Hallo Zusammen

Ich habe zwar schon einen Beitrag dazu gelesen, wäre euch aber sehr dankbar, wenn sich dies ein Spezialist unter die Lupe nehmen könnte.

Im Voraus schon einmal besten Dank!

Zum Problem:

Ich habe mir leider aus Leichtsinn und Zeitdruck schnell ein Programm heruntergeladen. Dies richtete mir den Claro search ein. Schliesslich wollte ich diesen entfernen und wurde auf eine Spyware abgeleitet. Diese war aber kein Stück besser.

Ich hoffe ich poste nun alles wichtige, was es benötigt, sonst bitte melden

OTL.txt

OTL logfile created on: 27.11.2012 21:43:46 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Mario\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.99 Gb Total Physical Memory | 1.67 Gb Available Physical Memory | 55.81% Memory free
6.19 Gb Paging File | 4.66 Gb Available in Paging File | 75.22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.65 Gb Total Space | 34.40 Gb Free Space | 24.12% Space Free | Partition Type: NTFS
Drive D: | 142.67 Gb Total Space | 142.58 Gb Free Space | 99.94% Space Free | Partition Type: NTFS
 
Computer Name: MARIO-PC | User Name: Mario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Mario\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Users\Mario\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\Acer\Acer Bio Protection\CompPtcVUI.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Programme\Acer\Acer Bio Protection\BASVC.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
PRC - C:\Programme\Acer\Acer VCM\acp2HID.exe (Acer Inc.)
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\e3180b4230f052996adb81da3dc64ad0\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\c933fd5d1d27f268331890d7ddba8fec\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\ca69ec9d6589d3526ee38212ef28e2bb\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll ()
MOD - C:\Windows\System32\SysHook.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll ()
MOD - C:\Programme\Acer\Acer VCM\AcerControl.dll ()
MOD - C:\Programme\Launch Manager\PowerUtl.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IGBASVC) -- C:\Programme\Acer\Acer Bio Protection\BASVC.exe ()
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (eDataSecurity Service) -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (yukonwlh) -- system32\DRIVERS\yk60x86.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (AlfaFF) -- C:\Windows\System32\drivers\AlfaFF.sys (Alfa Corporation)
DRV - (ATSWPDRV) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.google.ch/
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\..\SearchScopes,bProtectorDefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Claro Search"
FF - prefs.js..browser.search.order.1: "Claro Search"
FF - prefs.js..browser.search.selectedEngine: "Claro Search"
FF - prefs.js..keyword.URL: "hxxp://www.claro-search.com/?affID=117452&tt=4712_8&babsrc=KW_ss&mntrId=240e99d10000000000000016ea4f8140&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2012.11.20 22:24:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
 
[2008.11.30 10:38:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mario\AppData\Roaming\mozilla\Extensions
[2012.11.25 21:05:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mario\AppData\Roaming\mozilla\Firefox\Profiles\3h6pdbc6.default-1353694430434\Extensions
[2012.11.20 22:24:09 | 000,006,520 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\searchplugins\mngr.xml
[2012.11.01 12:04:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.01 12:05:08 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.05.22 18:46:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.18 21:01:38 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.05.22 18:46:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.22 18:46:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.22 18:46:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.22 18:46:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Programme\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2644863971-1121740263-626221152-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O7 - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe ()
O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: 538793D5-659C-4639-A56C-A179AD87ED44 vpnweb.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A7FD0626-A8DE-43FE-A495-EA62852AAA69}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\25911~1.18\{c16c1~1\mngr.dll) - c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - (C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll) - C:\Programme\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.)
O24 - Desktop WallPaper: C:\Users\Mario\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mario\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{6f51dfef-0b05-11de-b35e-001d72c97672}\Shell - "" = AutoRun
O33 - MountPoints2\{6f51dfef-0b05-11de-b35e-001d72c97672}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{91629af8-1a7c-11e0-b943-001d72c97672}\Shell\AutoRun\command - "" = F:\Install.exe
O33 - MountPoints2\{91629af8-1a7c-11e0-b943-001d72c97672}\Shell\menu1\command - "" = F:\Install.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.27 21:27:26 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Mario\Desktop\OTL.exe
[2012.11.24 00:24:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hex-Editor MX
[2012.11.24 00:24:21 | 000,000,000 | ---D | C] -- C:\Program Files\Hex-Editor MX
[2012.11.23 19:15:56 | 000,000,000 | ---D | C] -- C:\Users\Mario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Toolbar Cleaner
[2012.11.23 19:15:56 | 000,000,000 | ---D | C] -- C:\Program Files\Toolbar Cleaner
[2012.11.22 22:01:34 | 000,000,000 | ---D | C] -- C:\Users\Mario\AppData\Roaming\Malwarebytes
[2012.11.22 22:01:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.22 20:52:00 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.11.22 20:50:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2012.11.20 22:24:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager
[2012.11.20 22:23:55 | 000,000,000 | ---D | C] -- C:\Users\Mario\Desktop\Programme\Documents\Downloads
[2012.11.01 12:04:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.27 21:49:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.27 21:46:00 | 003,932,160 | -HS- | M] () -- C:\Users\Mario\NTUSER.DAT
[2012.11.27 21:43:05 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.27 21:42:48 | 001,445,310 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2012.11.27 21:42:48 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.27 21:42:48 | 000,595,818 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.27 21:42:48 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.27 21:42:48 | 000,103,892 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.27 21:37:01 | 000,002,299 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\acervcmtmp.ini
[2012.11.27 21:35:45 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2012.11.27 21:35:38 | 000,240,219 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.11.27 21:35:38 | 000,240,219 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.11.27 21:35:38 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.27 21:35:38 | 000,000,356 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job
[2012.11.27 21:35:27 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.27 21:35:27 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.27 21:35:24 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012.11.27 21:35:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.27 21:33:30 | 000,524,288 | -HS- | M] () -- C:\Users\Mario\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2012.11.27 21:33:30 | 000,065,536 | -HS- | M] () -- C:\Users\Mario\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2012.11.27 21:32:08 | 002,951,443 | -H-- | M] () -- C:\Users\Mario\AppData\Local\IconCache.db
[2012.11.27 21:30:31 | 000,480,125 | ---- | M] () -- C:\Users\Mario\Desktop\adwcleaner.exe
[2012.11.27 21:27:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Mario\Desktop\OTL.exe
[2012.11.23 19:47:01 | 005,522,303 | ---- | M] () -- C:\Users\Mario\Desktop\Kate Deluna - Run The Show (ft Busta Rhymes).mp3
[2012.11.23 19:15:56 | 000,000,887 | ---- | M] () -- C:\Users\Mario\Desktop\Toolbar Cleaner.lnk
[2012.11.22 22:17:35 | 000,008,268 | ---- | M] () -- C:\Users\Mario\AppData\Local\d3d9caps.dat
[2012.11.22 16:51:30 | 000,000,219 | ---- | M] () -- C:\Windows\win.ini
[2012.11.20 22:08:34 | 006,198,276 | ---- | M] () -- C:\Users\Mario\Desktop\Dunkelbunt Feat. Boban I Marko Markovic Orkestar - Cinnamon Girl.mp3
[2012.11.20 22:07:48 | 005,167,545 | ---- | M] () -- C:\Users\Mario\Desktop\Beyonce - Countdown.mp3
[2012.11.20 22:07:41 | 008,736,185 | ---- | M] () -- C:\Users\Mario\Desktop\Lionel Hampton - It Don't Mean A Thing (If It...mp3
[2012.11.20 22:05:56 | 012,606,739 | ---- | M] () -- C:\Users\Mario\Desktop\Neon Hitch - F__k U Betta (Chuckie Club Remix).mp3
[2012.11.20 22:02:55 | 006,988,132 | ---- | M] () -- C:\Users\Mario\Desktop\N.O.R.E - Mas Maiz (Feat Fat Joe, Big Mato, Nina Sky, Chingo Bling, Lil' Rob, Negra (Of LD....mp3
[2012.11.20 22:01:56 | 007,135,000 | ---- | M] () -- C:\Users\Mario\Desktop\Seth Lakeman - Lady of the Sea.mp3
[2012.11.20 22:01:16 | 002,757,712 | ---- | M] () -- C:\Users\Mario\Desktop\Seth Lakeman - The White Hare.mp3
[2012.11.20 21:59:17 | 005,376,293 | ---- | M] () -- C:\Users\Mario\Desktop\Deniz Koyu feat. Wynter Gordon - Follow you (Original mix).mp3
[2012.11.20 21:50:31 | 005,394,911 | ---- | M] () -- C:\Users\Mario\Desktop\Boys Town Gang  - Can't Take My Eyes Off Of You.mp3
[2012.11.20 21:42:09 | 008,556,713 | ---- | M] () -- C:\Users\Mario\Desktop\Army Of Lovers - Crucified.mp3
[2012.11.20 21:37:01 | 008,193,152 | ---- | M] () -- C:\Users\Mario\Desktop\Robbie Williams - Candy.mp3
[2012.11.15 13:00:19 | 008,715,493 | ---- | M] () -- C:\Users\Mario\Desktop\Seeed - Augenbling.mp3
[2012.11.15 12:58:03 | 011,574,546 | ---- | M] () -- C:\Users\Mario\Desktop\Adele - Skyfall.mp3
[2012.11.13 21:58:34 | 014,816,591 | ---- | M] () -- C:\Users\Mario\Desktop\Tommy Trash - Truffle Pig.mp3
[2012.11.13 21:55:13 | 006,425,957 | ---- | M] () -- C:\Users\Mario\Desktop\Rob Costlow - Sleepaway.mp3
[2012.11.13 21:52:17 | 006,535,168 | ---- | M] () -- C:\Users\Mario\Desktop\Rob Costlow - Meant to Be.mp3
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.27 21:30:17 | 000,480,125 | ---- | C] () -- C:\Users\Mario\Desktop\adwcleaner.exe
[2012.11.24 00:47:16 | 002,951,443 | -H-- | C] () -- C:\Users\Mario\AppData\Local\IconCache.db
[2012.11.23 19:15:56 | 000,000,887 | ---- | C] () -- C:\Users\Mario\Desktop\Toolbar Cleaner.lnk
[2012.11.20 22:24:52 | 000,000,356 | ---- | C] () -- C:\Windows\tasks\AmiUpdXp.job
[2012.11.20 22:24:14 | 000,000,044 | ---- | C] () -- C:\Users\Mario\Desktop\Track08.cda
[2012.11.20 22:08:31 | 006,198,276 | ---- | C] () -- C:\Users\Mario\Desktop\Dunkelbunt Feat. Boban I Marko Markovic Orkestar - Cinnamon Girl.mp3
[2012.11.20 22:07:45 | 005,167,545 | ---- | C] () -- C:\Users\Mario\Desktop\Beyonce - Countdown.mp3
[2012.11.20 22:07:19 | 008,736,185 | ---- | C] () -- C:\Users\Mario\Desktop\Lionel Hampton - It Don't Mean A Thing (If It...mp3
[2012.11.20 22:05:24 | 012,606,739 | ---- | C] () -- C:\Users\Mario\Desktop\Neon Hitch - F__k U Betta (Chuckie Club Remix).mp3
[2012.11.20 22:02:47 | 006,988,132 | ---- | C] () -- C:\Users\Mario\Desktop\N.O.R.E - Mas Maiz (Feat Fat Joe, Big Mato, Nina Sky, Chingo Bling, Lil' Rob, Negra (Of LD....mp3
[2012.11.20 22:01:50 | 007,135,000 | ---- | C] () -- C:\Users\Mario\Desktop\Seth Lakeman - Lady of the Sea.mp3
[2012.11.20 22:01:10 | 002,757,712 | ---- | C] () -- C:\Users\Mario\Desktop\Seth Lakeman - The White Hare.mp3
[2012.11.20 21:59:14 | 005,376,293 | ---- | C] () -- C:\Users\Mario\Desktop\Deniz Koyu feat. Wynter Gordon - Follow you (Original mix).mp3
[2012.11.20 21:53:06 | 005,522,303 | ---- | C] () -- C:\Users\Mario\Desktop\Kate Deluna - Run The Show (ft Busta Rhymes).mp3
[2012.11.20 21:50:27 | 005,394,911 | ---- | C] () -- C:\Users\Mario\Desktop\Boys Town Gang  - Can't Take My Eyes Off Of You.mp3
[2012.11.20 21:41:43 | 008,556,713 | ---- | C] () -- C:\Users\Mario\Desktop\Army Of Lovers - Crucified.mp3
[2012.11.20 21:36:48 | 008,193,152 | ---- | C] () -- C:\Users\Mario\Desktop\Robbie Williams - Candy.mp3
[2012.11.15 13:00:00 | 008,715,493 | ---- | C] () -- C:\Users\Mario\Desktop\Seeed - Augenbling.mp3
[2012.11.15 12:57:11 | 011,574,546 | ---- | C] () -- C:\Users\Mario\Desktop\Adele - Skyfall.mp3
[2012.11.13 21:58:12 | 014,816,591 | ---- | C] () -- C:\Users\Mario\Desktop\Tommy Trash - Truffle Pig.mp3
[2012.11.13 21:51:53 | 006,535,168 | ---- | C] () -- C:\Users\Mario\Desktop\Rob Costlow - Meant to Be.mp3
[2012.11.13 21:51:53 | 006,425,957 | ---- | C] () -- C:\Users\Mario\Desktop\Rob Costlow - Sleepaway.mp3
[2011.01.20 21:35:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.11.11 19:42:26 | 000,000,101 | ---- | C] () -- C:\Users\Mario\Unbenannt1.vbs
[2009.11.07 13:03:12 | 000,002,299 | ---- | C] () -- C:\Users\Mario\AppData\Roaming\acervcmtmp.ini
[2008.12.14 15:55:48 | 000,017,902 | ---- | C] () -- C:\Users\Mario\AppData\Roaming\UserTile.png
[2008.12.04 21:27:33 | 000,018,944 | ---- | C] () -- C:\Users\Mario\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.30 15:56:08 | 000,008,268 | ---- | C] () -- C:\Users\Mario\AppData\Local\d3d9caps.dat
[2008.11.23 16:29:53 | 000,000,680 | RHS- | C] () -- C:\Users\Mario\ntuser.pol
[2008.11.22 14:01:14 | 000,240,219 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008.11.22 14:01:10 | 000,103,992 | ---- | C] () -- C:\Users\Mario\AppData\Local\GDIPFONTCACHEV1.DAT
[2008.11.22 13:59:35 | 000,240,219 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.11.22 13:59:27 | 000,524,288 | -HS- | C] () -- C:\Users\Mario\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2008.11.22 13:59:27 | 000,524,288 | -HS- | C] () -- C:\Users\Mario\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2008.11.22 13:59:27 | 000,065,536 | -HS- | C] () -- C:\Users\Mario\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2008.11.22 13:59:27 | 000,000,020 | -HS- | C] () -- C:\Users\Mario\ntuser.ini
[2008.11.22 13:59:26 | 003,932,160 | -HS- | C] () -- C:\Users\Mario\NTUSER.DAT
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 16:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.03.03 05:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 03:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Acer GameZone Console
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Acer GameZone Console
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\Users\Habbbo Test\AppData\Roaming\Acer GameZone Console
[2009.07.03 18:31:24 | 000,000,000 | -HSD | M] -- C:\Users\Mario\AppData\Roaming\.#
[2008.11.22 14:30:52 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Acer
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Acer GameZone Console
[2010.12.28 18:50:41 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Azureus
[2011.08.28 15:35:21 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011.08.21 12:42:58 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012.09.01 12:09:04 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\DVDVideoSoft
[2011.04.11 19:11:49 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.10 20:48:24 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\eSobi
[2011.05.19 22:35:11 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Jumping Bytes
[2011.05.19 22:54:14 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Mobile Master
[2008.11.28 20:01:23 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Opera
[2008.12.14 15:55:47 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\PeerNetworking
[2010.12.22 19:39:29 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\PhotoScape
[2008.11.23 10:33:04 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\PlayFirst
[2011.11.13 15:40:02 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\TeamViewer
[2009.02.09 17:06:22 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Teeworlds
[2009.11.11 19:38:53 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\www.scriptinternals.com
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\Users\Testkonto\AppData\Roaming\Acer GameZone Console
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2009.01.09 22:00:19 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2008.11.22 14:46:32 | 000,000,000 | ---D | M] -- C:\Acer
[2008.11.23 05:38:45 | 000,000,000 | ---D | M] -- C:\Book
[2008.02.06 00:25:41 | 000,000,000 | -HSD | M] -- C:\Boot
[2008.11.22 14:25:44 | 000,000,000 | ---D | M] -- C:\CLSetup
[2012.11.23 19:21:12 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2008.11.22 14:50:40 | 000,000,000 | ---D | M] -- C:\Elements
[2010.12.28 18:51:45 | 000,000,000 | ---D | M] -- C:\Games
[2008.04.30 08:21:30 | 000,000,000 | ---D | M] -- C:\Intel
[2008.05.07 18:46:17 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.11.24 00:24:21 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.11.27 21:31:15 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.11.27 21:46:32 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.09.04 17:58:00 | 000,000,000 | ---D | M] -- C:\TyphonInstaller
[2009.10.16 21:44:36 | 000,000,000 | R--D | M] -- C:\Users
[2012.11.27 21:35:45 | 000,000,000 | ---D | M] -- C:\Windows
 
< %SYSTEMDRIVE%\*.* >
[2012.11.27 21:31:26 | 000,003,966 | ---- | M] () -- C:\AdwCleaner[S1].txt
[2006.09.18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2008.01.21 03:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2008.02.06 00:25:41 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2006.09.18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2008.11.22 14:25:44 | 000,000,020 | ---- | M] () -- C:\Medion.ini
[2012.11.27 21:34:20 | 3529,629,696 | -HS- | M] () -- C:\pagefile.sys
[2008.11.22 14:01:03 | 000,000,058 | ---- | M] () -- C:\Partition.txt
[2008.08.13 01:51:24 | 000,003,857 | -HS- | M] () -- C:\Patch.rev
[2008.11.23 05:38:42 | 000,000,147 | RHS- | M] () -- C:\preload.rev
[2008.11.22 14:40:02 | 000,000,091 | ---- | M] () -- C:\PS.log
[2008.11.22 14:29:30 | 000,000,426 | ---- | M] () -- C:\RHDSetup.log
 
< %PROGRAMFILES%\*.exe >
Invalid Environment Variable: PROGRAMFILES(X86)
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /10 >
[2012.11.23 19:21:12 | 000,000,000 | ---D | M] -- C:\Windows\installer\{57752979-A1C9-4C02-856B-FBB27AC4E02C}
[2012.11.22 16:52:55 | 000,000,000 | ---D | M] -- C:\Windows\installer\{91140000-0011-0000-0000-0000000FF1CE}
 
< %appdata%\*.  >
[2009.07.03 18:31:24 | 000,000,000 | -HSD | M] -- C:\Users\Mario\AppData\Roaming\.#
[2008.11.22 14:30:52 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Acer
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Acer GameZone Console
[2011.08.28 15:34:21 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Adobe
[2010.06.24 23:16:52 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Apple Computer
[2012.09.01 13:34:12 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Avira
[2010.12.28 18:50:41 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Azureus
[2011.08.28 15:35:21 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011.08.21 12:42:58 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2008.11.23 10:52:04 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\CyberLink
[2009.06.12 14:45:20 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\DivX
[2009.02.09 17:38:00 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Download Manager
[2012.09.01 12:09:04 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\DVDVideoSoft
[2011.04.11 19:11:49 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.10 20:48:24 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\eSobi
[2008.11.22 14:00:49 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Identities
[2008.11.22 14:30:12 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\InstallShield
[2011.05.19 22:35:11 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Jumping Bytes
[2008.11.22 14:01:17 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Macromedia
[2012.11.22 22:01:34 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Media Center Programs
[2012.06.10 20:46:02 | 000,000,000 | --SD | M] -- C:\Users\Mario\AppData\Roaming\Microsoft
[2011.05.19 22:54:14 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Mobile Master
[2008.11.30 10:38:17 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Mozilla
[2008.11.28 20:01:23 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Opera
[2008.12.14 15:55:47 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\PeerNetworking
[2010.12.22 19:39:29 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\PhotoScape
[2008.11.23 10:33:04 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\PlayFirst
[2012.11.20 21:44:37 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Skype
[2011.01.20 21:35:53 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\skypePM
[2011.11.13 15:40:02 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\TeamViewer
[2009.02.09 17:06:22 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Teeworlds
[2009.03.07 13:14:17 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\U3
[2009.11.11 19:38:53 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\www.scriptinternals.com
[2008.11.22 14:33:19 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Roaming\Yahoo!
 
< %appdata%\*.*  >
[2012.11.27 21:37:01 | 000,002,299 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\acervcmtmp.ini
[2010.01.02 16:37:17 | 000,017,902 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\UserTile.png
 
< %appdata%\*.exe /s >
[2011.08.21 12:42:15 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Mario\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.04.14 19:07:39 | 002,833,568 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Mario\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2009.01.15 21:57:06 | 000,319,488 | ---- | M] (Octoshape ApS) -- C:\Users\Mario\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
[2011.12.27 22:53:50 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Mario\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
[2011.12.27 22:53:50 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Mario\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
[2011.12.27 22:53:50 | 000,008,854 | R--- | M] () -- C:\Users\Mario\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\Uninstall_Project64__9559F7CA5E344237A2D9D856464AD727.exe
[2009.08.29 13:33:44 | 000,010,134 | R--- | M] () -- C:\Users\Mario\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
 
< %localappdata%\*.  >
[2008.11.23 10:28:31 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Acer Arcade Deluxe
[2011.08.28 15:31:49 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Adobe
[2008.11.22 13:59:27 | 000,000,000 | -HSD | M] -- C:\Users\Mario\AppData\Local\Anwendungsdaten
[2009.11.30 17:55:08 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Apple
[2011.03.04 23:50:06 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Apple Computer
[2010.06.08 21:28:04 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Apps
[2012.09.04 17:39:08 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Cisco
[2008.11.23 10:28:42 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\CyberLink
[2008.11.22 14:33:56 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Downloaded Installations
[2010.04.10 00:59:46 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Google
[2011.12.24 17:13:25 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Microsoft
[2010.01.25 19:23:53 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Microsoft Games
[2010.09.30 18:38:21 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Microsoft Help
[2011.05.19 22:54:21 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Mobile Master
[2008.11.30 10:38:16 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Mozilla
[2008.11.28 20:01:23 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Opera
[2008.11.23 11:36:14 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\PlayMovie
[2008.11.30 15:47:42 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\PowerCinema
[2008.11.23 10:28:43 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\SoftDMA
[2012.11.27 21:37:13 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Temp
[2008.11.22 13:59:27 | 000,000,000 | -HSD | M] -- C:\Users\Mario\AppData\Local\Temporary Internet Files
[2008.11.22 13:59:27 | 000,000,000 | -HSD | M] -- C:\Users\Mario\AppData\Local\Verlauf
[2009.11.11 19:43:33 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\VirtualStore
[2009.11.11 19:38:12 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\www.scriptinternals.com
[2010.01.20 20:20:50 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\Zattoo
[2008.11.22 15:41:37 | 000,000,000 | ---D | M] -- C:\Users\Mario\AppData\Local\ZattooPlayer
 
< %localappdata%\*.* >
[2012.11.22 22:17:35 | 000,008,268 | ---- | M] () -- C:\Users\Mario\AppData\Local\d3d9caps.dat
[2012.01.22 17:16:34 | 000,018,944 | ---- | M] () -- C:\Users\Mario\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.22 14:34:27 | 000,091,992 | ---- | M] () -- C:\Users\Mario\AppData\Local\edsinstaller.txt-20081122.log
[2012.09.04 18:27:33 | 000,103,992 | ---- | M] () -- C:\Users\Mario\AppData\Local\GDIPFONTCACHEV1.DAT
[2012.11.27 21:32:08 | 002,951,443 | -H-- | M] () -- C:\Users\Mario\AppData\Local\IconCache.db
 
< %localappdata%\*.exe /s >
[2008.12.07 00:45:38 | 002,356,088 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Mario\AppData\Local\Adobe\Updater5\Install\AdobeUpdater\AdobeUpdater.exe
[2008.12.07 00:45:14 | 000,082,808 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Mario\AppData\Local\Adobe\Updater5\Install\AdobeUpdater\AdobeUpdaterInstallMgr.exe
[2012.09.21 09:14:50 | 000,888,472 | ---- | M] () -- C:\Users\Mario\AppData\Local\Temp\MyClaroTB.exe
[2008.11.22 14:50:23 | 000,204,800 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Users\Mario\AppData\Local\Temp\RtkBtMnt.exe
[2012.11.22 20:50:28 | 032,218,776 | ---- | M] () -- C:\Users\Mario\AppData\Local\Temp\SHSetup.exe
[2012.11.20 22:35:31 | 000,378,008 | ---- | M] (Babylon Ltd.) -- C:\Users\Mario\AppData\Local\Temp\uninst1.exe
[2012.11.20 22:25:07 | 000,108,875 | ---- | M] () -- C:\Users\Mario\AppData\Local\Temp\Wajam.exe
[2012.11.20 22:25:23 | 000,417,088 | ---- | M] () -- C:\Users\Mario\AppData\Local\Temp\wajam_install.exe
[5 C:\Users\Mario\AppData\Local\Temp\*.tmp files -> C:\Users\Mario\AppData\Local\Temp\*.tmp -> ]
[2004.05.26 22:55:46 | 000,894,885 | ---- | M] () -- C:\Users\Mario\AppData\Local\Temp\_PA783\setup.exe
[2012.11.18 16:08:43 | 001,842,840 | ---- | M] (Babylon Ltd.) -- C:\Users\Mario\AppData\Local\Temp\4023FD79-BAB0-7891-A9E2-3D46482BF413\Latest\Setup.exe
 
< %allusersprofile%\*.  >
[2012.09.22 19:37:28 | 000,000,000 | ---D | M] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2008.05.07 19:02:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Acer GameZone Console
[2012.01.28 17:38:05 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009.11.30 17:58:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple
[2009.11.30 17:57:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012.09.01 13:27:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Avira
[2010.12.28 18:39:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Azureus
[2012.11.20 22:24:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Browser Manager
[2012.09.04 17:34:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Cisco
[2009.11.21 00:26:49 | 000,000,000 | ---D | M] -- C:\ProgramData\ConeXware
[2009.01.23 19:43:58 | 000,000,000 | ---D | M] -- C:\ProgramData\CyberLink
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2008.11.23 10:59:25 | 000,000,000 | ---D | M] -- C:\ProgramData\eSobi
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2008.05.07 18:52:27 | 000,000,000 | ---D | M] -- C:\ProgramData\FloodLightGames
[2011.11.20 14:49:17 | 000,000,000 | ---D | M] -- C:\ProgramData\hps
[2012.11.22 22:01:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes
[2010.10.01 18:40:25 | 000,000,000 | ---D | M] -- C:\ProgramData\McAfee
[2012.09.04 18:03:52 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft
[2012.11.22 16:53:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help
[2012.05.22 18:46:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Mozilla
[2008.11.22 14:50:39 | 000,000,000 | ---D | M] -- C:\ProgramData\NVIDIA
[2008.11.23 12:08:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Oberon Games
[2008.11.23 10:33:04 | 000,000,000 | ---D | M] -- C:\ProgramData\PlayFirst
[2012.02.26 15:11:34 | 000,000,000 | ---D | M] -- C:\ProgramData\regid.1986-12.com.adobe
[2009.11.11 19:38:00 | 000,000,000 | ---D | M] -- C:\ProgramData\scriptinternals
[2008.12.21 01:31:19 | 000,000,000 | ---D | M] -- C:\ProgramData\SiteAdvisor
[2012.11.20 21:44:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Skype
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010.10.31 16:54:32 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2006.11.02 14:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011.11.20 19:32:32 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp
[2008.11.22 13:56:05 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2009.04.09 09:36:39 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2008.11.23 18:46:08 | 000,000,000 | ---D | M] -- C:\ProgramData\WLInstaller
[2008.05.07 18:51:35 | 000,000,000 | ---D | M] -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2010.06.21 20:57:19 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.11.30 17:58:12 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
 
< %allusersprofile%\*.* >
[2011.01.20 21:35:55 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2012.11.27 21:35:38 | 000,240,219 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.11.27 21:35:38 | 000,240,219 | ---- | M] () -- C:\ProgramData\nvModes.dat
 
< %allusersprofile%\*.exe /s >
[2007.03.23 22:10:17 | 003,124,038 | ---- | M] (Microsoft Corporation                                                                                                                                                                                                                                                                                       ) -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe
[2012.08.21 12:01:28 | 001,977,816 | ---- | M] (GEAR Software, Inc.) -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\GEARDIFx.exe
[2012.08.21 12:01:22 | 000,115,672 | ---- | M] (GEAR Software, Inc.) -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DifXInst32.exe
[2010.03.01 22:44:10 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\java-rmi.exe
[2010.03.01 22:44:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\java.exe
[2010.03.01 22:44:10 | 000,059,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\javacpl.exe
[2010.03.01 22:44:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\javaw.exe
[2010.03.01 22:44:10 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\javaws.exe
[2010.03.01 22:44:12 | 000,079,648 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jbroker.exe
[2010.03.01 22:44:12 | 000,023,328 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jp2launcher.exe
[2010.03.01 22:44:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jqs.exe
[2010.03.01 22:44:12 | 000,055,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jqsnotify.exe
[2010.03.01 22:44:12 | 000,386,872 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jucheck.exe
[2010.03.01 22:44:12 | 000,055,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jureg.exe
[2010.03.01 22:44:14 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\jusched.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\keytool.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\kinit.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\klist.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\ktab.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\orbd.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\pack200.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\policytool.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\rmid.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\rmiregistry.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\servertool.exe
[2010.03.01 22:44:14 | 000,030,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\ssvagent.exe
[2010.03.01 22:44:14 | 000,033,568 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\tnameserv.exe
[2010.03.01 22:44:14 | 000,132,896 | ---- | M] (Sun Microsystems, Inc.) -- C:\ProgramData\Adobe\CS5\jre\bin\unpack200.exe
[2012.09.22 19:25:16 | 000,073,624 | ---- | M] (Apple Inc.) -- C:\ProgramData\Apple Computer\Installer Cache\iTunes 10.7.0.21\SetupAdmin.exe
[2010.06.21 20:39:46 | 000,071,992 | ---- | M] (Apple Inc.) -- C:\ProgramData\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
[2012.11.15 10:56:40 | 000,612,640 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\ProgramData\Avira\AntiVir Desktop\TEMP\SELFUPDATE\update.exe
[2012.07.18 17:04:35 | 000,047,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\ProgramData\Avira\AntiVir Desktop\TEMP\SELFUPDATE\updrgui.exe
[2012.11.12 11:05:14 | 002,402,840 | ---- | M] () -- C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.exe
[2012.11.12 11:05:14 | 002,402,840 | ---- | M] () -- C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Mario\Desktop\IMG_1278.MOV:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Mario\Desktop\IMG_0435.MOV:TOC.WMV
@Alternate Data Stream - 2 bytes -> C:\Users\Mario\Unbenannt1.vbs:curpos
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:9F683177
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C95B63DA
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:417F5F46
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:73933431
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:4F636E25
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:2B99FE60
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:706E2910
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:580E04D8
@Alternate Data Stream - 1 bytes -> C:\Users\Mario\Unbenannt1.vbs:nodes

< End of report >
         

Extras.txt

OTL Extras logfile created on: 27.11.2012 21:43:46 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Mario\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.99 Gb Total Physical Memory | 1.67 Gb Available Physical Memory | 55.81% Memory free
6.19 Gb Paging File | 4.66 Gb Available in Paging File | 75.22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.65 Gb Total Space | 34.40 Gb Free Space | 24.12% Space Free | Partition Type: NTFS
Drive D: | 142.67 Gb Total Space | 142.58 Gb Free Space | 99.94% Space Free | Partition Type: NTFS
 
Computer Name: MARIO-PC | User Name: Mario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07154BCC-C9F0-481A-BB18-F94EDC239B47}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{11A70EF1-02C8-4948-AD21-2F1DFC2DBE06}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{1394E796-522C-4124-8139-5CFAF745D8BB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{16BD9158-72A6-437C-AD53-30E9B8444953}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{200F5844-A306-4858-A524-60B9091DA1CB}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{441FF610-8A4D-4243-A4A6-B2BC35D6CC40}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{4AEEFB0B-4CA2-48A6-938A-3850942BB541}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{507EF8B2-CBA8-45F7-8353-27BF0DAFF20B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{5AF25DF4-C2B4-41D4-ADE4-2DACD89249F0}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{717C35DC-352D-4E92-B4FC-9156045786E9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{73CD4EB6-FF2C-4E2A-AAA2-0516ECEBE053}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{74F3ED2E-A637-46E5-AEFF-5DA8291A190C}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{75757545-D8A8-4BE2-B9CD-D832D80E9CE2}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{8F94A72B-82E8-4DC8-9152-8DDB86E76855}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{9D0049CD-BBF4-48BE-9650-B57A89CEBA48}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A71AD2A9-85F1-43E4-B96D-57C7F5377A56}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{D5DDAADC-CE6A-459D-967A-C30D0298D8B8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DB2D34AD-61EE-48D5-830F-9A76DCBDA9E1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{E2286A89-8235-4119-ADB7-3069921C1749}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
"{E6716AEE-1B7C-4BD9-AA64-D0A639B1192B}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{EFB8A40D-E737-4BC9-808B-05A6BD76D0AC}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F23608EB-DF32-4F39-8C9F-4FC2CDA54054}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08F9EEF4-CA51-4961-A6F3-C3ECAD75E49A}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe | 
"{0C465CCF-F7E6-40AD-B137-9450CC13AD57}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{13107D0F-41AC-4C43-8A04-241588997E78}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{2477BAD5-F7B3-4588-BDEB-F8C765E9B00A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{26F97270-CA7D-4455-8420-3881595EC132}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2B50ECC1-1CB4-4B34-B6BF-FEE9D6135EF1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{2DFF51A0-13F3-4DAB-9EAF-6ADD5090E458}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3009C122-9ABC-4BEA-A858-E28473481491}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{50228E9E-C0E3-4B4C-A407-0F4D7054FCD2}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | 
"{52A7E98D-F696-4461-895B-D98A15BD57C4}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{5A9F6F07-232C-4735-9CAB-3D3F9830B72D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{618538CD-B91A-4D6F-94DF-91696C8504CE}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe | 
"{70288E78-7CBB-4621-A250-BFC8EBACA552}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe | 
"{8117F78D-362A-4D3D-9694-B36036792009}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{881719A5-BE8F-4128-88D7-C6C060B92C12}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{A15DC360-39A3-45D7-9922-C52EA94F3745}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{A938A3EB-7B3B-4E8B-BC06-AF52FFF6D522}" = protocol=6 | dir=out | app=system | 
"{ACE7AE53-F3E7-46E0-9549-5EE4BF9DC2F6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B9C7D6EB-C66C-4082-BA45-77BDA2622FE2}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{C8E14E97-A56B-4D1B-A400-B02D82AF8B3F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{CB0DFBE7-249F-4361-8E2F-20106F635C94}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{CD04A254-A2E8-4ADB-96D2-91074CD83499}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{D258BCE9-75AA-4564-AA5F-EBAC5D6372C6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D878E622-7C5E-4EA1-A9F3-90A0CC44B32A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D937731D-367D-412E-A4AF-34AB790FB05A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{DAB284D5-1C21-4B5C-87DF-F6FDF9540AA6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{DECF0F72-D9E7-41C2-B275-2D44EB3C252D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{E46ACD3F-2352-4E47-B95B-816893B60D42}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E587322B-3A8B-49D5-8B83-C48030BAE136}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe | 
"{E9309D69-7F05-4D11-B759-41C33B4C2475}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{F0EEC98B-434D-4DF0-B3D9-F1B3216E6938}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe | 
"{F58B531C-8E2B-43D5-824D-5D091E9071C0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{01616521-F157-4CF9-A2D6-503E14F7D7C1}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{550F4837-B9B0-442F-8D8B-A3127C5B2303}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{82A82A24-D296-4575-B589-801B771AA8A1}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | 
"TCP Query User{84751D6D-F83E-4E94-B268-1F713A7C3E30}C:\users\mario\temp\teamviewer\version4\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\mario\temp\teamviewer\version4\teamviewer.exe | 
"TCP Query User{AF946BD8-9D3D-4CEF-9C71-AB865986ACCC}E:\d-link.exe" = protocol=6 | dir=in | app=e:\d-link.exe | 
"TCP Query User{C07200CB-1643-4D5A-8E77-0FD4AB80015B}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"TCP Query User{C633D02B-63C3-4964-A99B-44068DD75BB7}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{D5082B83-1E20-446E-A047-D39119716EA4}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{32184EFB-EDFA-409E-AB1A-D76E2B83D2B0}C:\users\mario\temp\teamviewer\version4\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\mario\temp\teamviewer\version4\teamviewer.exe | 
"UDP Query User{5A41A84F-30AC-4029-AC04-19BBD398D296}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{632ED014-F78D-4A67-9EFC-19B64F5F3176}E:\d-link.exe" = protocol=17 | dir=in | app=e:\d-link.exe | 
"UDP Query User{692B61A8-75FA-407F-BDBC-5B10D203FF64}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"UDP Query User{7E17B843-5549-4BC1-BE4D-F08553BD6A0C}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{CDF97B15-0CED-47C2-8003-8F66058AA19B}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{DF51CDB6-32FC-459B-A043-02000249CEAE}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | 
"UDP Query User{E17F440A-7194-4049-86AE-865CB8463817}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00D0200F-3B4D-4A2F-869E-533ED835A943}" = Hervorhebe-Funktion (Windows Live Toolbar)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{218761F6-CBF6-4973-B910-A33E6563A1EA}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17
"{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}" = Smart Menus (Windows Live Toolbar)
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{31A5ED9F-E07B-4F6E-8179-27325BAAC502}" = AuthenTec Fingerprint Sensor Minimum Install
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}" = RollerCoaster Tycoon 2
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites für Windows Live Toolbar
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79872596-B887-E700-8D56-CADBC78BA5DE}" = Adobe Download Assistant
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}" = Software Version Updater
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 3.0.6.2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B64D470C-FD66-4115-9EF7-20BB51A5C51A}" = PowerArchiver 2010 German
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C1EC4E2D-6F63-4806-B88E-7685B6EC186E}" = Cisco AnyConnect VPN Client
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Acer Acer Bio Protection 6.0.00.15" = Acer Bio Protection

AAA 6.0.00.15
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Eduroam Tool" = Eduroam Tool (remove only)
"Free 3D Photo Maker_is1" = Free 3D Photo Maker version 2.0.14.221
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Studio_is1" = Free Studio version 4.8
"Free Video to iPhone Converter_is1" = Free Video to iPhone Converter version 3.2.18.426
"Free YouTube Download_is1" = Free YouTube Download version 3.0.20.1228
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.29.825
"Google Chrome" = Google Chrome
"GridVista" = Acer GridVista
"HijackThis" = HijackThis 2.0.2
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Toolbar Cleaner" = Toolbar Cleaner 1.1
"Uninstall_is1" = Uninstall 1.0.0.1
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinVDIG_is1" = WinVDIG 1.0
"Zattoo" = Zattoo 3.3.4 Beta
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2644863971-1121740263-626221152-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Typhon Installer" = Typhon Installer
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 07.02.2011 15:47:26 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2474659
 
Error - 07.02.2011 15:47:26 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2474659
 
Error - 08.02.2011 15:00:00 | Computer Name = Mario-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.02.2011 16:36:10 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 08.02.2011 16:36:10 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = 404: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 08.02.2011 16:36:10 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = 400: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 08.02.2011 16:36:10 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = 408: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 08.02.2011 16:36:10 | Computer Name = Mario-PC | Source = Bonjour Service | ID = 100
Description = 412: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 09.02.2011 15:13:07 | Computer Name = Mario-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.02.2011 15:35:32 | Computer Name = Mario-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Cisco AnyConnect VPN Client Events ]
Error - 27.11.2012 16:36:35 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
 1019 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
 not contact target 
 
Error - 27.11.2012 16:36:35 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 855 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
Error - 27.11.2012 16:36:35 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
 190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
Error - 27.11.2012 16:37:05 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: URL::URL File: .\Utility\URL.cpp Line: 38 Invoked Function:
 URL::setURL Return Code: -28508150 (0xFE4D000A) Description: URL_ERROR_BAD_URL parameter=
 
Error - 27.11.2012 16:37:13 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnTransportInitiateComplete File: .\IP\HttpSessionAsync.cpp
Line:
 1051 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
 -31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 
 
Error - 27.11.2012 16:37:13 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
 254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780
 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 
 
Error - 27.11.2012 16:37:13 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp
Line:
 1175 Invoked Function: CSocketTransport::postConnectProcessing Return Code: -31522780
 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 
 
Error - 27.11.2012 16:37:13 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
 1019 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
 not contact target 
 
Error - 27.11.2012 16:37:13 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 855 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
Error - 27.11.2012 16:37:13 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
 190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
[ System Events ]
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:33:01 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 27.11.2012 16:35:27 | Computer Name = Mario-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 27.11.2012 16:35:44 | Computer Name = Mario-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

checkup.txt

 Results of screen317's Security Check version 0.99.56  
 Windows Vista Service Pack 1 x86 (UAC is enabled)  
 Out of date service pack!! 
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Out of date HijackThis  installed! 
 HijackThis 2.0.2    
 Toolbar Cleaner 1.1   
 Java(TM) 6 Update 17  
 Java version out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Flash Player 	11.2.202.233  
 Adobe Reader 8 Adobe Reader out of Date! 
 Mozilla Firefox 16.0.2 Firefox out of Date!  
 Google Chrome 21.0.1180.83  
 Google Chrome 21.0.1180.89  
 Google Chrome 22.0.1229.79  
 Google Chrome 22.0.1229.94  
 Google Chrome 23.0.1271.64  
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSASCui.exe 
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Windows Defender MSASCui.exe   
 windows defender MpCmdRun.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

AdwCleaner[S1].txt

# AdwCleaner v2.009 - Datei am 27/11/2012 um 21:31:13 erstellt
# Aktualisiert am 24/11/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# Benutzer : Mario - MARIO-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Mario\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : Browser Manager

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Gelöscht mit Neustart : C:\ProgramData\Browser Manager
Ordner Gelöscht : C:\Program Files\Common Files\Plasmoo
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Mario\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Ordner Gelöscht : C:\Users\Mario\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Ordner Gelöscht : C:\Users\Mario\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\Mario\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Mario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager

***** [Registrierungsdatenbank] *****

Daten Gelöscht : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\browse~1\25911~1.18\{c16c1~1\mngr.dll
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Default Tab
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wajam
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Default Tab
Schlüssel Gelöscht : HKLM\Software\DefaultTab
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKU\S-1-5-21-2644863971-1121740263-626221152-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6001.18000

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default-1353694430434 [Profil par défaut]
Datei : C:\Users\Mario\AppData\Roaming\Mozilla\Firefox\Profiles\3h6pdbc6.default-1353694430434\prefs.js

Gelöscht : user_pref("browser.search.defaultenginename", "Claro Search");
Gelöscht : user_pref("browser.search.order.1", "Claro Search");
Gelöscht : user_pref("browser.search.selectedEngine", "Claro Search");
Gelöscht : user_pref("keyword.URL", "hxxp://www.claro-search.com/?affID=117452&tt=4712_8&babsrc=KW_ss&mntrId=24[...]

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Mario\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.3] : homepage = "hxxp://www.claro-search.com/?affID=117452&tt=4712_8&babsrc=HP_ss&mntrId=240e99d10000000[...]
Gelöscht [l.4] : urls_to_restore_on_startup ="session": { "restore_on_startup": 4,  [ "hxxp://www.claro-search.com/?[...]

*************************

AdwCleaner[S1].txt - [3837 octets] - [27/11/2012 21:31:13]

########## EOF - C:\AdwCleaner[S1].txt - [3897 octets] ##########
         

Voila. Ich hoffe mir kann geholfen werden

Beste Grüsse

Mario

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
  Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
• Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
• Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
• Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
  Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
  Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Warum hast du das Service Pack 2 für Windows Vista nicht installiert?





Schritt 1
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop.

• Starte das Tool mit Doppelklick. Vista und 7 Nutzer bitte mit Rechtsklick "als Administrator ausführen" starten.
• Das Tool wird sich öffnen. Drücke eine beliebige Taste, um den Suchlauf zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 2
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Bitte poste mit deiner nächsten Antwort

• die Beantwortung der gestellten Fragen,
• die Logdatei von JRT,
• die Logdatei von ComboFix.

Hallo Matthias

Besten Dank für deine Antwort!

Warum hast du das Service Pack 2 für Windows Vista nicht installiert?

Gute Frage... Wie hole ich das nach?

Combofix log

ComboFix 12-11-28.02 - Mario 28.11.2012  21:29:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.41.1031.18.3066.1593 [GMT 1:00]
ausgeführt von:: c:\users\Mario\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Acer\Acer Bio Protection\PwdFilter.dll
c:\users\Mario\AppData\Roaming\.#
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-10-28 bis 2012-11-28  ))))))))))))))))))))))))))))))
.
.
2012-11-28 20:42 . 2012-11-28 20:47	--------	d-----w-	c:\users\Mario\AppData\Local\temp
2012-11-28 20:42 . 2012-11-28 20:42	--------	d-----w-	c:\users\Testkonto\AppData\Local\temp
2012-11-28 20:11 . 2012-11-28 20:11	--------	d-----w-	c:\windows\ERUNT
2012-11-28 20:09 . 2012-11-28 20:09	--------	d-----w-	C:\JRT
2012-11-27 20:42 . 2012-11-08 18:00	6812136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A66ABE43-1723-4A10-835A-BFDE5EAAE2B6}\mpengine.dll
2012-11-23 23:24 . 2012-11-23 23:24	--------	d-----w-	c:\program files\Hex-Editor MX
2012-11-23 18:15 . 2012-11-23 18:19	--------	d-----w-	c:\program files\Toolbar Cleaner
2012-11-22 21:01 . 2012-11-22 21:01	--------	d-----w-	c:\users\Mario\AppData\Roaming\Malwarebytes
2012-11-22 21:01 . 2012-11-22 21:01	--------	d-----w-	c:\programdata\Malwarebytes
2012-11-22 20:48 . 2012-11-22 20:49	--------	d-----w-	c:\windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-11-22 19:52 . 2012-11-22 19:52	--------	d-----w-	c:\program files\Enigma Software Group
2012-11-22 19:50 . 2012-11-22 19:50	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2012-11-20 21:24 . 2012-11-20 21:24	--------	d-----w-	c:\programdata\Browser Manager
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-01 21:02 . 2012-11-01 11:04	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2012-11-01 11:04	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2012-11-01 11:05 . 2012-11-01 11:04	261600	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 22:38	121392	----a-w-	c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-25 6111232]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-25 809480]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-30 397312]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2008-11-22 1216512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-11-22 13:32	3110912	----a-w-	c:\program files\Acer\Acer Bio Protection\WinNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 18:41]
.
2012-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:21]
.
2012-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:21]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{78523D96-7FA9-469D-A2F0-83E93AEFFF96}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.ch/
mStart Page = hxxp://de.intl.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
DPF: 538793D5-659C-4639-A56C-A179AD87ED44 - vpnweb.cab
FF - ProfilePath - c:\users\Mario\AppData\Roaming\Mozilla\Firefox\Profiles\3h6pdbc6.default-1353694430434\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-eRecoveryService - (no file)
AddRemove-Free 3D Photo Maker_is1 - c:\program files\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-Free Audio CD Burner_is1 - c:\program files\DVDVideoSoft\Free Audio CD Burner\unins000.exe
AddRemove-Free Studio_is1 - c:\program files\DVDVideoSoft\Free Studio\unins000.exe
AddRemove-Free Video to iPhone Converter_is1 - c:\program files\DVDVideoSoft\Free Video to iPhone Converter\unins000.exe
AddRemove-Free YouTube Download_is1 - c:\program files\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-Free YouTube to MP3 Converter_is1 - c:\program files\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-Uninstall_is1 - c:\program files\Common Files\DVDVideoSoft\unins000.exe
AddRemove-{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} - c:\users\Mario\AppData\Local\SwvUpdater\Updater.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-11-28 21:47
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3868)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe
c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Acer\Acer Bio Protection\BASVC.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Acer\Acer VCM\RS_Service.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-28  21:53:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-11-28 20:53
.
Vor Suchlauf: 13 Verzeichnis(se), 34'730'893'312 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 35'057'647'616 Bytes frei
.
- - End Of File - - 57A122293BC28B91262F70DFCEB818B9
         

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 3.5.8 (11.28.2012:2)
OS: Windows Vista (TM) Home Premium x86
Ran by Mario on 28.11.2012 at 21:11:46.90
Blog: hxxp://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\windows nt\currentversion\windows\\AppInit_DLLs
Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\main\\bProtector Start Page 
Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\bProtectorDefaultScope 



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{9afb8248-617f-460d-9366-d71cdeda3179}



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\browser manager"
Successfully deleted: [Folder] "C:\Users\Mario\AppData\Roaming\dvdvideosoft"
Successfully deleted: [Folder] "C:\Users\Mario\AppData\Roaming\dvdvideosoftiehelpers"
Successfully deleted: [Folder] "C:\Program Files\Common Files\dvdvideosoft"
Successfully deleted: [Folder] "C:\Program Files\dvdvideosoft"



~~~ FireFox

Successfully deleted: [File] C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\bprotector_extensions.sqlite
Successfully deleted: [File] C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\bprotector_prefs.js
Successfully deleted: [Registry Value] hkey_current_user\software\mozilla\firefox\extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}
Successfully deleted the following from C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\prefs.js

user_pref("browser.search.defaultenginename", "Claro Search");
user_pref("browser.search.order.1", "Claro Search");
user_pref("browser.search.selectedEngine", "Claro Search");
user_pref("keyword.URL", "hxxp://www.claro-search.com/?affID=117452&tt=4712_8&babsrc=KW_ss&mntrId=240e99d10000000000000016ea4f8140&q=");



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Mario\appdata\local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Successfully deleted: [Folder] C:\Users\Mario\appdata\local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.11.2012 at 21:18:30.90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Vielen Dank für deine Bemühungen

Gruss Mario

Servus,



um das Service Pack 2 kümmern wir uns gemeinsam zum Schluss.



Schritt 1
Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

• Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
• Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
• Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
• Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
  
  
  

  Folder::
  c:\programdata\Browser Manager
           

• Speichere dies als CFScript.txt auf deinem Desktop.
• Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
  Danach wieder anstellen nicht vergessen!
• Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
• Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  
  
• Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
• Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
  Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Schritt 2
Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.





Bitte poste mit deiner nächsten Antwort

• die Logdatei von ComboFix,
• die beiden Logdateien von OTL.

Hallöchen

Ist gut, machen wir so.

Hier die log's:

ComboFix

ComboFix 12-11-30.02 - Mario 30.11.2012  16:02:11.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.41.1031.18.3066.1760 [GMT 1:00]
ausgeführt von:: c:\users\Mario\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Mario\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Browser Manager
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\chrome.manifest
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-16.0.dll
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-17.0.dll
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-3.6.xpt
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content\mngr.js
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content\overlay.xul
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\install.rdf
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.crx
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.exe
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.settings
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22
c:\programdata\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-10-28 bis 2012-11-30  ))))))))))))))))))))))))))))))
.
.
2012-11-30 15:13 . 2012-11-30 15:13	--------	d-----w-	c:\users\Testkonto\AppData\Local\temp
2012-11-30 15:13 . 2012-11-30 15:13	--------	d-----w-	c:\users\Märkli\AppData\Local\temp
2012-11-30 15:13 . 2012-11-30 15:13	--------	d-----w-	c:\users\Habbbo Test\AppData\Local\temp
2012-11-30 15:13 . 2012-11-30 15:13	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-11-28 20:53 . 2012-11-30 15:13	--------	d-----w-	c:\users\Mario\AppData\Local\temp
2012-11-28 20:11 . 2012-11-28 20:11	--------	d-----w-	c:\windows\ERUNT
2012-11-28 20:09 . 2012-11-28 20:09	--------	d-----w-	C:\JRT
2012-11-27 20:42 . 2012-11-08 18:00	6812136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A66ABE43-1723-4A10-835A-BFDE5EAAE2B6}\mpengine.dll
2012-11-23 23:24 . 2012-11-23 23:24	--------	d-----w-	c:\program files\Hex-Editor MX
2012-11-23 18:15 . 2012-11-23 18:19	--------	d-----w-	c:\program files\Toolbar Cleaner
2012-11-22 21:01 . 2012-11-22 21:01	--------	d-----w-	c:\users\Mario\AppData\Roaming\Malwarebytes
2012-11-22 21:01 . 2012-11-22 21:01	--------	d-----w-	c:\programdata\Malwarebytes
2012-11-22 20:48 . 2012-11-22 20:49	--------	d-----w-	c:\windows\DDABC66756B3412282B02F5782EA2F9A.TMP
2012-11-22 19:52 . 2012-11-22 19:52	--------	d-----w-	c:\program files\Enigma Software Group
2012-11-22 19:50 . 2012-11-22 19:50	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-01 21:02 . 2012-11-01 11:04	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2012-11-01 11:04	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2012-11-01 11:05 . 2012-11-01 11:04	261600	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 22:38	121392	----a-w-	c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-25 6111232]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-25 809480]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-30 397312]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2008-11-22 1216512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-11-22 13:32	3110912	----a-w-	c:\program files\Acer\Acer Bio Protection\WinNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 18:41]
.
2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:21]
.
2012-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:21]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{78523D96-7FA9-469D-A2F0-83E93AEFFF96}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.ch/
mStart Page = hxxp://de.intl.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
DPF: 538793D5-659C-4639-A56C-A179AD87ED44 - vpnweb.cab
FF - ProfilePath - c:\users\Mario\AppData\Roaming\Mozilla\Firefox\Profiles\3h6pdbc6.default-1353694430434\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-11-30 16:13
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2012-11-30  16:15:16
ComboFix-quarantined-files.txt  2012-11-30 15:15
ComboFix2.txt  2012-11-28 20:53
.
Vor Suchlauf: 17 Verzeichnis(se), 34'606'833'664 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 35'366'596'608 Bytes frei
.
- - End Of File - - 995DD6A3BC235637C4E37D81EA4DDEE9
         

OTL.txt

OTL logfile created on: 30.11.2012 16:17:49 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Mario\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.99 Gb Total Physical Memory | 1.72 Gb Available Physical Memory | 57.57% Memory free
6.19 Gb Paging File | 4.86 Gb Available in Paging File | 78.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.65 Gb Total Space | 32.99 Gb Free Space | 23.13% Space Free | Partition Type: NTFS
Drive D: | 142.67 Gb Total Space | 142.58 Gb Free Space | 99.94% Space Free | Partition Type: NTFS
 
Computer Name: MARIO-PC | User Name: Mario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Mario\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Acer\Acer Bio Protection\CompPtcVUI.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
PRC - C:\Programme\Acer\Acer VCM\acp2HID.exe (Acer Inc.)
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\e3180b4230f052996adb81da3dc64ad0\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\c933fd5d1d27f268331890d7ddba8fec\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\ca69ec9d6589d3526ee38212ef28e2bb\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll ()
MOD - C:\Windows\System32\SysHook.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll ()
MOD - C:\Programme\Acer\Acer VCM\AcerControl.dll ()
MOD - C:\Programme\Launch Manager\PowerUtl.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SwitchBoard) -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IGBASVC) -- C:\Programme\Acer\Acer Bio Protection\BASVC.exe ()
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (eDataSecurity Service) -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (yukonwlh) -- system32\DRIVERS\yk60x86.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (mbr) -- C:\ComboFix\mbr.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV - (catchme) -- C:\Users\Mario\AppData\Local\Temp\catchme.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (AlfaFF) -- C:\Windows\System32\drivers\AlfaFF.sys (Alfa Corporation)
DRV - (ATSWPDRV) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.23 19:20:30 | 000,000,000 | ---D | M]
 
[2008.11.30 10:38:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mario\AppData\Roaming\mozilla\Extensions
[2012.11.25 21:05:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mario\AppData\Roaming\mozilla\Firefox\Profiles\3h6pdbc6.default-1353694430434\Extensions
[2012.11.20 22:24:09 | 000,006,520 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\searchplugins\mngr.xml
[2012.11.01 12:04:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.01 12:05:08 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.05.22 18:46:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.18 21:01:38 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.05.22 18:46:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.22 18:46:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.22 18:46:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.22 18:46:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2012.11.30 16:13:23 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Programme\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil32_11_2_202_233_Plugin.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe ()
O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: 538793D5-659C-4639-A56C-A179AD87ED44 vpnweb.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A7FD0626-A8DE-43FE-A495-EA62852AAA69}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - (C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll) - C:\Programme\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.)
O24 - Desktop WallPaper: C:\Users\Mario\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mario\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.30 16:15:20 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.11.30 16:15:18 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.11.30 15:58:01 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.11.30 15:54:38 | 005,009,213 | R--- | C] (Swearware) -- C:\Users\Mario\Desktop\ComboFix.exe
[2012.11.28 21:53:39 | 000,000,000 | ---D | C] -- C:\Users\Mario\AppData\Local\temp
[2012.11.28 21:25:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.11.28 21:25:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.11.28 21:25:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.11.28 21:23:47 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.11.28 21:23:05 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.11.28 21:11:39 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2012.11.28 21:09:14 | 000,000,000 | ---D | C] -- C:\JRT
[2012.11.27 21:27:26 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Mario\Desktop\OTL.exe
[2012.11.24 00:24:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hex-Editor MX
[2012.11.24 00:24:21 | 000,000,000 | ---D | C] -- C:\Program Files\Hex-Editor MX
[2012.11.23 19:15:56 | 000,000,000 | ---D | C] -- C:\Users\Mario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Toolbar Cleaner
[2012.11.23 19:15:56 | 000,000,000 | ---D | C] -- C:\Program Files\Toolbar Cleaner
[2012.11.22 22:01:34 | 000,000,000 | ---D | C] -- C:\Users\Mario\AppData\Roaming\Malwarebytes
[2012.11.22 22:01:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.22 20:52:00 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.11.22 20:50:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2012.11.20 22:23:55 | 000,000,000 | ---D | C] -- C:\Users\Mario\Desktop\Programme\Documents\Downloads
[2012.11.01 12:04:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.30 16:13:23 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.11.30 15:54:30 | 005,009,213 | R--- | M] (Swearware) -- C:\Users\Mario\Desktop\ComboFix.exe
[2012.11.30 15:51:16 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.30 15:51:16 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.30 15:51:16 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.30 15:51:16 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.30 15:49:18 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.30 15:45:38 | 000,002,299 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\acervcmtmp.ini
[2012.11.30 15:44:24 | 000,240,219 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.11.30 15:44:24 | 000,240,219 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.11.30 15:44:23 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.30 15:44:12 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2012.11.30 15:43:43 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.30 15:43:43 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.30 15:43:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.28 21:43:17 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.28 21:08:27 | 000,910,564 | ---- | M] () -- C:\Users\Mario\Desktop\JRT.exe
[2012.11.27 21:58:59 | 000,856,731 | ---- | M] () -- C:\Users\Mario\Desktop\SecurityCheck.exe
[2012.11.27 21:30:31 | 000,480,125 | ---- | M] () -- C:\Users\Mario\Desktop\adwcleaner.exe
[2012.11.27 21:27:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Mario\Desktop\OTL.exe
[2012.11.23 19:15:56 | 000,000,887 | ---- | M] () -- C:\Users\Mario\Desktop\Toolbar Cleaner.lnk
[2012.11.22 22:17:35 | 000,008,268 | ---- | M] () -- C:\Users\Mario\AppData\Local\d3d9caps.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.28 21:25:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.11.28 21:25:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.11.28 21:25:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.11.28 21:25:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.11.28 21:25:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.11.28 21:08:25 | 000,910,564 | ---- | C] () -- C:\Users\Mario\Desktop\JRT.exe
[2012.11.27 21:58:43 | 000,856,731 | ---- | C] () -- C:\Users\Mario\Desktop\SecurityCheck.exe
[2012.11.27 21:30:17 | 000,480,125 | ---- | C] () -- C:\Users\Mario\Desktop\adwcleaner.exe
[2012.11.23 19:15:56 | 000,000,887 | ---- | C] () -- C:\Users\Mario\Desktop\Toolbar Cleaner.lnk
[2012.11.20 22:24:14 | 000,000,044 | ---- | C] () -- C:\Users\Mario\Desktop\Track08.cda
[2011.01.20 21:35:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.11.11 19:42:26 | 000,000,101 | ---- | C] () -- C:\Users\Mario\Unbenannt1.vbs
[2009.11.07 13:03:12 | 000,002,299 | ---- | C] () -- C:\Users\Mario\AppData\Roaming\acervcmtmp.ini
[2008.12.14 15:55:48 | 000,017,902 | ---- | C] () -- C:\Users\Mario\AppData\Roaming\UserTile.png
[2008.12.04 21:27:33 | 000,018,944 | ---- | C] () -- C:\Users\Mario\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.30 15:56:08 | 000,008,268 | ---- | C] () -- C:\Users\Mario\AppData\Local\d3d9caps.dat
[2008.11.23 16:29:53 | 000,000,680 | RHS- | C] () -- C:\Users\Mario\ntuser.pol
[2008.11.22 14:01:14 | 000,240,219 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008.11.22 13:59:35 | 000,240,219 | ---- | C] () -- C:\ProgramData\nvModes.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 16:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.03.03 05:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 03:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Mario\Desktop\IMG_1278.MOV:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Mario\Desktop\IMG_0435.MOV:TOC.WMV
@Alternate Data Stream - 2 bytes -> C:\Users\Mario\Unbenannt1.vbs:curpos
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:9F683177
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C95B63DA
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:417F5F46
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:73933431
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:4F636E25
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:2B99FE60
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:706E2910
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:580E04D8
@Alternate Data Stream - 1 bytes -> C:\Users\Mario\Unbenannt1.vbs:nodes

< End of report >
         

Extras.txt

OTL Extras logfile created on: 30.11.2012 16:17:49 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Mario\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.99 Gb Total Physical Memory | 1.72 Gb Available Physical Memory | 57.57% Memory free
6.19 Gb Paging File | 4.86 Gb Available in Paging File | 78.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.65 Gb Total Space | 32.99 Gb Free Space | 23.13% Space Free | Partition Type: NTFS
Drive D: | 142.67 Gb Total Space | 142.58 Gb Free Space | 99.94% Space Free | Partition Type: NTFS
 
Computer Name: MARIO-PC | User Name: Mario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07154BCC-C9F0-481A-BB18-F94EDC239B47}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{11A70EF1-02C8-4948-AD21-2F1DFC2DBE06}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{1394E796-522C-4124-8139-5CFAF745D8BB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{16BD9158-72A6-437C-AD53-30E9B8444953}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{200F5844-A306-4858-A524-60B9091DA1CB}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{441FF610-8A4D-4243-A4A6-B2BC35D6CC40}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{4AEEFB0B-4CA2-48A6-938A-3850942BB541}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{507EF8B2-CBA8-45F7-8353-27BF0DAFF20B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{5AF25DF4-C2B4-41D4-ADE4-2DACD89249F0}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{717C35DC-352D-4E92-B4FC-9156045786E9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{73CD4EB6-FF2C-4E2A-AAA2-0516ECEBE053}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{74F3ED2E-A637-46E5-AEFF-5DA8291A190C}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{75757545-D8A8-4BE2-B9CD-D832D80E9CE2}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{8F94A72B-82E8-4DC8-9152-8DDB86E76855}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{9D0049CD-BBF4-48BE-9650-B57A89CEBA48}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A71AD2A9-85F1-43E4-B96D-57C7F5377A56}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{D5DDAADC-CE6A-459D-967A-C30D0298D8B8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DB2D34AD-61EE-48D5-830F-9A76DCBDA9E1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{E2286A89-8235-4119-ADB7-3069921C1749}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
"{E6716AEE-1B7C-4BD9-AA64-D0A639B1192B}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{EFB8A40D-E737-4BC9-808B-05A6BD76D0AC}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F23608EB-DF32-4F39-8C9F-4FC2CDA54054}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08F9EEF4-CA51-4961-A6F3-C3ECAD75E49A}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe | 
"{0C465CCF-F7E6-40AD-B137-9450CC13AD57}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{13107D0F-41AC-4C43-8A04-241588997E78}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{2477BAD5-F7B3-4588-BDEB-F8C765E9B00A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{26F97270-CA7D-4455-8420-3881595EC132}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2B50ECC1-1CB4-4B34-B6BF-FEE9D6135EF1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{2DFF51A0-13F3-4DAB-9EAF-6ADD5090E458}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3009C122-9ABC-4BEA-A858-E28473481491}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{50228E9E-C0E3-4B4C-A407-0F4D7054FCD2}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | 
"{52A7E98D-F696-4461-895B-D98A15BD57C4}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{5A9F6F07-232C-4735-9CAB-3D3F9830B72D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{618538CD-B91A-4D6F-94DF-91696C8504CE}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe | 
"{70288E78-7CBB-4621-A250-BFC8EBACA552}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe | 
"{8117F78D-362A-4D3D-9694-B36036792009}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{881719A5-BE8F-4128-88D7-C6C060B92C12}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{A15DC360-39A3-45D7-9922-C52EA94F3745}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{A938A3EB-7B3B-4E8B-BC06-AF52FFF6D522}" = protocol=6 | dir=out | app=system | 
"{ACE7AE53-F3E7-46E0-9549-5EE4BF9DC2F6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B9C7D6EB-C66C-4082-BA45-77BDA2622FE2}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{C8E14E97-A56B-4D1B-A400-B02D82AF8B3F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{CB0DFBE7-249F-4361-8E2F-20106F635C94}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{CD04A254-A2E8-4ADB-96D2-91074CD83499}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{D258BCE9-75AA-4564-AA5F-EBAC5D6372C6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D878E622-7C5E-4EA1-A9F3-90A0CC44B32A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D937731D-367D-412E-A4AF-34AB790FB05A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{DAB284D5-1C21-4B5C-87DF-F6FDF9540AA6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{DECF0F72-D9E7-41C2-B275-2D44EB3C252D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{E46ACD3F-2352-4E47-B95B-816893B60D42}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E587322B-3A8B-49D5-8B83-C48030BAE136}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe | 
"{E9309D69-7F05-4D11-B759-41C33B4C2475}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{F0EEC98B-434D-4DF0-B3D9-F1B3216E6938}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe | 
"{F58B531C-8E2B-43D5-824D-5D091E9071C0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{01616521-F157-4CF9-A2D6-503E14F7D7C1}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{550F4837-B9B0-442F-8D8B-A3127C5B2303}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{82A82A24-D296-4575-B589-801B771AA8A1}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | 
"TCP Query User{84751D6D-F83E-4E94-B268-1F713A7C3E30}C:\users\mario\temp\teamviewer\version4\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\mario\temp\teamviewer\version4\teamviewer.exe | 
"TCP Query User{AF946BD8-9D3D-4CEF-9C71-AB865986ACCC}E:\d-link.exe" = protocol=6 | dir=in | app=e:\d-link.exe | 
"TCP Query User{C07200CB-1643-4D5A-8E77-0FD4AB80015B}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"TCP Query User{C633D02B-63C3-4964-A99B-44068DD75BB7}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{D5082B83-1E20-446E-A047-D39119716EA4}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{32184EFB-EDFA-409E-AB1A-D76E2B83D2B0}C:\users\mario\temp\teamviewer\version4\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\mario\temp\teamviewer\version4\teamviewer.exe | 
"UDP Query User{5A41A84F-30AC-4029-AC04-19BBD398D296}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{632ED014-F78D-4A67-9EFC-19B64F5F3176}E:\d-link.exe" = protocol=17 | dir=in | app=e:\d-link.exe | 
"UDP Query User{692B61A8-75FA-407F-BDBC-5B10D203FF64}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"UDP Query User{7E17B843-5549-4BC1-BE4D-F08553BD6A0C}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{CDF97B15-0CED-47C2-8003-8F66058AA19B}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{DF51CDB6-32FC-459B-A043-02000249CEAE}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | 
"UDP Query User{E17F440A-7194-4049-86AE-865CB8463817}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00D0200F-3B4D-4A2F-869E-533ED835A943}" = Hervorhebe-Funktion (Windows Live Toolbar)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{218761F6-CBF6-4973-B910-A33E6563A1EA}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17
"{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}" = Smart Menus (Windows Live Toolbar)
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{31A5ED9F-E07B-4F6E-8179-27325BAAC502}" = AuthenTec Fingerprint Sensor Minimum Install
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}" = RollerCoaster Tycoon 2
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites für Windows Live Toolbar
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79872596-B887-E700-8D56-CADBC78BA5DE}" = Adobe Download Assistant
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 3.0.6.2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B64D470C-FD66-4115-9EF7-20BB51A5C51A}" = PowerArchiver 2010 German
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C1EC4E2D-6F63-4806-B88E-7685B6EC186E}" = Cisco AnyConnect VPN Client
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Acer Acer Bio Protection 6.0.00.15" = Acer Bio Protection

AAA 6.0.00.15
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Eduroam Tool" = Eduroam Tool (remove only)
"Google Chrome" = Google Chrome
"GridVista" = Acer GridVista
"HijackThis" = HijackThis 2.0.2
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Toolbar Cleaner" = Toolbar Cleaner 1.1
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinVDIG_is1" = WinVDIG 1.0
"Zattoo" = Zattoo 3.3.4 Beta
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Typhon Installer" = Typhon Installer
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.11.2012 16:18:32 | Computer Name = Mario-PC | Source = Windows Search Service | ID = 3083
Description = 
 
Error - 28.11.2012 16:23:47 | Computer Name = Mario-PC | Source = Windows Search Service | ID = 3083
Description = 
 
Error - 28.11.2012 16:31:50 | Computer Name = Mario-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe_ProfSvc, Version 6.0.6001.18000,
 Zeitstempel 0x47918b89, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel
 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x00000000,  Prozess-ID 0x448, 
Anwendungsstartzeit 01cdcda3b65a498c.
 
Error - 28.11.2012 16:34:21 | Computer Name = Mario-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 28.11.2012 16:42:43 | Computer Name = Mario-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 28.11.2012 16:46:21 | Computer Name = Mario-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.11.2012 10:44:09 | Computer Name = Mario-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.11.2012 10:45:53 | Computer Name = Mario-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AppleSyncNotifier.exe, Version 1.6.72.0, Zeitstempel
 0x4cafabcb, fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18631, Zeitstempel
 0x4da467f0, Ausnahmecode 0xc06d007e, Fehleroffset 0x00044503,  Prozess-ID 0xe60, 
Anwendungsstartzeit 01cdcf093f8dc3c2.
 
[ Cisco AnyConnect VPN Client Events ]
Error - 30.11.2012 10:45:04 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
 1019 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
 not contact target 
 
Error - 30.11.2012 10:45:04 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 855 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
Error - 30.11.2012 10:45:04 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
 190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
Error - 30.11.2012 10:45:34 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: URL::URL File: .\Utility\URL.cpp Line: 38 Invoked Function:
 URL::setURL Return Code: -28508150 (0xFE4D000A) Description: URL_ERROR_BAD_URL parameter=
 
Error - 30.11.2012 10:45:42 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CHttpSessionAsync::OnTransportInitiateComplete File: .\IP\HttpSessionAsync.cpp
Line:
 1051 Invoked Function: ISocketTransportCB::OnTransportInitiateComplete Return Code:
 -31522780 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 
 
Error - 30.11.2012 10:45:42 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp
Line:
 254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780
 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 
 
Error - 30.11.2012 10:45:42 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp
Line:
 1175 Invoked Function: CSocketTransport::postConnectProcessing Return Code: -31522780
 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 
 
Error - 30.11.2012 10:45:42 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp
Line:
 1019 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363
 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could
 not contact target 
 
Error - 30.11.2012 10:45:42 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 855 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
Error - 30.11.2012 10:45:42 | Computer Name = Mario-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
 190 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)
Description:
 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 
 
[ System Events ]
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:06:32 | Computer Name = Mario-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description = 
 
Error - 30.11.2012 11:09:01 | Computer Name = Mario-PC | Source = Service Control Manager | ID = 7030
Description = 
 
Error - 30.11.2012 11:13:25 | Computer Name = Mario-PC | Source = Service Control Manager | ID = 7030
Description = 
 
 
< End of report >
         

Besten Dank. Schönes Weekend

Servus,

Fixen mit OTL

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

:OTL
[2012.11.20 22:24:09 | 000,006,520 | ---- | M] () -- C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\searchplugins\mngr.xml
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

:commands
[Emptytemp]
         

• Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
• Schließe bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
  ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
  Kopiere nun den Inhalt hier in Deinen Thread

Gibt es noch Probleme mit Claro-Search?
Wenn ja, in welchem Browser?

Hey

Also Claro-Search schein weg zu sein. 1000x Dank!

Hier das OTL

All processes killed
========== OTL ==========
C:\Users\Mario\AppData\Roaming\mozilla\firefox\profiles\3h6pdbc6.default-1353694430434\searchplugins\mngr.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 134 bytes
->Flash cache emptied: 56543 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Habbbo Test
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 24838151 bytes
->Flash cache emptied: 649 bytes
 
User: Mario
->Temp folder emptied: 34326 bytes
->Temporary Internet Files folder emptied: 996753358 bytes
->Java cache emptied: 80429806 bytes
->FireFox cache emptied: 62198814 bytes
->Google Chrome cache emptied: 6888102 bytes
->Apple Safari cache emptied: 2751488 bytes
->Opera cache emptied: 10368101 bytes
->Flash cache emptied: 3215975 bytes
 
User: Märkli
->Temp folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Testkonto
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 9866084 bytes
->Flash cache emptied: 480 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1280306 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1'143.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 11302012_180241

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Oder?

Ausserdem, wenn ich mit HijackThis einen Scan mache, erhalte ich im Log etwa 7x folgende Datei:

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

Kannst du mir sagen, was dies ist?

Wenn dies nun wirklich weg ist, könntest du mir ein Programm empfehlen, wo ich .cda Dateien in .mp3 umwandeln kann?

Gruss

Servus,


eins nach dem anderen. Wir sind noch nicht ganz fertig.





Schritt 1
Downloade Dir bitte Malwarebytes' Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Downloade Dir bitte SecurityCheck

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.

Poste den Inhalt bitte hier.





Bitte poste mit deiner nächsten Antwort

• die Logdatei von MBAM,
• die Logdatei von ESET,
• die Logdatei von SecurityCheck.

Hehey, hier die Log's

MBAM

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.12.01.07

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Mario :: MARIO-PC [Administrator]

01.12.2012 15:39:44
mbam-log-2012-12-01 (15-39-44).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 256149
Laufzeit: 16 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=5c3d9c80f0b9504e8252eb539c8ad20b
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-12-01 05:06:13
# local_time=2012-12-01 06:06:13 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 108424106 108424106 0 0
# compatibility_mode=1792 16777215 100 0 107819957 107819957 0 0
# compatibility_mode=5892 16776574 100 100 326552 191906939 0 0
# compatibility_mode=8192 67108863 100 0 3883 3883 0 0
# scanned=192361
# found=7
# cleaned=0
# scan_time=7362
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.crx.vir	Win32/bProtector.D application (unable to clean)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll.vir	a variant of Win32/bProtector.A application (unable to clean)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.exe.vir	a variant of Win32/bProtector.A application (unable to clean)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe.vir	a variant of Win32/bProtector.A application (unable to clean)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-16.0.dll.vir	a variant of Win32/bProtector.B application (unable to clean)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-17.0.dll.vir	a variant of Win32/bProtector.B application (unable to clean)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content\mngr.js.vir	Win32/bProtector.C application (unable to clean)	00000000000000000000000000000000	I
         

checkup von securitycheck

 Results of screen317's Security Check version 0.99.56  
 Windows Vista Service Pack 1 x86 (UAC is enabled)  
 Out of date service pack!! 
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus out of date!  
`````````Anti-malware/Other Utilities Check:````````` 
 Out of date HijackThis  installed! 
 Malwarebytes Anti-Malware Version 1.65.1.1000  
 HijackThis 2.0.2    
 Toolbar Cleaner 1.1   
 Java(TM) 6 Update 17  
 Java version out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Flash Player 	11.2.202.233  
 Adobe Reader 8 Adobe Reader out of Date! 
 Mozilla Firefox 16.0.2 Firefox out of Date!  
 Google Chrome 21.0.1180.83  
 Google Chrome 21.0.1180.89  
 Google Chrome 22.0.1229.79  
 Google Chrome 22.0.1229.94  
 Google Chrome 23.0.1271.64  
 Google Chrome 23.0.1271.95  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 system32 FirewallControlPanel.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

Servus,



die Funde von Eset können keinen Schaden mehr anrichten. Diese werden mit den nächsten Schritten automatisch entfernt.




Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.



Downloade und installiere als Erstes:
Vista Service Pack 2
Nach der Installation werden dir weitere Sicherheitsudpates angeboten, die du installieren musst!




Schritt 1
Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 9 ) herunter laden.
• Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Software / Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
• Klicke erneut OK.

Schritt 2
Deine Version von Adobe Flash Player ist veraltet.
Bitte folge diesen Schritte, um Adobe Flash zu aktualisieren:

• Bitte besuche diese Seite von Adobe.
• Wähle dein Betriebssystem und deinen Internetbrowser ("Internet Explorer" oder "other" für Firefox zum Beispiel)
• Deaktiviere gegebenenfalls den Haken vor Google Chrome bzw. McAfee Security Scan.
• Installiere die neuste Version auf deinem Computer.

Schritt 3
Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome.





Schritt 4

• Klicke auf > Hilfe > Über Firefox
• Warte bis das Update geladen ist, klicke auf Update installieren und lasse Firefox neu starten.
• Prüfe bitte, ob weitere Updates vorliegen oder ob Firefox aktuell ist.
• Klicke nun auf > Add-ons > > Auf Updates überprüfen
• Nach einem weiteren Neustart von Firefox sollte alles aktuell sein.

Prüfe bitte auch (regelmässig) ob folgende Links fehlende Updates bei deinen Plugins zeigen:

• PluginCheck-Schnelltest
• Mozilla Plugin-Check

Schritt 5
Starte DeFogger und klicke auf Re-enable.
Gegebenenfalls muss dein Rechner neu gestartet werden.





Schritt 6
Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.

Combofix /Uninstall
         

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.





Schritt 7
Downloade dir bitte delfix auf deinen Desktop.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Klicke auf Löschen.
• Schließe die sich öffnende Textdatei.
• Klicke abschließend auf Deinstallation.
• Bestätige mit Ja.

Schritt 8
Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles, nur weil es Dich dazu auffordert und schön bunt ist.
• Verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.



Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Hey Matthias

Besten Dank für deine Anweisungen. Sollte nun alles aktuell sein

Für mich hat sich das Problem erledigt. Nochmals 1000 Dank!

Darf ich dich aber noch fragen, ob du ein Tool kennst, wo man .cda Dateien in .mp3 umwandeln kann?

Danke!

Beste Grüsse
Mario

Servus,

Zitat von Mario123

Darf ich dich aber noch fragen, ob du ein Tool kennst, wo man .cda Dateien in .mp3 umwandeln kann?

evtl. hilft dir das hier weiter:
http://www.netzwelt.de/forum/audio-software/40738-mp3-umwandeln-cda-files.html

Ansonsten kann ich dir leider nicht weiterhelfen.






Ich bin froh, dass wir helfen konnten

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.