05-FB0C-DD73-A85DE5D8D283}" = Media Go Video Playback Engine 1.92.167.06150
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9AD487E-9E66-4214-A0B4-93981A12A2FE}" = MAGIX Foto Manager 10
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{B0414A3B-3AE3-47B8-8FC0-2129781FF425}" = t@x 2011
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C9D8A041-2963-4B31-8FFC-1500F3DB9293}" = EpsonNet Setup 3.3
"{D1F7C704-99F2-11E1-9C74-984BE15F174E}" = Evernote v. 4.5.6
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E8D82F42-EBD8-478C-917B-28F5BA6EAAAA}" = StarMoney
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.094
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6BB6248-C507-46FE-8A35-1B16F35E0441}" = ITECIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"1&1 SoftPhone" = 1&1 SoftPhone
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Android SDK Tools" = Android SDK Tools
"Avira AntiVir Desktop" = Avira Free Antivirus
"BirdieSync" = BirdieSync 2.1.0.1
"CamSpace" = CamSpace
"Das Planetarium 1900 - 2100" = Das Planetarium 1900 - 2100
"Dell Webcam Central" = Dell Webcam Central
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DjVuLibre+DjView" = DjVuLibre+DjView
"EPSON BX620FWD Series Manual" = EPSON BX620FWD Series Handbuch
"EPSON BX620FWD Series Network Guide" = EPSON BX620FWD Series Netzwerk-Handbuch
"EPSON PC-FAX Driver 2" = Epson PC-FAX Driver
"EPSON Scanner" = EPSON Scan
"FileZilla Client" = FileZilla Client 3.3.3
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"GRemoteServer" = GRemoteServer Pro(remove only)
"ImgBurn" = ImgBurn
"MAGIX_MSI_Foto_Manager_10" = MAGIX Foto Manager 10
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.45a
"MPE" = MyPhoneExplorer
"MyMDb_0" = MyMDb 3.6
"NAVIGON Fresh" = NAVIGON Fresh 3.2.0
"Sweet Home 3D_is1" = Sweet Home 3D version 3.3
"Synology Assistant" = Synology Assistant (remove only)
"TVAnts 1.0" = TVAnts 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Update Engine" = Sony Ericsson Update Engine
"VLC media player" = VLC media player 1.0.3
"Winamp" = Winamp
"Zattoo4" = Zattoo4 4.0.4
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Anwendungserkennung
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 23.10.2011 08:49:15 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.10.2011 12:22:24 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 5.0.0.4183,
 Zeitstempel: 0x4df952a0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x106c  Startzeit der fehlerhaften Anwendung: 0x01cc919ff1a093d0  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Online\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\Office\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 30923170-fd93-11e0-9a32-00225ff7ce9d
 
Error - 23.10.2011 14:06:22 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x35c  Startzeit der fehlerhaften Anwendung: 0x01cc91ae6e0e84a0
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 b6aa6080-fda1-11e0-a570-00225ff7ce9d
 
Error - 23.10.2011 14:06:29 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.10.2011 01:11:51 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x3c0  Startzeit der fehlerhaften Anwendung: 0x01cc920b679b8a20
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 adc7bdc0-fdfe-11e0-9946-00225ff7ce9d
 
Error - 24.10.2011 01:12:01 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.10.2011 13:55:34 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x3b8  Startzeit der fehlerhaften Anwendung: 0x01cc92761920d4c0
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 5ed140e0-fe69-11e0-9813-00225ff7ce9d
 
Error - 24.10.2011 13:55:45 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.10.2011 13:59:34 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 5.0.0.4183,
 Zeitstempel: 0x4df952a0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x9b4  Startzeit der fehlerhaften Anwendung: 0x01cc9276ae689ef0  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Online\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\Office\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 ed7601f0-fe69-11e0-9813-00225ff7ce9d
 
Error - 25.10.2011 01:13:26 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 25.10.2011 15:24:09 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x3c0  Startzeit der fehlerhaften Anwendung: 0x01cc934ba2240e60
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 e9111160-ff3e-11e0-b0bc-00225ff7ce9d
 
[ System Events ]
Error - 14.11.2012 18:09:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:14:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:14:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:14:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:16:13 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:16:13 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:16:13 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:21:12 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:21:12 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:21:12 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         

Benutzername ersetzt durch ***Username
PCName ersetzt durch ***PCName

Bitte um Hilfe. Danke schonmal.

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
• Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

:OTL
O4 - HKLM..\Run: [FAStartup] File not found 
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
[2012.11.13 21:00:16 | 000,000,828 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 
[2012.11.04 20:39:13 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf 
[2012.09.28 14:58:42 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI 
[2010.12.29 16:27:34 | 000,233,542 | ---- | C] () -- C:\Windows\SysWow64\vcdll.dll 
[2010.12.29 16:27:34 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\GkSui20.EXE 
[2010.12.29 16:26:42 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\astro32.dll 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini 
@Alternate Data Stream - 143 bytes -> C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML:OECustomProperty 
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:302A9871 
[2012.11.14 22:24:14 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad 
[2012.11.13 21:00:10 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe 

:Files
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\***Username\*.tmp
C:\Users\***Username\AppData\Local\{*}
C:\Users\***Username\AppData\Local\Temp\*.exe
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[emptytemp]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

4. Schritt

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Vielen Dank, ein erster Schritt ist anscheinend schon mal geschafft: Mein PC hat im "nicht-abgesicherten" Modus gebootet ohne dass er gesperrt wurde. Leider ist das unfreiwillig passiert beim Reboot nach dem 2. Schritt. Aber jetzt der Reihe nach, was ich gemacht habe:

1. Schritt

OTL-Log nach Fix

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FAStartup deleted successfully.
C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\ProgramData\lsass.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
File C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File move failed. C:\Windows\SysWOW64\ieuinit.inf scheduled to be moved on reboot.
C:\Windows\SysWOW64\PerfStringBackup.INI moved successfully.
C:\Windows\SysWOW64\vcdll.dll moved successfully.
C:\Windows\SysWOW64\GkSui20.EXE moved successfully.
C:\Windows\SysWOW64\astro32.dll moved successfully.
C:\Windows\assembly\Desktop.ini moved successfully.
ADS C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML:OECustomProperty deleted successfully.
ADS C:\ProgramData\Temp:302A9871 deleted successfully.
C:\ProgramData\dsgsdgdsgdsgw.pad moved successfully.
File C:\ProgramData\lsass.exe not found.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
C:\ProgramData\TEMP folder moved successfully.
File\Folder C:\Users\***Username\*.tmp not found.
File\Folder C:\Users\***Username\AppData\Local\{*} not found.
C:\Users\***Username\AppData\Local\Temp\wgsdgsdgdsgsd.exe moved successfully.
C:\Users\***Username\AppData\Local\Temp\_is8E89.exe moved successfully.
C:\Users\***Username\AppData\Local\Temp\_isB75F.exe moved successfully.
C:\Users\***Username\AppData\Local\Temp\_isC706.exe moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-2ce405f0-n folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\***Username\Desktop\cmd.bat deleted successfully.
C:\Users\***Username\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: ***Username
->Temp folder emptied: 107103510 bytes
->Temporary Internet Files folder emptied: 883834568 bytes
->FireFox cache emptied: 60422123 bytes
->Flash cache emptied: 205965 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 722691851 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67966 bytes
RecycleBin emptied: 5140077452 bytes
 
Total Files Cleaned = 6.594,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 11152012_071746
         

Anschließend einen Reboot gemacht.

2. Schritt

Malwarebytes Anti-Malware ausgeführt und 1 Datei entfernt. Hier die Log:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.15.01

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
***Username :: ***PCName [Administrator]

15.11.2012 07:25:38
mbam-log-2012-11-15 (07-25-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 519630
Laufzeit: 32 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\Local\Temp\wgsdgsdgdsgsd.exe (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Die Meldung zum Rebooten habe ich bestätigt.

Dann lief es leider nicht mehr ganz rund:

a) Beim Rebooten in den abgesicherten Modus hat er sich minutenlang aufgehängt bei der Zeile:
mit "CLASSPNP.SYS"

b) Weil nichts mehr ging habe ich den Powerknopf so lange gedrückt, bis er ausgegangen ist und dann noch mal neu gestartet in den abgesicherten Modus. Wieder ist er lange gehangen bei der gleichen Zeile. Das habe ich genutzt, um kurz was zu essen - was wohl ein Fehler war...

c) Als ich wieder gekommen bin, kam eine Windows-Sicherheitsabfrage, ob OTL.exe ausgeführt werden darf. Die habe ich bestätigt. Aber das komische war, dass er im "normalen" also nicht im abgesicherten Modus hochgefahren war. Während ich essen war, muss er wohl nochmal einen Reboot gemacht haben, bei dem ich nicht auf F8 drücken konnte (wie es passiert ist, s.u.).

d) Im "normalen" Modus ist dann eine weitere Log-Datei von OTL aufgegangen. Ist so weit ich es erkennen kann nicht die gleiche wie direkt nach dem Fix:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FAStartup deleted successfully.
C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\ProgramData\lsass.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
File C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File move failed. C:\Windows\SysWOW64\ieuinit.inf scheduled to be moved on reboot.
C:\Windows\SysWOW64\PerfStringBackup.INI moved successfully.
C:\Windows\SysWOW64\vcdll.dll moved successfully.
C:\Windows\SysWOW64\GkSui20.EXE moved successfully.
C:\Windows\SysWOW64\astro32.dll moved successfully.
C:\Windows\assembly\Desktop.ini moved successfully.
ADS C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML:OECustomProperty deleted successfully.
ADS C:\ProgramData\Temp:302A9871 deleted successfully.
C:\ProgramData\dsgsdgdsgdsgw.pad moved successfully.
File C:\ProgramData\lsass.exe not found.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
C:\ProgramData\TEMP folder moved successfully.
File\Folder C:\Users\***Username\*.tmp not found.
File\Folder C:\Users\***Username\AppData\Local\{*} not found.
C:\Users\***Username\AppData\Local\Temp\wgsdgsdgdsgsd.exe moved successfully.
C:\Users\***Username\AppData\Local\Temp\_is8E89.exe moved successfully.
C:\Users\***Username\AppData\Local\Temp\_isB75F.exe moved successfully.
C:\Users\***Username\AppData\Local\Temp\_isC706.exe moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-2ce405f0-n folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\***Username\Desktop\cmd.bat deleted successfully.
C:\Users\***Username\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: ***Username
->Temp folder emptied: 107103510 bytes
->Temporary Internet Files folder emptied: 883834568 bytes
->FireFox cache emptied: 60422123 bytes
->Flash cache emptied: 205965 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 722691851 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67966 bytes
RecycleBin emptied: 5140077452 bytes
 
Total Files Cleaned = 6.594,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 11152012_071746

Files\Folders moved on Reboot...
File move failed. C:\Windows\SysWOW64\ieuinit.inf scheduled to be moved on reboot.
File\Folder C:\Users\***Username\AppData\Local\Temp\2011-09-29-1187897587_04-RG-1.PDF  not found!
File\Folder C:\Users\***Username\AppData\Local\Temp\2011-09-29-1187897587_04-RG.PDF  not found!
File\Folder C:\Users\***Username\AppData\Local\Temp\2011-10-28-1198282679_04-RG.PDF  not found!
C:\Users\***Username\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\***Username\AppData\Local\Temp\~DF54F0D462586FD00F.TMP not found!
File\Folder C:\Users\***Username\AppData\Local\Temp\~DF7F0C879BD79B7399.TMP not found!
File\Folder C:\Users\***Username\AppData\Local\Temp\~DFB961A1A3992403CB.TMP not found!
File\Folder C:\Users\***Username\AppData\Local\Temp\~DFD750160D6E51F409.TMP not found!
File\Folder C:\Users\***Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LGTK6SW\6740D3CCEEC992C281BC61E988349[2].jpg not found!
File\Folder C:\Users\***Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LGTK6SW\6B9C9580AFE8AC44C591C87EAEE5F8[1].jpg not found!
File\Folder C:\Users\***Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LGTK6SW\6CBD9F1B63A8E9CCC81AF5434BAFA[2].gif not found!
File\Folder C:\Users\***Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LGTK6SW\718799C7D1A6727F5A335BD7F0DD2F[4].gif not found!
File\Folder C:\Users\***Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LGTK6SW\7412E7A862D9990E1F0C3EBB31CC0[2].gif not found!
File\Folder C:\Users\***Username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LGTK6SW\ACD09EBB66ED981567776AD3831BD1[1].gif not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

e) Windows Updates
Als ich einen Reboot gestartet habe, um wieder in den abgesicherten Modus zu gehen, um Schritt 3 zu machen, sind Windows Updates gestartet. Die habe ich dann laufen lassen. Beim Reboot habe ich dann wieder F8 gedrückt.

f) Diesmal ging er schnell weiter bei der Zeile CLASSPNP.SYS - hat aber plötzlich nochmal das Booten von vorne angefangen - wahrscheinlich ist das gleiche schon passiert als ich essen war. Beim Hochfahren im abgesicherten Modus hat er dann eine Meldung gebracht "Fehler bei der Konfiguration der Windows-Updates. Mache Updates rückgängig" (sinngemäß). Das hat aber geklappt und jetzt bin ich wieder im abgesicherten Modus.

Kann ich jetzt einfach bei Schritt 3 weitermachen oder soll ich an einer anderen Stelle wieder einsteigen? Weil Windows war ja im "normalen" Modus und hat auch Updates geladen.

Danke schonmal fürs geduldige lesen...

Bitte alle Aktionen im Normalen Modus ausfuehren!

Mit Schritt 3 weitermachen

AdwCleaner[R1]

# AdwCleaner v2.007 - Datei am 15/11/2012 um 22:20:15 erstellt
# Aktualisiert am 06/11/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : ***Username - ***PCName
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\***Username\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gefunden : HKU\S-1-5-21-2768090867-1693393677-3593847686-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default 
Datei : C:\Users\***Username\AppData\Roaming\Mozilla\Firefox\Profiles\mb3ab5xj.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1469 octets] - [15/11/2012 22:20:15]

########## EOF - C:\AdwCleaner[R1].txt - [1529 octets] ##########
         

AdwCleaner[S1]

# AdwCleaner v2.007 - Datei am 15/11/2012 um 22:22:41 erstellt
# Aktualisiert am 06/11/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : ***Username - ***PCName
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\***Username\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default 
Datei : C:\Users\***Username\AppData\Roaming\Mozilla\Firefox\Profiles\mb3ab5xj.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1596 octets] - [15/11/2012 22:20:15]
AdwCleaner[S1].txt - [1369 octets] - [15/11/2012 22:22:41]

########## EOF - C:\AdwCleaner[S1].txt - [1429 octets] ##########
         

Sehr gut!

Wie laeuft der Rechner?


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Ja - sehr gut! Finde ich auch. Der Rechner läuft wieder :-)

Emsisoft läuft. Melde mich wieder mit der Log-Datei, wenn es durchgelaufen ist.

so, jetzt ist es fertig:

Emsisoft Anti-Malware - Version 7.0
Letztes Update: 16.11.2012 06:11:39

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, F:\, G:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn:	16.11.2012 06:15:51

C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\6282058e-6aad3808 -> a/Help.class 	gefunden: Exploit.Java.CVE-2012-0507.B (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\6282058e-6aad3808 -> a/Test.class 	gefunden: Exploit.Java.CVE-2012-0507.N (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\1f3b1692-2c79db26 -> ba/bb.class 	gefunden: Exploit.Java.Blacole.G (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\1f3b1692-2c79db26 -> ba/T.class 	gefunden: Exploit.Java.Blacole.G (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\75c9b417-20b611f6 -> a/Help.class 	gefunden: Exploit.Java.CVE-2012-0507.B (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\75c9b417-20b611f6 -> a/Test.class 	gefunden: Exploit.Java.CVE-2012-0507.N (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\573e099c-17060a60 -> bagdfssdb.class 	gefunden: Exploit.Java.CVE-2012-5076.A (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\573e099c-17060a60 -> bagdfssda.class 	gefunden: Exploit.Java.CVE-2012-5076.A (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_a.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> ER.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> Inc.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_d.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> lz.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_b.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_c.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\594e348c.qua -> (Quarantine-8) 	gefunden: Backdoor.Generic.740895 (B)
F:\downloads\Brennen\Daemon Tools 4.121 Lite.exe 	gefunden: Adware.Win32.Shopper.r (A)
F:\downloads\System\Utilities\Registry System Wizard 186.exe 	gefunden: TrojanClicker.Win32.Yabector.AMN (A)

Gescannt	632599
Gefunden	18

Scan Ende:	16.11.2012 07:29:59
Scan Zeit:	1:14:08
         

Sorry, zu schnell den Bericht reinkopiert.
Hatte noch nicht auf "Quarantäne" geklickt.

Unten bei der Log ist noch was dazugekommen:

Emsisoft Anti-Malware - Version 7.0
Letztes Update: 16.11.2012 06:11:39

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, F:\, G:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn:	16.11.2012 06:15:51

C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\6282058e-6aad3808 -> a/Help.class 	gefunden: Exploit.Java.CVE-2012-0507.B (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\6282058e-6aad3808 -> a/Test.class 	gefunden: Exploit.Java.CVE-2012-0507.N (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\1f3b1692-2c79db26 -> ba/bb.class 	gefunden: Exploit.Java.Blacole.G (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\1f3b1692-2c79db26 -> ba/T.class 	gefunden: Exploit.Java.Blacole.G (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\75c9b417-20b611f6 -> a/Help.class 	gefunden: Exploit.Java.CVE-2012-0507.B (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\75c9b417-20b611f6 -> a/Test.class 	gefunden: Exploit.Java.CVE-2012-0507.N (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\573e099c-17060a60 -> bagdfssdb.class 	gefunden: Exploit.Java.CVE-2012-5076.A (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\573e099c-17060a60 -> bagdfssda.class 	gefunden: Exploit.Java.CVE-2012-5076.A (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_a.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> ER.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> Inc.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_d.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> lz.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_b.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_c.class 	gefunden: Exploit.Java.Blacole.F (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\594e348c.qua -> (Quarantine-8) 	gefunden: Backdoor.Generic.740895 (B)
F:\downloads\Brennen\Daemon Tools 4.121 Lite.exe 	gefunden: Adware.Win32.Shopper.r (A)
F:\downloads\System\Utilities\Registry System Wizard 186.exe 	gefunden: TrojanClicker.Win32.Yabector.AMN (A)

Gescannt	632599
Gefunden	18

Scan Ende:	16.11.2012 07:29:59
Scan Zeit:	1:14:08

F:\downloads\System\Utilities\Registry System Wizard 186.exe	Quarantäne TrojanClicker.Win32.Yabector.AMN (A)
F:\downloads\Brennen\Daemon Tools 4.121 Lite.exe	Quarantäne Adware.Win32.Shopper.r (A)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\594e348c.qua -> (Quarantine-8)	Quarantäne Backdoor.Generic.740895 (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\395589b7-3ef3bb9a -> s_a.class	Quarantäne Exploit.Java.Blacole.F (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\573e099c-17060a60 -> bagdfssdb.class	Quarantäne Exploit.Java.CVE-2012-5076.A (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\1f3b1692-2c79db26 -> ba/bb.class	Quarantäne Exploit.Java.Blacole.G (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\6282058e-6aad3808 -> a/Test.class	Quarantäne Exploit.Java.CVE-2012-0507.N (B)
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\75c9b417-20b611f6 -> a/Test.class	Quarantäne Exploit.Java.CVE-2012-0507.N (B)

Quarantäne	8
         

Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Habe noch eine Synology Diskstation. Da habe ich ein paar Partitionen als Netzlaufwerke in Windows eingebunden.
Die Verbindungen auch aktivieren zum Scannen oder?

Schadet nicht!

Frage interessehalber: Für was war das mit dem Browser als Administrator öffnen?

Hier die Log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b8d77257ce555d46af280c8d36a08f46
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-17 02:13:03
# local_time=2012-11-17 03:13:03 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 1094112 1094112 0 0
# compatibility_mode=5893 16776574 100 94 1096051 104738628 0 0
# compatibility_mode=8192 67108863 100 0 4016 4016 0 0
# scanned=356556
# found=12
# cleaned=12
# scan_time=9605
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\37531001-27e64dea	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\b0cce8c-443c4f14	Java/Exploit.Agent.NDF trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\68fd1fcf-24f7bfd0	Java/Exploit.Agent.NBD trojan (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\9d9b052-26c817f0	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\5355b999-1271fa0e	a variant of Java/Exploit.CVE-2012-1723.AJ trojan (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\1ff7166d-40313e8d	a variant of Java/Exploit.CVE-2012-1723.CP trojan (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\307c0e6d-48cff4d3	Java/Exploit.Agent.AB trojan (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\13db56e-1750420d	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\6492ed77-4ba61d90	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\29bb91fb-37b85d87	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\11152012_071746\C_Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk	Win32/Reveton.J trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
F:\downloads\Multimedia\Grafik\Foto Sizer 1.19.exe	Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 9 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

Habe Java akutalisiert und die alten Versionen deinstalliert.

--> 1. Mal PluginCheck

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 16.0 ist aktuell

    Flash (11,5,502,110) ist aktuell.

    Java (1,7,0,9) ist aktuell.

undefined
         

Java deaktiviert
--> 2. PluginCheck

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 16.0 ist aktuell

    Flash (11,5,502,110) ist aktuell.

    Java ist nicht Installiert oder nicht aktiviert.

undefined
         

Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Uninstall.
• Bestätige mit Ja.

Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

• Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
• Speichere es auf Deinem Desktop.
• Doppelklick auf OTL.exe um das Programm auszuführen.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Klicke auf den Button "Bereinigung"
• OTL fragt eventuell nach einem Neustart.
  Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

• Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
• temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
http://www.trojaner-board.de/109844-...ren-seite.html
PC wird immer langsamer - was tun?

Juchhu

Vielen vielen Dank für die tolle Hilfe

Eine letzte Frage zur Sicherheit habe ich am Ende noch.
Die Bereinigungschritte habe ich alle gemacht. Beim Aufräumen mit CCleaner habe ich aber bisher nur die temporären Datein gelöscht und noch nicht die Fehler in der Registry behoben, weil in der verlinkten Anleitung steht, dass das keinesfalls empfohlen wird? Soll ich die Registry-Fehler beheben?