Hallo,

seit kurzem bei mir öffnet sich bei mir Claro Search automatisch wenn
ich Mozilla Firefox 17 öffne.
Bekomme dies nicht raus.
Wer kann mir hier weiterhelfen.

-Windows XP

Danke
bone52

hi
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

OTL Logfile:

OTL Extras logfile created on: 03.12.2012 18:16:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\L.Kern´s  Ordner\Alle Klinik- Krankheiten- Mobbing- TKK und sonstige Ordner\Diabetes- Glucofacts-  Marcumar\GLUCOFACTS Deluxe\ANLEITUNGEN- iNFO´S
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
639,53 Mb Total Physical Memory | 225,80 Mb Available Physical Memory | 35,31% Memory free
1,59 Gb Paging File | 0,93 Gb Available in Paging File | 58,39% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Programme
Drive C: | 37,27 Gb Total Space | 33,90 Gb Free Space | 90,96% Space Free | Partition Type: NTFS
Drive D: | 24,67 Gb Total Space | 24,31 Gb Free Space | 98,56% Space Free | Partition Type: NTFS
Drive F: | 127,99 Gb Total Space | 100,58 Gb Free Space | 78,59% Space Free | Partition Type: NTFS
 
Computer Name: KERN-92DE1320F2 | User Name: Leopold Kern | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_USERS\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
http [open] -- "F:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "F:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour Port 5353
"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"F:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = F:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"F:\Programme\Opera\opera.exe" = F:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser
"F:\Programme\Skype\Plugin Manager\skypePM.exe" = F:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe" = F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company)
"F:\Programme\Kodak\AiO\Center\Kodak.Statistics.exe" = F:\Programme\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company)
"F:\Programme\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = F:\Programme\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company)
"F:\Programme\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = F:\Programme\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company)
"F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kodak\Installer\Setup.exe" = F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company)
"F:\Programme\Skype\Phone\Skype.exe" = F:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{09234F0D-5971-4701-94EE-89CB6926E273}" = Serif PhotoPlus SE
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E13CAA3-B5FC-48C0-AA4A-26F5CD0C371C}" = Garmin Lifetime Updater
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = Browser Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71504FB8-F84D-4B63-A97F-D6D5F0F0F410}" = Deutsche Post E-Porto
"{7236672F-6430-439E-9B27-27EDEAF1D676}" = Diagnostics Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D210D79-AEC5-453B-960C-4DD2C73931E1}" = Bonjour-Druckdienste
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5037E15-5231-41F1-92BE-D2E156157884}" = GLUCOFACTS(TM) Deluxe Smart Launch
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DAC580DB-6629-43B9-98DD-8BABA515B958}" = WISO Mein Geld 2013 Professional
"{DDABC667-56B3-4122-82B0-2F5782EA2F9A}" = SpyHunter
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{EF95137B-5D22-4DA5-ADB8-12038DD355B3}" = GLUCOFACTS® Deluxe
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = GMX Softwareaktualisierung
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG Secure Search" = AVG Security Toolbar
"Avira AntiVir Desktop" = Avira Antivirus Premium
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"Dr. Hardware 2010_is1" = Dr. Hardware 2010 10.0d
"EASEUS Todo Backup 1.0_is1" = EASEUS Todo Backup 1.0
"ElsterFormular 13.2.0.8623p" = ElsterFormular
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GMX ProfiFax" = GMX ProfiFax
"ie8" = Windows Internet Explorer 8
"JDiskReport 1.3.2" = JGoodies JDiskReport 1.3.2
"jv16 PowerTools 2011" = jv16 PowerTools 2011
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 17.0 (x86 de)" = Mozilla Firefox 17.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"myBabylon_English Toolbar" = myBabylon English Toolbar
"Picasa 3" = Picasa 3
"PrintProjects" = PrintProjects
"Samsung CLP-510 Series" = Samsung CLP-510 Series
"Sound Blaster PCI128" = Sound Blaster PCI128
"Totalcmd" = Total Commander (Remove or Repair)
"VLC media player" = VLC media player 1.0.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WISO Mein Geld 2013 Professional" = WISO Mein Geld 2013 Professional
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"YTdetect" = Yahoo! Detect
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Glucofacts Deluxe Version Check 2.1" = Glucofacts Deluxe Version Check 2.1
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.11.2012 09:41:08 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 16.0.2.4680, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 21.11.2012 12:37:26 | Computer Name = KERN-92DE1320F2 | Source = MsiInstaller | ID = 11316
Description = Product: C4USelfUpdater -- Error 1316.A network error occurred while
 attempting to read from the file F:\WINDOWS\Installer\C4USelfUpdater_7_1.msi
 
Error - 21.11.2012 12:54:15 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 16.0.2.4680, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 09:55:06 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung MG.exe, Version 15.0.0.1, Stillstandmodul 
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 10:33:04 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung TOTALCMD.EXE, Version 7.5.0.1, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 10:55:01 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 17.0.0.4706, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 10:55:01 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 17.0.0.4706, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 25.11.2012 08:23:51 | Computer Name = KERN-92DE1320F2 | Source = MsiInstaller | ID = 11316
Description = Product: C4USelfUpdater -- Error 1316.A network error occurred while
 attempting to read from the file F:\WINDOWS\Installer\C4USelfUpdater_7_1.msi
 
Error - 26.11.2012 16:50:03 | Computer Name = KERN-92DE1320F2 | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
 auf!  Fehlercode: 0x35
 
Error - 28.11.2012 07:07:32 | Computer Name = KERN-92DE1320F2 | Source = MsiInstaller | ID = 11316
Description = Product: C4USelfUpdater -- Error 1316.A network error occurred while
 attempting to read from the file F:\WINDOWS\Installer\C4USelfUpdater_7_1.msi
 
[ OSession Events ]
Error - 03.05.2012 14:38:06 | Computer Name = KERN-92DE1320F2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 11865
 seconds with 1560 seconds of active time.  This session ended with a crash.
 
Error - 18.05.2012 08:34:50 | Computer Name = KERN-92DE1320F2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 10.09.2012 13:46:08 | Computer Name = KERN-92DE1320F2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 78
 seconds with 60 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 03.12.2012 06:08:35 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7002
Description = Der Dienst "A4SII300" ist von der Gruppe " 3Parallel arbitrat" abhängig.
 Kein Mitglied dieser Gruppe wurde jedoch gestartet.
 
Error - 03.12.2012 06:11:09 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 03.12.2012 06:11:10 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1053
 
Error - 03.12.2012 10:42:58 | Computer Name = KERN-92DE1320F2 | Source = ACPI | ID = 327685
Description = AMLI: ACPI-BIOS versucht, in eine ungültige E/A-Portadresse (0xcf8)
 zu schreiben, die sich in "0xcf8 - 0xcff", einem  geschützten Adressbereich befindet.
 Dies kann zu Systeminstabilität führen. Wenden Sie sich an den Systemhersteller,
um
 technische Unterstützung zu erhalten.
 
Error - 03.12.2012 10:42:58 | Computer Name = KERN-92DE1320F2 | Source = ACPI | ID = 327684
Description = AMLI: ACPI-BIOS versucht, von einer ungültigen E/A-Portadresse (0xcfc)
 zu lesen, die sich in "0xcf8 - 0xcff", einem  geschützten Adressbereich, befindet.
 Dies kann zu Systeminstabilität führen. Wenden Sie sich and den Systemhersteller,
um
 technische Unterstützung zu erhalten.
 
Error - 03.12.2012 10:43:27 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "A4S2" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 03.12.2012 10:43:27 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7002
Description = Der Dienst "A4SII300" ist von der Gruppe " 3Parallel arbitrat" abhängig.
 Kein Mitglied dieser Gruppe wurde jedoch gestartet.
 
Error - 03.12.2012 10:48:12 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.
 
Error - 03.12.2012 10:48:12 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 03.12.2012 10:50:29 | Computer Name = KERN-92DE1320F2 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\D gefunden.
 
 
< End of report >
         

--- --- ---
OTL Logfile:

OTL logfile created on: 03.12.2012 18:16:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\L.Kern´s  Ordner\Alle Klinik- Krankheiten- Mobbing- TKK und sonstige Ordner\Diabetes- Glucofacts-  Marcumar\GLUCOFACTS Deluxe\ANLEITUNGEN- iNFO´S
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
639,53 Mb Total Physical Memory | 225,80 Mb Available Physical Memory | 35,31% Memory free
1,59 Gb Paging File | 0,93 Gb Available in Paging File | 58,39% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Programme
Drive C: | 37,27 Gb Total Space | 33,90 Gb Free Space | 90,96% Space Free | Partition Type: NTFS
Drive D: | 24,67 Gb Total Space | 24,31 Gb Free Space | 98,56% Space Free | Partition Type: NTFS
Drive F: | 127,99 Gb Total Space | 100,58 Gb Free Space | 78,59% Space Free | Partition Type: NTFS
 
Computer Name: KERN-92DE1320F2 | User Name: Leopold Kern | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.12.03 18:12:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\L.Kern´s  Ordner\Alle Klinik- Krankheiten- Mobbing- TKK und sonstige Ordner\Diabetes- Glucofacts-  Marcumar\GLUCOFACTS Deluxe\ANLEITUNGEN- iNFO´S\OTL.exe
PRC - [2012.11.26 12:26:21 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.11.26 12:26:13 | 000,565,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2012.11.26 12:26:11 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.11.26 12:26:11 | 000,379,168 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.11.26 12:26:11 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.11.20 07:16:04 | 000,916,960 | ---- | M] (Mozilla Corporation) -- F:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.11.08 19:28:02 | 000,997,320 | ---- | M] () -- F:\Programme\AVG Secure Search\vprot.exe
PRC - [2012.11.08 19:28:00 | 000,711,112 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
PRC - [2012.11.08 11:26:19 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.10.11 12:17:59 | 002,312,216 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
PRC - [2012.10.08 19:21:22 | 000,766,400 | ---- | M] (Enigma Software Group USA, LLC.) -- F:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe
PRC - [2012.09.29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- F:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- F:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- F:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.07.14 17:45:12 | 000,134,584 | ---- | M] (Bayer Healthcare LLC) -- F:\Programme\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
PRC - [2011.12.19 16:32:26 | 000,394,672 | ---- | M] (Eastman Kodak Company) -- F:\Programme\Kodak\AiO\Center\EKAiOHostService.exe
PRC - [2010.09.02 15:23:28 | 001,638,400 | ---- | M] (Eastman Kodak Company) -- F:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.11.20 07:16:18 | 002,400,224 | ---- | M] () -- F:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.11.18 12:02:36 | 000,169,984 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Automation\e9586a65ad6367804227335f19f8129e\Inkjet.Automation.ni.dll
MOD - [2012.11.18 12:02:18 | 000,098,304 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.DeviceSettin#\811b30adb7d717d097f578376a529bd3\Inkjet.DeviceSettings.ni.dll
MOD - [2012.11.18 12:01:27 | 000,771,584 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d7ec47c4afad694faa491abd6b45928a\System.Runtime.Remoting.ni.dll
MOD - [2012.11.18 12:00:53 | 000,105,472 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Diagnostics\7cbb1790cd14569c8b83bcc18f701db8\Inkjet.Diagnostics.ni.dll
MOD - [2012.11.18 12:00:52 | 000,237,056 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Localization\5bfe6be47ba9428e7a998b8754f4b7c8\Inkjet.Localization.ni.dll
MOD - [2012.11.18 12:00:30 | 000,283,648 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Utilities\a0a8ecc06169e53623e46a4df02b561f\Inkjet.Utilities.ni.dll
MOD - [2012.11.18 12:00:21 | 000,824,320 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Hardware\9946fbc6e54625c962f6f63a6a2f8bb8\Inkjet.Hardware.ni.dll
MOD - [2012.11.18 12:00:18 | 000,080,896 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Configuration\344311144d2a60d63b4ec8f072c1d8a4\Inkjet.Configuration.ni.dll
MOD - [2012.11.18 12:00:17 | 000,180,736 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Statistics\4d4b611aee5cfdb0b89d1f5ff6b30b84\Inkjet.Statistics.ni.dll
MOD - [2012.11.18 12:00:01 | 000,971,264 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\41cac4885974d07de06f0b4fec9883f0\System.Configuration.ni.dll
MOD - [2012.11.16 22:13:09 | 005,450,752 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\d35b50eb6bb7b1bfb6592419d9feba47\System.Xml.ni.dll
MOD - [2012.11.16 22:12:49 | 012,433,920 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6585a5fcaaa1b49b9a1bd9ca5c5c306e\System.Windows.Forms.ni.dll
MOD - [2012.11.16 21:56:42 | 001,592,320 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\da4bcb702feb770ce40cf1371b0c4d02\System.Drawing.ni.dll
MOD - [2012.11.16 21:40:57 | 007,977,472 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\90ad0c96693527ae685ff40019bb33b0\System.ni.dll
MOD - [2012.11.16 21:40:06 | 011,492,352 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3add69b075f3da012fb97ce00cd795c0\mscorlib.ni.dll
MOD - [2012.11.08 19:28:06 | 000,134,600 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\13.2.0\SiteSafety.dll
MOD - [2012.11.08 19:28:05 | 000,566,728 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\DNTInstaller\13.2.0\avgdttbx.dll
MOD - [2012.11.08 19:28:02 | 000,997,320 | ---- | M] () -- F:\Programme\AVG Secure Search\vprot.exe
MOD - [2012.11.08 19:28:00 | 000,711,112 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
MOD - [2012.11.08 11:27:38 | 000,397,088 | ---- | M] () -- F:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.10.11 12:17:59 | 002,312,216 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
MOD - [2012.10.11 12:17:06 | 002,069,528 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll
MOD - [2012.07.27 21:51:38 | 000,301,056 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (NMIndexingService)
SRV - [2012.11.26 12:26:21 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.11.26 12:26:13 | 000,565,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2012.11.26 12:26:11 | 000,379,168 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.11.26 12:26:11 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.11.20 07:16:13 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- F:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.08 19:28:00 | 000,711,112 | ---- | M] () [Auto | Running] -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe -- (vToolbarUpdater13.2.0)
SRV - [2012.10.14 18:57:29 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- F:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.11 12:17:59 | 002,312,216 | ---- | M] () [Auto | Running] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -- (Browser Manager)
SRV - [2012.10.08 19:21:22 | 000,766,400 | ---- | M] (Enigma Software Group USA, LLC.) [Auto | Running] -- F:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- F:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- F:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.07.14 17:45:12 | 000,134,584 | ---- | M] (Bayer Healthcare LLC) [Auto | Running] -- F:\Programme\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe -- (BayerHealthcareService)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- F:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.12.19 16:32:26 | 000,394,672 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- F:\Programme\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- F:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.11.29 10:42:56 | 000,058,944 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- F:\Programme\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- F:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (cpuz132)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Auto | Stopped] -- F:\WINDOWS\System32\drivers\A4SII300.SYS -- (A4SII300)
DRV - File not found [Kernel | Auto | Stopped] -- F:\WINDOWS\System32\drivers\a4s2.sys -- (A4S2)
DRV - [2012.11.14 18:04:12 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.11.14 18:04:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.11.14 18:04:11 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- F:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.11.08 19:28:06 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2012.11.08 11:28:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.06.22 12:01:30 | 000,019,984 | ---- | M] () [File_System | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\EsgScanner.sys -- (EsgScanner)
DRV - [2011.05.06 16:57:08 | 000,013,904 | ---- | M] () [Kernel | On_Demand | Running] -- F:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2009.07.28 21:31:52 | 000,020,616 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | Boot | Running] -- F:\WINDOWS\system32\drivers\eufs.sys -- (EUFS)
DRV - [2009.07.28 21:31:50 | 000,014,216 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\eudskacs.sys -- (EUDSKACS)
DRV - [2009.07.28 21:31:48 | 000,026,120 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | Boot | Running] -- F:\WINDOWS\system32\drivers\eubakup.sys -- (EUBAKUP)
DRV - [2009.07.28 21:31:46 | 000,122,504 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\EuDisk.sys -- (EuDisk)
DRV - [2009.06.17 17:56:24 | 000,079,248 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2009.06.17 17:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009.06.17 17:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009.06.17 17:55:26 | 000,063,248 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2009.06.17 17:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2006.07.31 12:58:00 | 000,083,456 | ---- | M] (D-Link Corp.                                                ) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\DLKRTXP.SYS -- (RTL8023xp)
DRV - [2006.07.18 02:40:00 | 000,008,399 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\LANPkt.sys -- (LANPkt)
DRV - [2006.07.11 15:13:00 | 000,011,003 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\diag69xp.sys -- (Diag69xp)
DRV - [2006.06.01 19:21:00 | 000,016,384 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\RTLVLAN.SYS -- (RTLVLAN)
DRV - [2005.12.01 10:49:22 | 000,023,600 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- F:\WINDOWS\System32\drivers\drhard.sys -- (drhard)
DRV - [2004.05.17 14:04:16 | 000,041,984 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2001.08.17 12:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371)
DRV - [2000.04.04 02:00:00 | 000,050,367 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\sbpci.sys -- (sbpci)
DRV - [1999.12.17 01:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- F:\WINDOWS\system32\PfModNT.sys -- (PfModNT)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\.DEFAULT\..\SearchScopes\{13403B61-F7F9-42EE-8B94-7025F65C5728}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=cc043ab5-4f52-45df-ae17-e540923af303&apn_sauid=D7B07396-ABB3-431D-859F-855C21ECD5B7
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-18\..\SearchScopes\{13403B61-F7F9-42EE-8B94-7025F65C5728}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=cc043ab5-4f52-45df-ae17-e540923af303&apn_sauid=D7B07396-ABB3-431D-859F-855C21ECD5B7
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = Claro Search
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.claro-search.com/?q={searchTerms}&affID=117423&tt=4612_1&babsrc=SP_ss&mntrId=045321ee00000000000000195b5d3b5a
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=cc043ab5-4f52-45df-ae17-e540923af303&apn_sauid=D7B07396-ABB3-431D-859F-855C21ECD5B7
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{6BCA6F70-47C9-478F-99B5-D203BCF15671}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{6EAA42E9-BA7B-4630-863A-0D36DE63F6CA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={D96BA4F5-6AEF-4B9D-9405-949C11704544}&mid=81162670a6f347d08884d1501db9d2a9-b602d594afd2b0b327e07a06f36ca6a7e42546d0&lang=de&ds=od011&pr=sa&d=2012-03-18 12:49:38&v=9.0.0.23&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE"
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:1.1.2
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:3.3.3
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: dlScheduler@ext.net:1.5
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.97
FF - prefs.js..extensions.enabledItems: sparbar@geizkragen.de:1.1.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.1
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {6614d11d-d21d-b211-ae23-815234e1ebb5}:1.0.21
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:2.23b1
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.4.3
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:2.5.6.0
FF - prefs.js..network.proxy.type: 4
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: F:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: F:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: F:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: F:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: f:\Programme\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: F:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: F:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: F:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search\FireFoxExt\13.2.0.5 [2012.11.08 19:30:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: F:\Programme\Mozilla Firefox\components [2012.11.21 18:53:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins [2012.10.28 12:40:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension [2012.11.16 12:45:51 | 000,000,000 | ---D | M]
 
[2010.03.02 18:52:55 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Extensions
[2010.03.02 18:52:55 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.12.18 18:18:33 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions
[2010.06.18 09:31:52 | 000,000,000 | ---D | M] ("ColorfulTabs") -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010.03.23 22:20:47 | 000,000,000 | ---D | M] (All-in-One Sidebar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010.06.13 10:31:46 | 000,000,000 | ---D | M] (WebMail Notifier) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
[2010.07.04 11:46:51 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.03.23 22:20:47 | 000,000,000 | ---D | M] (Dr.Web anti-virus link checker) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2010.06.29 15:44:18 | 000,000,000 | ---D | M] (NoScript) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.02.28 21:04:59 | 000,000,000 | ---D | M] (ImTranslator) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010.05.21 14:35:40 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.04.26 12:42:58 | 000,000,000 | ---D | M] (myBabylon English Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2010.04.30 10:46:19 | 000,000,000 | ---D | M] (Adblock Plus) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.12 17:57:14 | 000,000,000 | ---D | M] (Download Statusbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2012.01.06 21:18:34 | 000,000,000 | ---D | M] (Toolbar für amazon.de) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\0002.amztoolbar@minimalarts.de
[2010.05.07 19:09:43 | 000,000,000 | ---D | M] (Download Scheduler) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\dlScheduler@ext.net
[2010.04.10 09:22:16 | 000,000,000 | ---D | M] (Fast Dial) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\fastdial@telega.phpnet.us
[2010.02.28 21:04:59 | 000,000,000 | ---D | M] (Geizkragen.de Sparbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\sparbar@geizkragen.de
[2012.12.02 20:37:27 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2012.12.02 20:37:27 | 000,000,000 | ---D | M] (Garmin Communicator) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012.10.07 18:38:47 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.11.27 21:44:40 | 000,000,000 | ---D | M] (ReminderFox) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2012.01.07 03:41:04 | 000,000,000 | ---D | M] (DownloadHelper) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2)
[2012.11.27 21:44:46 | 000,000,000 | ---D | M] (Adblock Plus) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.08.22 20:01:43 | 000,000,000 | ---D | M] (British English Dictionary) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\en-GB@dictionaries.addons.mozilla.org
[2012.06.12 18:59:38 | 000,000,000 | ---D | M] ("Linkury Smartbar") -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\helperbar@helperbar(2).com
[2012.11.21 11:21:57 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\toolbar@web.de
[2011.12.18 18:18:33 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions
[2010.07.02 17:45:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.27 13:30:46 | 000,000,000 | ---D | M] (Google Shortcuts) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{5C46D283-ABDE-4dce-B83C-08881401921C}(2)(2)
[2010.12.27 13:42:21 | 000,000,000 | ---D | M] (NoScript) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)
[2010.12.27 13:30:47 | 000,000,000 | ---D | M] (ImTranslator) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}(2)
[2010.12.27 17:12:22 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.12.27 13:30:47 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}(2)
[2010.12.27 13:37:36 | 000,000,000 | ---D | M] (FireFTP) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010.12.27 17:12:24 | 000,000,000 | ---D | M] (Elf 1.15 Community Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{b9d63c58-90cc-428b-8d3b-cbb88eb07e7e}
[2010.10.16 11:17:19 | 000,000,000 | ---D | M] (DownloadHelper) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.12.27 17:12:23 | 000,000,000 | ---D | M] (Adblock Plus) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.01 14:01:57 | 000,000,000 | ---D | M] (DownThemAll!) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010.11.17 21:13:58 | 000,000,000 | ---D | M] (FoxTab) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2012.01.06 21:18:34 | 000,000,000 | ---D | M] (Toolbar für amazon.de) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\0002.amztoolbar@minimalarts.de
[2010.11.17 21:13:55 | 000,000,000 | ---D | M] (InvisibleHand) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\canitbecheaper@trafficbroker.co.uk
[2010.11.20 13:06:09 | 000,000,000 | ---D | M] (SimilarWeb) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\FirefoxAddon@similarWeb.com
[2010.07.02 10:36:00 | 000,000,000 | ---D | M] (Cooliris) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\piclens@cooliris.com
[2011.01.02 14:27:46 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\toolbar@gmx.net
[2012.11.16 22:37:13 | 000,566,853 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\toolbar@web.de.xpi
[2012.10.27 09:28:43 | 000,060,290 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\translator@zoli.bod.xpi
[2012.08.28 18:54:51 | 000,455,379 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
[2011.08.22 20:01:43 | 000,007,532 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi
[2012.11.23 12:32:34 | 000,804,627 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.31 08:23:28 | 000,434,392 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.11.08 11:48:26 | 000,002,262 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\searchplugins\askcom.xml
[2012.11.21 18:53:30 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions
[2012.10.28 12:40:15 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.10.28 12:40:15 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.10.28 12:40:16 | 000,000,000 | ---D | M] (Java Console) -- F:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.10.28 12:40:15 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com
[2012.10.28 12:40:02 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\distribution(2)\extensions(2)
[2012.10.28 12:40:10 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Programme\Mozilla Firefox\distribution(2)\extensions(2)\toolbar@gmx(2).net
[2012.06.30 17:11:10 | 000,000,000 | ---D | M] (Java Quick Starter) -- F:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
File not found (No name found) -- F:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
File not found (No name found) -- F:\PROGRAMME\PDFFORGE TOOLBAR\FF
File not found (No name found) -- F:\PROGRAMME\PDFFORGE TOOLBAR\SSFF
[2012.02.20 13:22:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.11.20 07:17:00 | 000,262,112 | ---- | M] (Mozilla Foundation) -- F:\Programme\mozilla firefox\components\browsercomps.dll
[2012.11.20 08:13:26 | 000,001,392 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.08 19:28:31 | 000,003,574 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.11.16 12:44:06 | 000,006,520 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.11.20 08:13:26 | 000,002,465 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.11.20 08:13:26 | 000,001,153 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.20 08:13:26 | 000,006,805 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.20 08:13:26 | 000,001,178 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.20 08:13:26 | 000,001,105 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: Google
CHR - plugin: Chrome PDF Viewer (Enabled) = F:\Programme\Google\Chrome\Application\8.0.552.224\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = F:\Programme\Google\Chrome\Application\8.0.552.224\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = F:\Programme\Google\Chrome\Application\8.0.552.224\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = F:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = F:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = F:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = F:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft\u00AE DRM (Enabled) = F:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = F:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = F:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Picasa (Enabled) = F:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = F:\Programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll
CHR - plugin: Shockwave Flash (Enabled) = F:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = f:\Programme\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = f:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2006.02.28 13:00:00 | 000,000,820 | ---- | M]) - F:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - F:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - F:\Programme\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll ()
O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - F:\Programme\myBabylon_English\prxtbmyB2.dll (Conduit Ltd.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - F:\Programme\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - F:\Programme\myBabylon_English\prxtbmyB2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - F:\Programme\myBabylon_English\prxtbmyB2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe ARM] F:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] F:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Conime] F:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] F:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [SpyHunter Security Suite] F:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.)
O4 - HKLM..\Run: [vProt] F:\Programme\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-527237240-842925246-1957994488-1003..\Run: [1und1Dispatcher] F:\Programme\1und1Softwareaktualisierung\SchedDispatcher.exe (1&1 Mail & Media GmbH)
O4 - HKU\S-1-5-21-527237240-842925246-1957994488-1003..\Run: [ccleaner] F:\Programme\CCleaner\CCleaner.exe (Piriform Ltd)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - F:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - F:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - F:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - F:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O15 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..Trusted Domains: deutschepost.de ([internetmarke] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E803E0F-181D-427A-B45F-C60B68EF276F}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - F:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - F:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - F:\Programme\Gemeinsame Dateien\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - F:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (f:\dokume~1\alluse~1\anwend~1\browser manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll) - f:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - F:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (F:\WINDOWS\system32\userinit.exe) - F:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.03.24 20:24:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2012.12.03 12:07:09 | 000,000,000 | ---- | M] () - F:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 60 Days ==========
 
[2012.12.03 15:46:35 | 000,000,000 | RH-D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Recent
[2012.12.03 12:05:54 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Startmenü\Programme\SpyHunter
[2012.12.03 12:05:36 | 000,000,000 | ---D | C] -- F:\sh4ldr
[2012.12.03 12:05:36 | 000,000,000 | ---D | C] -- F:\Programme\Enigma Software Group
[2012.12.03 12:04:21 | 000,000,000 | ---D | C] -- F:\Programme\Gemeinsame Dateien\Wise Installation Wizard
[2012.12.02 15:46:52 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Malwarebytes
[2012.12.02 15:46:19 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.12.02 15:46:17 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.12.02 15:46:14 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- F:\WINDOWS\System32\drivers\mbam.sys
[2012.12.02 15:46:14 | 000,000,000 | ---D | C] -- F:\Programme\Malwarebytes' Anti-Malware
[2012.11.18 17:08:51 | 000,000,000 | R--D | C] -- D:\Eigene Dateien\Eigene Bilder
[2012.11.18 16:39:39 | 000,000,000 | ---D | C] -- F:\Programme\Bayer HealthCare SmartLaunch
[2012.11.18 10:56:40 | 000,000,000 | R--D | C] -- F:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Musik
[2012.11.16 12:46:22 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Startmenü\Programme\Browser Manager
[2012.11.16 12:45:16 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager
[2012.11.16 12:42:13 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PDFCreator
[2012.11.16 12:41:52 | 000,662,288 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSCOMCT2.OCX
[2012.11.16 12:41:52 | 000,137,000 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSMAPI32.OCX
[2012.11.16 12:41:52 | 000,086,528 | ---- | C] (pdfforge GbR) -- F:\WINDOWS\System32\pdfcmon.dll
[2012.11.16 12:41:43 | 000,158,208 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSCMCDE.DLL
[2012.11.16 12:41:43 | 000,125,712 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\VB6DE.DLL
[2012.11.16 12:41:43 | 000,064,512 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSCC2DE.DLL
[2012.11.16 12:41:42 | 000,023,552 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSMPIDE.DLL
[2012.11.16 12:41:38 | 000,000,000 | ---D | C] -- F:\Programme\PDFCreator
[2012.11.09 10:35:52 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\CallingID
[2012.11.08 19:29:18 | 000,026,984 | ---- | C] (AVG Technologies) -- F:\WINDOWS\System32\drivers\avgtpx86.sys
[2012.11.08 11:56:39 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Avira
[2012.11.08 11:52:22 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2012.11.08 11:52:17 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\BabylonToolbar
[2012.11.08 11:52:07 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\myBabylon_English
[2012.11.08 11:48:46 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.11.08 11:48:03 | 000,000,000 | ---D | C] -- F:\Programme\Ask.com
[2012.11.08 11:47:53 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2012.11.08 11:47:23 | 000,028,520 | ---- | C] (Avira GmbH) -- F:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.11.08 11:47:18 | 000,133,824 | ---- | C] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avipbb.sys
[2012.11.08 11:47:18 | 000,083,432 | ---- | C] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avgntflt.sys
[2012.11.08 11:47:18 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avkmgr.sys
[2012.11.08 11:47:10 | 000,000,000 | ---D | C] -- F:\Programme\Avira
[2012.11.07 20:33:48 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\WISO Mein Geld
[2012.11.07 19:51:26 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WISO Mein Geld 2013
[2012.10.28 12:39:59 | 000,000,000 | ---D | C] -- F:\Programme\Mozilla Firefox
[2012.10.27 20:40:21 | 000,000,000 | R--D | C] -- D:\Eigene Dateien\Eigene Musik
[2011.01.08 12:05:44 | 037,719,448 | ---- | C] (Adobe Systems Incorporated) -- F:\Programme\AdbeRdr1000_de_DE.exe
[2010.12.11 18:44:35 | 007,290,568 | ---- | C] (Uniblue Systems Ltd                                                                                                                                                                                                                                                                                         ) -- F:\Programme\registrybooster.exe
[2010.12.11 18:40:59 | 011,237,760 | ---- | C] (Mozilla) -- F:\Programme\Firefox Setup 4.0 Beta 7.exe
[2010.10.23 20:08:39 | 014,259,704 | ---- | C] (Google Inc.) -- F:\Programme\picasa38-setup.exe
[2010.09.04 17:32:53 | 017,010,016 | ---- | C] (Microsoft Corporation) -- F:\Programme\IE8-WindowsXP-x86-DEU.exe
[2010.04.12 17:26:19 | 002,025,768 | ---- | C] (Skype Technologies S.A.) -- F:\Programme\SkypeSetup.exe
[8 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 60 Days ==========
 
[2012.12.03 18:38:01 | 000,000,240 | ---- | M] () -- F:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.12.03 18:38:00 | 000,000,294 | ---- | M] () -- F:\WINDOWS\tasks\Browser Manager.job
[2012.12.03 17:57:00 | 000,000,884 | ---- | M] () -- F:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.12.03 17:51:00 | 000,001,100 | ---- | M] () -- F:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.03 17:51:00 | 000,000,486 | ---- | M] () -- F:\WINDOWS\tasks\PrintProjects Communicator.job
[2012.12.03 17:43:54 | 000,000,432 | -H-- | M] () -- F:\WINDOWS\tasks\User_Feed_Synchronization-{0E24EDD0-64F5-48B7-95C0-549FFC98A668}.job
[2012.12.03 16:27:21 | 000,000,724 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.12.03 15:43:36 | 000,012,700 | ---- | M] () -- F:\WINDOWS\System32\wpa.dbl
[2012.12.03 15:43:31 | 000,001,096 | ---- | M] () -- F:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.03 15:43:28 | 000,000,460 | ---- | M] () -- F:\WINDOWS\tasks\PCCT - MAGIX AG.job
[2012.12.03 15:42:53 | 000,002,048 | --S- | M] () -- F:\WINDOWS\bootstat.dat
[2012.12.03 15:42:51 | 670,666,752 | -HS- | M] () -- F:\hiberfil.sys
[2012.12.03 12:46:57 | 000,001,404 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\Lange Version CD-Progressive-Muskelentspannung-Langversion-128kbps.lnk
[2012.12.03 12:07:09 | 000,000,000 | ---- | M] () -- F:\autoexec.bat
[2012.12.03 12:05:55 | 000,002,003 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\SpyHunter.lnk
[2012.12.02 20:39:19 | 000,000,676 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\CCleaner v3.25.1872 (26 Nov 2012).lnk
[2012.12.02 15:46:20 | 000,000,796 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.21 18:53:45 | 000,000,724 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox 17.0, 21.11.2012.lnk
[2012.11.18 17:25:13 | 000,527,798 | ---- | M] () -- F:\WINDOWS\System32\perfh007.dat
[2012.11.18 17:25:13 | 000,496,492 | ---- | M] () -- F:\WINDOWS\System32\perfh009.dat
[2012.11.18 17:25:13 | 000,125,526 | ---- | M] () -- F:\WINDOWS\System32\perfc007.dat
[2012.11.18 17:25:13 | 000,101,944 | ---- | M] () -- F:\WINDOWS\System32\perfc009.dat
[2012.11.18 13:25:20 | 000,001,940 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\Launch GLUCOFACTS(TM) Deluxe Update Utility.lnk
[2012.11.18 10:55:19 | 000,269,392 | ---- | M] () -- F:\WINDOWS\System32\FNTCACHE.DAT
[2012.11.14 18:04:12 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avipbb.sys
[2012.11.14 18:04:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avkmgr.sys
[2012.11.14 18:04:11 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avgntflt.sys
[2012.11.08 19:28:06 | 000,026,984 | ---- | M] (AVG Technologies) -- F:\WINDOWS\System32\drivers\avgtpx86.sys
[2012.11.08 11:48:46 | 000,001,699 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center 2013.lnk
[2012.11.08 11:28:20 | 000,028,520 | ---- | M] (Avira GmbH) -- F:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.11.07 19:51:27 | 000,000,788 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\WISO Mein Geld 2013 (07.11.2012).lnk
[2012.10.22 20:56:29 | 001,866,496 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\System32\win32k.sys
[2012.10.22 20:56:29 | 001,866,496 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\System32\dllcache\win32k.sys
[2012.10.14 18:57:27 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- F:\WINDOWS\System32\FlashPlayerApp.exe
[2012.10.14 18:57:27 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- F:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.10.12 07:34:54 | 000,086,528 | ---- | M] (pdfforge GbR) -- F:\WINDOWS\System32\pdfcmon.dll
[8 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.12.03 16:27:21 | 000,000,730 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2012.12.03 16:27:21 | 000,000,724 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.12.03 12:07:09 | 000,000,000 | ---- | C] () -- F:\autoexec.bat
[2012.12.03 12:05:55 | 000,002,003 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\SpyHunter.lnk
[2012.12.02 15:46:20 | 000,000,796 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.12.02 13:48:47 | 000,000,294 | ---- | C] () -- F:\WINDOWS\tasks\Browser Manager.job
[2012.11.21 18:53:44 | 000,000,724 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox 17.0, 21.11.2012.lnk
[2012.11.18 13:25:19 | 000,001,940 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\Launch GLUCOFACTS(TM) Deluxe Update Utility.lnk
[2012.11.08 11:48:46 | 000,001,699 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center 2013.lnk
[2012.11.08 11:48:19 | 000,000,240 | ---- | C] () -- F:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.11.07 19:51:27 | 000,000,788 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\WISO Mein Geld 2013 (07.11.2012).lnk
[2012.11.07 18:14:39 | 000,000,676 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\CCleaner v3.25.1872 (26 Nov 2012).lnk
[2012.06.22 12:01:30 | 000,019,984 | ---- | C] () -- F:\WINDOWS\System32\ESGScanner.sys
[2012.06.22 12:01:30 | 000,019,984 | ---- | C] () -- F:\WINDOWS\System32\drivers\EsgScanner.sys
[2012.06.18 16:36:11 | 000,159,672 | ---- | C] () -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.05.11 22:50:04 | 000,272,974 | ---- | C] () -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012.02.16 13:02:48 | 000,003,072 | ---- | C] () -- F:\WINDOWS\System32\iacenc.dll
[2012.02.14 16:18:25 | 000,002,518 | ---- | C] () -- F:\WINDOWS\System32\ASOROSet.bin
[2011.12.23 13:02:27 | 000,000,145 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2011.06.25 11:36:40 | 000,003,776 | ---- | C] () -- F:\WINDOWS\System32\fxsperf.ini
[2011.05.17 09:45:16 | 000,000,265 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2011.03.26 13:11:31 | 000,000,022 | -HS- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Sys2662.Config.Repository.bin
[2011.03.24 21:27:24 | 000,000,552 | ---- | C] () -- F:\WINDOWS\System32\d3d8caps.dat
[2011.02.10 10:17:28 | 000,737,721 | ---- | C] () -- F:\Programme\wot-20100908-fx_sm.zip
[2011.01.09 12:33:14 | 000,001,324 | ---- | C] () -- F:\WINDOWS\System32\d3d9caps.dat
[2010.04.26 12:42:12 | 008,256,440 | ---- | C] () -- F:\Programme\Babylon8_setup.exe
[2010.03.05 20:06:14 | 000,023,552 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2012.11.09 23:09:20 | 000,000,596 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}\defaults\printing\icons\@.png
[2010.02.24 18:54:10 | 000,000,227 | RHS- | M] () -- F:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 07:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = F:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = F:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.11.08 19:30:51 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search
[2012.03.18 12:38:33 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012.11.18 16:39:45 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BayerLogs
[2012.11.16 12:45:16 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager
[2010.02.24 21:04:22 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2012.07.20 18:45:09 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.03.18 12:48:48 | 000,000,000 | -H-D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2011.05.16 19:18:40 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Deutsche Post AG
[2011.01.02 17:46:51 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Mender
[2010.07.01 13:15:17 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Whiz
[2012.06.13 17:17:15 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2012.02.26 13:07:38 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fighters
[2012.05.11 15:45:44 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Garmin
[2010.08.02 18:26:30 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX
[2010.12.27 13:30:38 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010.06.19 11:15:40 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2012.09.05 15:52:13 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PrintProjects
[2012.04.29 13:10:23 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UUdb
[2012.02.15 12:50:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Visan
[2011.01.02 16:07:15 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2011.09.09 11:21:50 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Default User\Anwendungsdaten\Temp
[2011.12.20 13:29:13 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Abelssoft
[2012.01.06 21:18:03 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\AllDup
[2011.12.18 17:50:45 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\ASCOMP Software
[2012.03.18 12:49:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\AVG Secure Search
[2012.03.18 12:38:32 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Babylon
[2012.04.14 20:50:03 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\BabylonToolbar
[2010.02.24 21:04:58 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Buhl Data Service
[2012.11.07 20:29:48 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Buhl Data Service GmbH
[2012.11.20 11:10:05 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\CallingID
[2010.07.10 11:25:43 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\CheckPoint
[2010.04.19 19:21:55 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\COMPUTERBILD-Abzockschutz
[2010.02.24 21:08:30 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\DataDesign
[2012.06.13 17:17:54 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\elsterformular
[2012.02.26 13:07:40 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Fighters
[2012.01.07 04:05:38 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Garmin
[2010.02.22 17:22:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\GHISLER
[2010.08.02 18:28:48 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\GMX
[2010.07.12 09:38:44 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\JGoodies
[2010.08.22 07:38:14 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Leadertech
[2010.02.24 21:04:39 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\LetsTrade
[2010.12.23 20:36:54 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\MAGIX
[2012.07.14 13:12:02 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\OpenCandy
[2011.05.20 12:37:35 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Opera
[2012.11.16 12:42:13 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\pdfforge
[2012.04.14 20:59:34 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Search Settings
[2010.10.13 11:38:45 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Serif
[2012.02.14 16:19:15 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Systweak
[2012.04.16 10:51:16 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\TeamViewer
[2012.02.15 11:32:59 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Temp
[2010.03.02 18:52:34 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Thunderbird
[2010.07.01 12:59:22 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Uniblue
[2012.02.15 12:50:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Visan
[2010.02.22 20:56:54 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\webpdf.jclient
[2012.11.08 11:52:17 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\BabylonToolbar
[2010.12.27 13:37:00 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Fighters
[2011.06.22 10:50:20 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Temp
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---

OTL Logfile:

OTL Extras logfile created on: 03.12.2012 18:16:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\L.Kern´s  Ordner\Alle Klinik- Krankheiten- Mobbing- TKK und sonstige Ordner\Diabetes- Glucofacts-  Marcumar\GLUCOFACTS Deluxe\ANLEITUNGEN- iNFO´S
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
639,53 Mb Total Physical Memory | 225,80 Mb Available Physical Memory | 35,31% Memory free
1,59 Gb Paging File | 0,93 Gb Available in Paging File | 58,39% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Programme
Drive C: | 37,27 Gb Total Space | 33,90 Gb Free Space | 90,96% Space Free | Partition Type: NTFS
Drive D: | 24,67 Gb Total Space | 24,31 Gb Free Space | 98,56% Space Free | Partition Type: NTFS
Drive F: | 127,99 Gb Total Space | 100,58 Gb Free Space | 78,59% Space Free | Partition Type: NTFS
 
Computer Name: KERN-92DE1320F2 | User Name: Leopold Kern | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_USERS\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
http [open] -- "F:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "F:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour Port 5353
"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"F:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = F:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"F:\Programme\Opera\opera.exe" = F:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser
"F:\Programme\Skype\Plugin Manager\skypePM.exe" = F:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe" = F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company)
"F:\Programme\Kodak\AiO\Center\Kodak.Statistics.exe" = F:\Programme\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company)
"F:\Programme\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = F:\Programme\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company)
"F:\Programme\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = F:\Programme\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company)
"F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kodak\Installer\Setup.exe" = F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company)
"F:\Programme\Skype\Phone\Skype.exe" = F:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{09234F0D-5971-4701-94EE-89CB6926E273}" = Serif PhotoPlus SE
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E13CAA3-B5FC-48C0-AA4A-26F5CD0C371C}" = Garmin Lifetime Updater
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = Browser Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71504FB8-F84D-4B63-A97F-D6D5F0F0F410}" = Deutsche Post E-Porto
"{7236672F-6430-439E-9B27-27EDEAF1D676}" = Diagnostics Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D210D79-AEC5-453B-960C-4DD2C73931E1}" = Bonjour-Druckdienste
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5037E15-5231-41F1-92BE-D2E156157884}" = GLUCOFACTS(TM) Deluxe Smart Launch
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DAC580DB-6629-43B9-98DD-8BABA515B958}" = WISO Mein Geld 2013 Professional
"{DDABC667-56B3-4122-82B0-2F5782EA2F9A}" = SpyHunter
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{EF95137B-5D22-4DA5-ADB8-12038DD355B3}" = GLUCOFACTS® Deluxe
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = GMX Softwareaktualisierung
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG Secure Search" = AVG Security Toolbar
"Avira AntiVir Desktop" = Avira Antivirus Premium
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"Dr. Hardware 2010_is1" = Dr. Hardware 2010 10.0d
"EASEUS Todo Backup 1.0_is1" = EASEUS Todo Backup 1.0
"ElsterFormular 13.2.0.8623p" = ElsterFormular
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GMX ProfiFax" = GMX ProfiFax
"ie8" = Windows Internet Explorer 8
"JDiskReport 1.3.2" = JGoodies JDiskReport 1.3.2
"jv16 PowerTools 2011" = jv16 PowerTools 2011
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 17.0 (x86 de)" = Mozilla Firefox 17.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"myBabylon_English Toolbar" = myBabylon English Toolbar
"Picasa 3" = Picasa 3
"PrintProjects" = PrintProjects
"Samsung CLP-510 Series" = Samsung CLP-510 Series
"Sound Blaster PCI128" = Sound Blaster PCI128
"Totalcmd" = Total Commander (Remove or Repair)
"VLC media player" = VLC media player 1.0.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WISO Mein Geld 2013 Professional" = WISO Mein Geld 2013 Professional
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"YTdetect" = Yahoo! Detect
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Glucofacts Deluxe Version Check 2.1" = Glucofacts Deluxe Version Check 2.1
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.11.2012 09:41:08 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 16.0.2.4680, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 21.11.2012 12:37:26 | Computer Name = KERN-92DE1320F2 | Source = MsiInstaller | ID = 11316
Description = Product: C4USelfUpdater -- Error 1316.A network error occurred while
 attempting to read from the file F:\WINDOWS\Installer\C4USelfUpdater_7_1.msi
 
Error - 21.11.2012 12:54:15 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 16.0.2.4680, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 09:55:06 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung MG.exe, Version 15.0.0.1, Stillstandmodul 
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 10:33:04 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung TOTALCMD.EXE, Version 7.5.0.1, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 10:55:01 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 17.0.0.4706, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.11.2012 10:55:01 | Computer Name = KERN-92DE1320F2 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 17.0.0.4706, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 25.11.2012 08:23:51 | Computer Name = KERN-92DE1320F2 | Source = MsiInstaller | ID = 11316
Description = Product: C4USelfUpdater -- Error 1316.A network error occurred while
 attempting to read from the file F:\WINDOWS\Installer\C4USelfUpdater_7_1.msi
 
Error - 26.11.2012 16:50:03 | Computer Name = KERN-92DE1320F2 | Source = Avira Antivirus | ID = 4110
Description = Während der Initialisierung der Suchengine trat ein unbekannter Fehler
 auf!  Fehlercode: 0x35
 
Error - 28.11.2012 07:07:32 | Computer Name = KERN-92DE1320F2 | Source = MsiInstaller | ID = 11316
Description = Product: C4USelfUpdater -- Error 1316.A network error occurred while
 attempting to read from the file F:\WINDOWS\Installer\C4USelfUpdater_7_1.msi
 
[ OSession Events ]
Error - 03.05.2012 14:38:06 | Computer Name = KERN-92DE1320F2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 11865
 seconds with 1560 seconds of active time.  This session ended with a crash.
 
Error - 18.05.2012 08:34:50 | Computer Name = KERN-92DE1320F2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 10.09.2012 13:46:08 | Computer Name = KERN-92DE1320F2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 78
 seconds with 60 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 03.12.2012 06:08:35 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7002
Description = Der Dienst "A4SII300" ist von der Gruppe " 3Parallel arbitrat" abhängig.
 Kein Mitglied dieser Gruppe wurde jedoch gestartet.
 
Error - 03.12.2012 06:11:09 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 03.12.2012 06:11:10 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1053
 
Error - 03.12.2012 10:42:58 | Computer Name = KERN-92DE1320F2 | Source = ACPI | ID = 327685
Description = AMLI: ACPI-BIOS versucht, in eine ungültige E/A-Portadresse (0xcf8)
 zu schreiben, die sich in "0xcf8 - 0xcff", einem  geschützten Adressbereich befindet.
 Dies kann zu Systeminstabilität führen. Wenden Sie sich an den Systemhersteller,
um
 technische Unterstützung zu erhalten.
 
Error - 03.12.2012 10:42:58 | Computer Name = KERN-92DE1320F2 | Source = ACPI | ID = 327684
Description = AMLI: ACPI-BIOS versucht, von einer ungültigen E/A-Portadresse (0xcfc)
 zu lesen, die sich in "0xcf8 - 0xcff", einem  geschützten Adressbereich, befindet.
 Dies kann zu Systeminstabilität führen. Wenden Sie sich and den Systemhersteller,
um
 technische Unterstützung zu erhalten.
 
Error - 03.12.2012 10:43:27 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "A4S2" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 03.12.2012 10:43:27 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7002
Description = Der Dienst "A4SII300" ist von der Gruppe " 3Parallel arbitrat" abhängig.
 Kein Mitglied dieser Gruppe wurde jedoch gestartet.
 
Error - 03.12.2012 10:48:12 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.
 
Error - 03.12.2012 10:48:12 | Computer Name = KERN-92DE1320F2 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 03.12.2012 10:50:29 | Computer Name = KERN-92DE1320F2 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\D gefunden.
 
 
< End of report >
         

--- --- ---
OTL Logfile:

OTL logfile created on: 03.12.2012 18:16:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\L.Kern´s  Ordner\Alle Klinik- Krankheiten- Mobbing- TKK und sonstige Ordner\Diabetes- Glucofacts-  Marcumar\GLUCOFACTS Deluxe\ANLEITUNGEN- iNFO´S
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
639,53 Mb Total Physical Memory | 225,80 Mb Available Physical Memory | 35,31% Memory free
1,59 Gb Paging File | 0,93 Gb Available in Paging File | 58,39% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Programme
Drive C: | 37,27 Gb Total Space | 33,90 Gb Free Space | 90,96% Space Free | Partition Type: NTFS
Drive D: | 24,67 Gb Total Space | 24,31 Gb Free Space | 98,56% Space Free | Partition Type: NTFS
Drive F: | 127,99 Gb Total Space | 100,58 Gb Free Space | 78,59% Space Free | Partition Type: NTFS
 
Computer Name: KERN-92DE1320F2 | User Name: Leopold Kern | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.12.03 18:12:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\L.Kern´s  Ordner\Alle Klinik- Krankheiten- Mobbing- TKK und sonstige Ordner\Diabetes- Glucofacts-  Marcumar\GLUCOFACTS Deluxe\ANLEITUNGEN- iNFO´S\OTL.exe
PRC - [2012.11.26 12:26:21 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.11.26 12:26:13 | 000,565,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2012.11.26 12:26:11 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.11.26 12:26:11 | 000,379,168 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.11.26 12:26:11 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.11.20 07:16:04 | 000,916,960 | ---- | M] (Mozilla Corporation) -- F:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.11.08 19:28:02 | 000,997,320 | ---- | M] () -- F:\Programme\AVG Secure Search\vprot.exe
PRC - [2012.11.08 19:28:00 | 000,711,112 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
PRC - [2012.11.08 11:26:19 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.10.11 12:17:59 | 002,312,216 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
PRC - [2012.10.08 19:21:22 | 000,766,400 | ---- | M] (Enigma Software Group USA, LLC.) -- F:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe
PRC - [2012.09.29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- F:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- F:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- F:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.07.14 17:45:12 | 000,134,584 | ---- | M] (Bayer Healthcare LLC) -- F:\Programme\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
PRC - [2011.12.19 16:32:26 | 000,394,672 | ---- | M] (Eastman Kodak Company) -- F:\Programme\Kodak\AiO\Center\EKAiOHostService.exe
PRC - [2010.09.02 15:23:28 | 001,638,400 | ---- | M] (Eastman Kodak Company) -- F:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.11.20 07:16:18 | 002,400,224 | ---- | M] () -- F:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.11.18 12:02:36 | 000,169,984 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Automation\e9586a65ad6367804227335f19f8129e\Inkjet.Automation.ni.dll
MOD - [2012.11.18 12:02:18 | 000,098,304 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.DeviceSettin#\811b30adb7d717d097f578376a529bd3\Inkjet.DeviceSettings.ni.dll
MOD - [2012.11.18 12:01:27 | 000,771,584 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d7ec47c4afad694faa491abd6b45928a\System.Runtime.Remoting.ni.dll
MOD - [2012.11.18 12:00:53 | 000,105,472 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Diagnostics\7cbb1790cd14569c8b83bcc18f701db8\Inkjet.Diagnostics.ni.dll
MOD - [2012.11.18 12:00:52 | 000,237,056 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Localization\5bfe6be47ba9428e7a998b8754f4b7c8\Inkjet.Localization.ni.dll
MOD - [2012.11.18 12:00:30 | 000,283,648 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Utilities\a0a8ecc06169e53623e46a4df02b561f\Inkjet.Utilities.ni.dll
MOD - [2012.11.18 12:00:21 | 000,824,320 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Hardware\9946fbc6e54625c962f6f63a6a2f8bb8\Inkjet.Hardware.ni.dll
MOD - [2012.11.18 12:00:18 | 000,080,896 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Configuration\344311144d2a60d63b4ec8f072c1d8a4\Inkjet.Configuration.ni.dll
MOD - [2012.11.18 12:00:17 | 000,180,736 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Inkjet.Statistics\4d4b611aee5cfdb0b89d1f5ff6b30b84\Inkjet.Statistics.ni.dll
MOD - [2012.11.18 12:00:01 | 000,971,264 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\41cac4885974d07de06f0b4fec9883f0\System.Configuration.ni.dll
MOD - [2012.11.16 22:13:09 | 005,450,752 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\d35b50eb6bb7b1bfb6592419d9feba47\System.Xml.ni.dll
MOD - [2012.11.16 22:12:49 | 012,433,920 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6585a5fcaaa1b49b9a1bd9ca5c5c306e\System.Windows.Forms.ni.dll
MOD - [2012.11.16 21:56:42 | 001,592,320 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\da4bcb702feb770ce40cf1371b0c4d02\System.Drawing.ni.dll
MOD - [2012.11.16 21:40:57 | 007,977,472 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\90ad0c96693527ae685ff40019bb33b0\System.ni.dll
MOD - [2012.11.16 21:40:06 | 011,492,352 | ---- | M] () -- F:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3add69b075f3da012fb97ce00cd795c0\mscorlib.ni.dll
MOD - [2012.11.08 19:28:06 | 000,134,600 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\13.2.0\SiteSafety.dll
MOD - [2012.11.08 19:28:05 | 000,566,728 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\DNTInstaller\13.2.0\avgdttbx.dll
MOD - [2012.11.08 19:28:02 | 000,997,320 | ---- | M] () -- F:\Programme\AVG Secure Search\vprot.exe
MOD - [2012.11.08 19:28:00 | 000,711,112 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
MOD - [2012.11.08 11:27:38 | 000,397,088 | ---- | M] () -- F:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.10.11 12:17:59 | 002,312,216 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
MOD - [2012.10.11 12:17:06 | 002,069,528 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll
MOD - [2012.07.27 21:51:38 | 000,301,056 | ---- | M] () -- F:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (NMIndexingService)
SRV - [2012.11.26 12:26:21 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.11.26 12:26:13 | 000,565,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2012.11.26 12:26:11 | 000,379,168 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.11.26 12:26:11 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- F:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.11.20 07:16:13 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- F:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.08 19:28:00 | 000,711,112 | ---- | M] () [Auto | Running] -- F:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe -- (vToolbarUpdater13.2.0)
SRV - [2012.10.14 18:57:29 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- F:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.11 12:17:59 | 002,312,216 | ---- | M] () [Auto | Running] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -- (Browser Manager)
SRV - [2012.10.08 19:21:22 | 000,766,400 | ---- | M] (Enigma Software Group USA, LLC.) [Auto | Running] -- F:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- F:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- F:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.07.14 17:45:12 | 000,134,584 | ---- | M] (Bayer Healthcare LLC) [Auto | Running] -- F:\Programme\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe -- (BayerHealthcareService)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- F:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.12.19 16:32:26 | 000,394,672 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- F:\Programme\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- F:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.11.29 10:42:56 | 000,058,944 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- F:\Programme\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- F:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (cpuz132)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Auto | Stopped] -- F:\WINDOWS\System32\drivers\A4SII300.SYS -- (A4SII300)
DRV - File not found [Kernel | Auto | Stopped] -- F:\WINDOWS\System32\drivers\a4s2.sys -- (A4S2)
DRV - [2012.11.14 18:04:12 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.11.14 18:04:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.11.14 18:04:11 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- F:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.11.08 19:28:06 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2012.11.08 11:28:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.06.22 12:01:30 | 000,019,984 | ---- | M] () [File_System | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\EsgScanner.sys -- (EsgScanner)
DRV - [2011.05.06 16:57:08 | 000,013,904 | ---- | M] () [Kernel | On_Demand | Running] -- F:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2009.07.28 21:31:52 | 000,020,616 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | Boot | Running] -- F:\WINDOWS\system32\drivers\eufs.sys -- (EUFS)
DRV - [2009.07.28 21:31:50 | 000,014,216 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\eudskacs.sys -- (EUDSKACS)
DRV - [2009.07.28 21:31:48 | 000,026,120 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | Boot | Running] -- F:\WINDOWS\system32\drivers\eubakup.sys -- (EUBAKUP)
DRV - [2009.07.28 21:31:46 | 000,122,504 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\EuDisk.sys -- (EuDisk)
DRV - [2009.06.17 17:56:24 | 000,079,248 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2009.06.17 17:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009.06.17 17:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009.06.17 17:55:26 | 000,063,248 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2009.06.17 17:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2006.07.31 12:58:00 | 000,083,456 | ---- | M] (D-Link Corp.                                                ) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\DLKRTXP.SYS -- (RTL8023xp)
DRV - [2006.07.18 02:40:00 | 000,008,399 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\LANPkt.sys -- (LANPkt)
DRV - [2006.07.11 15:13:00 | 000,011,003 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\diag69xp.sys -- (Diag69xp)
DRV - [2006.06.01 19:21:00 | 000,016,384 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\RTLVLAN.SYS -- (RTLVLAN)
DRV - [2005.12.01 10:49:22 | 000,023,600 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- F:\WINDOWS\System32\drivers\drhard.sys -- (drhard)
DRV - [2004.05.17 14:04:16 | 000,041,984 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2001.08.17 12:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371)
DRV - [2000.04.04 02:00:00 | 000,050,367 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\sbpci.sys -- (sbpci)
DRV - [1999.12.17 01:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- F:\WINDOWS\system32\PfModNT.sys -- (PfModNT)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\.DEFAULT\..\SearchScopes\{13403B61-F7F9-42EE-8B94-7025F65C5728}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=cc043ab5-4f52-45df-ae17-e540923af303&apn_sauid=D7B07396-ABB3-431D-859F-855C21ECD5B7
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-18\..\SearchScopes\{13403B61-F7F9-42EE-8B94-7025F65C5728}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=cc043ab5-4f52-45df-ae17-e540923af303&apn_sauid=D7B07396-ABB3-431D-859F-855C21ECD5B7
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = Claro Search
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=a94d6cde-6fd7-404f-84f4-3f0cef094093&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.claro-search.com/?q={searchTerms}&affID=117423&tt=4612_1&babsrc=SP_ss&mntrId=045321ee00000000000000195b5d3b5a
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=cc043ab5-4f52-45df-ae17-e540923af303&apn_sauid=D7B07396-ABB3-431D-859F-855C21ECD5B7
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{6BCA6F70-47C9-478F-99B5-D203BCF15671}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{6EAA42E9-BA7B-4630-863A-0D36DE63F6CA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={D96BA4F5-6AEF-4B9D-9405-949C11704544}&mid=81162670a6f347d08884d1501db9d2a9-b602d594afd2b0b327e07a06f36ca6a7e42546d0&lang=de&ds=od011&pr=sa&d=2012-03-18 12:49:38&v=9.0.0.23&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-527237240-842925246-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE"
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:1.1.2
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:3.3.3
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.8
FF - prefs.js..extensions.enabledItems: dlScheduler@ext.net:1.5
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.97
FF - prefs.js..extensions.enabledItems: sparbar@geizkragen.de:1.1.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.1
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {6614d11d-d21d-b211-ae23-815234e1ebb5}:1.0.21
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:2.23b1
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.4.3
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:2.5.6.0
FF - prefs.js..network.proxy.type: 4
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: F:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: F:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: F:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: F:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: f:\Programme\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: F:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: F:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: F:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search\FireFoxExt\13.2.0.5 [2012.11.08 19:30:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: F:\Programme\Mozilla Firefox\components [2012.11.21 18:53:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins [2012.10.28 12:40:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension [2012.11.16 12:45:51 | 000,000,000 | ---D | M]
 
[2010.03.02 18:52:55 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Extensions
[2010.03.02 18:52:55 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.12.18 18:18:33 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions
[2010.06.18 09:31:52 | 000,000,000 | ---D | M] ("ColorfulTabs") -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010.03.23 22:20:47 | 000,000,000 | ---D | M] (All-in-One Sidebar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010.06.13 10:31:46 | 000,000,000 | ---D | M] (WebMail Notifier) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}
[2010.07.04 11:46:51 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.03.23 22:20:47 | 000,000,000 | ---D | M] (Dr.Web anti-virus link checker) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2010.06.29 15:44:18 | 000,000,000 | ---D | M] (NoScript) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.02.28 21:04:59 | 000,000,000 | ---D | M] (ImTranslator) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010.05.21 14:35:40 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.04.26 12:42:58 | 000,000,000 | ---D | M] (myBabylon English Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2010.04.30 10:46:19 | 000,000,000 | ---D | M] (Adblock Plus) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.12 17:57:14 | 000,000,000 | ---D | M] (Download Statusbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2012.01.06 21:18:34 | 000,000,000 | ---D | M] (Toolbar für amazon.de) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\0002.amztoolbar@minimalarts.de
[2010.05.07 19:09:43 | 000,000,000 | ---D | M] (Download Scheduler) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\dlScheduler@ext.net
[2010.04.10 09:22:16 | 000,000,000 | ---D | M] (Fast Dial) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\fastdial@telega.phpnet.us
[2010.02.28 21:04:59 | 000,000,000 | ---D | M] (Geizkragen.de Sparbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\extensions\sparbar@geizkragen.de
[2012.12.02 20:37:27 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2012.12.02 20:37:27 | 000,000,000 | ---D | M] (Garmin Communicator) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012.10.07 18:38:47 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.11.27 21:44:40 | 000,000,000 | ---D | M] (ReminderFox) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2012.01.07 03:41:04 | 000,000,000 | ---D | M] (DownloadHelper) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2)
[2012.11.27 21:44:46 | 000,000,000 | ---D | M] (Adblock Plus) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.08.22 20:01:43 | 000,000,000 | ---D | M] (British English Dictionary) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\en-GB@dictionaries.addons.mozilla.org
[2012.06.12 18:59:38 | 000,000,000 | ---D | M] ("Linkury Smartbar") -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\helperbar@helperbar(2).com
[2012.11.21 11:21:57 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\toolbar@web.de
[2011.12.18 18:18:33 | 000,000,000 | ---D | M] (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions
[2010.07.02 17:45:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.27 13:30:46 | 000,000,000 | ---D | M] (Google Shortcuts) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{5C46D283-ABDE-4dce-B83C-08881401921C}(2)(2)
[2010.12.27 13:42:21 | 000,000,000 | ---D | M] (NoScript) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)
[2010.12.27 13:30:47 | 000,000,000 | ---D | M] (ImTranslator) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}(2)
[2010.12.27 17:12:22 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.12.27 13:30:47 | 000,000,000 | ---D | M] (WOT) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}(2)
[2010.12.27 13:37:36 | 000,000,000 | ---D | M] (FireFTP) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010.12.27 17:12:24 | 000,000,000 | ---D | M] (Elf 1.15 Community Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{b9d63c58-90cc-428b-8d3b-cbb88eb07e7e}
[2010.10.16 11:17:19 | 000,000,000 | ---D | M] (DownloadHelper) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.12.27 17:12:23 | 000,000,000 | ---D | M] (Adblock Plus) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.01 14:01:57 | 000,000,000 | ---D | M] (DownThemAll!) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010.11.17 21:13:58 | 000,000,000 | ---D | M] (FoxTab) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2012.01.06 21:18:34 | 000,000,000 | ---D | M] (Toolbar für amazon.de) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\0002.amztoolbar@minimalarts.de
[2010.11.17 21:13:55 | 000,000,000 | ---D | M] (InvisibleHand) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\canitbecheaper@trafficbroker.co.uk
[2010.11.20 13:06:09 | 000,000,000 | ---D | M] (SimilarWeb) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\FirefoxAddon@similarWeb.com
[2010.07.02 10:36:00 | 000,000,000 | ---D | M] (Cooliris) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\piclens@cooliris.com
[2011.01.02 14:27:46 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\yel7z2b1.Standard-Benutzer\extensions\toolbar@gmx.net
[2012.11.16 22:37:13 | 000,566,853 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\toolbar@web.de.xpi
[2012.10.27 09:28:43 | 000,060,290 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\translator@zoli.bod.xpi
[2012.08.28 18:54:51 | 000,455,379 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
[2011.08.22 20:01:43 | 000,007,532 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi
[2012.11.23 12:32:34 | 000,804,627 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.31 08:23:28 | 000,434,392 | ---- | M] () (No name found) -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.11.08 11:48:26 | 000,002,262 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\98pxhjtx.default\searchplugins\askcom.xml
[2012.11.21 18:53:30 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions
[2012.10.28 12:40:15 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.10.28 12:40:15 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.10.28 12:40:16 | 000,000,000 | ---D | M] (Java Console) -- F:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.10.28 12:40:15 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com
[2012.10.28 12:40:02 | 000,000,000 | ---D | M] (No name found) -- F:\Programme\Mozilla Firefox\distribution(2)\extensions(2)
[2012.10.28 12:40:10 | 000,000,000 | ---D | M] (GMX Toolbar) -- F:\Programme\Mozilla Firefox\distribution(2)\extensions(2)\toolbar@gmx(2).net
[2012.06.30 17:11:10 | 000,000,000 | ---D | M] (Java Quick Starter) -- F:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
File not found (No name found) -- F:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
File not found (No name found) -- F:\PROGRAMME\PDFFORGE TOOLBAR\FF
File not found (No name found) -- F:\PROGRAMME\PDFFORGE TOOLBAR\SSFF
[2012.02.20 13:22:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.11.20 07:17:00 | 000,262,112 | ---- | M] (Mozilla Foundation) -- F:\Programme\mozilla firefox\components\browsercomps.dll
[2012.11.20 08:13:26 | 000,001,392 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.08 19:28:31 | 000,003,574 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.11.16 12:44:06 | 000,006,520 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.11.20 08:13:26 | 000,002,465 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.11.20 08:13:26 | 000,001,153 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.20 08:13:26 | 000,006,805 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.20 08:13:26 | 000,001,178 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.20 08:13:26 | 000,001,105 | ---- | M] () -- F:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: Google
CHR - plugin: Chrome PDF Viewer (Enabled) = F:\Programme\Google\Chrome\Application\8.0.552.224\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = F:\Programme\Google\Chrome\Application\8.0.552.224\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = F:\Programme\Google\Chrome\Application\8.0.552.224\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = F:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = F:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = F:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = F:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft\u00AE DRM (Enabled) = F:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = F:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = F:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Picasa (Enabled) = F:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = F:\Programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll
CHR - plugin: Shockwave Flash (Enabled) = F:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = f:\Programme\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = f:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2006.02.28 13:00:00 | 000,000,820 | ---- | M]) - F:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - F:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - F:\Programme\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll ()
O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - F:\Programme\myBabylon_English\prxtbmyB2.dll (Conduit Ltd.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - F:\Programme\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - F:\Programme\myBabylon_English\prxtbmyB2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - F:\Programme\myBabylon_English\prxtbmyB2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - F:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe ARM] F:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] F:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Conime] F:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] F:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [SpyHunter Security Suite] F:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.)
O4 - HKLM..\Run: [vProt] F:\Programme\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-527237240-842925246-1957994488-1003..\Run: [1und1Dispatcher] F:\Programme\1und1Softwareaktualisierung\SchedDispatcher.exe (1&1 Mail & Media GmbH)
O4 - HKU\S-1-5-21-527237240-842925246-1957994488-1003..\Run: [ccleaner] F:\Programme\CCleaner\CCleaner.exe (Piriform Ltd)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] F:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - F:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - F:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - F:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - F:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O15 - HKU\S-1-5-21-527237240-842925246-1957994488-1003\..Trusted Domains: deutschepost.de ([internetmarke] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E803E0F-181D-427A-B45F-C60B68EF276F}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - F:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - F:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - F:\Programme\Gemeinsame Dateien\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - F:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (f:\dokume~1\alluse~1\anwend~1\browser manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll) - f:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - F:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (F:\WINDOWS\system32\userinit.exe) - F:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.03.24 20:24:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2012.12.03 12:07:09 | 000,000,000 | ---- | M] () - F:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 60 Days ==========
 
[2012.12.03 15:46:35 | 000,000,000 | RH-D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Recent
[2012.12.03 12:05:54 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Startmenü\Programme\SpyHunter
[2012.12.03 12:05:36 | 000,000,000 | ---D | C] -- F:\sh4ldr
[2012.12.03 12:05:36 | 000,000,000 | ---D | C] -- F:\Programme\Enigma Software Group
[2012.12.03 12:04:21 | 000,000,000 | ---D | C] -- F:\Programme\Gemeinsame Dateien\Wise Installation Wizard
[2012.12.02 15:46:52 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Malwarebytes
[2012.12.02 15:46:19 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.12.02 15:46:17 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.12.02 15:46:14 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- F:\WINDOWS\System32\drivers\mbam.sys
[2012.12.02 15:46:14 | 000,000,000 | ---D | C] -- F:\Programme\Malwarebytes' Anti-Malware
[2012.11.18 17:08:51 | 000,000,000 | R--D | C] -- D:\Eigene Dateien\Eigene Bilder
[2012.11.18 16:39:39 | 000,000,000 | ---D | C] -- F:\Programme\Bayer HealthCare SmartLaunch
[2012.11.18 10:56:40 | 000,000,000 | R--D | C] -- F:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Musik
[2012.11.16 12:46:22 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Startmenü\Programme\Browser Manager
[2012.11.16 12:45:16 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager
[2012.11.16 12:42:13 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PDFCreator
[2012.11.16 12:41:52 | 000,662,288 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSCOMCT2.OCX
[2012.11.16 12:41:52 | 000,137,000 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSMAPI32.OCX
[2012.11.16 12:41:52 | 000,086,528 | ---- | C] (pdfforge GbR) -- F:\WINDOWS\System32\pdfcmon.dll
[2012.11.16 12:41:43 | 000,158,208 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSCMCDE.DLL
[2012.11.16 12:41:43 | 000,125,712 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\VB6DE.DLL
[2012.11.16 12:41:43 | 000,064,512 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSCC2DE.DLL
[2012.11.16 12:41:42 | 000,023,552 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\MSMPIDE.DLL
[2012.11.16 12:41:38 | 000,000,000 | ---D | C] -- F:\Programme\PDFCreator
[2012.11.09 10:35:52 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\CallingID
[2012.11.08 19:29:18 | 000,026,984 | ---- | C] (AVG Technologies) -- F:\WINDOWS\System32\drivers\avgtpx86.sys
[2012.11.08 11:56:39 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Avira
[2012.11.08 11:52:22 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2012.11.08 11:52:17 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\BabylonToolbar
[2012.11.08 11:52:07 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\myBabylon_English
[2012.11.08 11:48:46 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.11.08 11:48:03 | 000,000,000 | ---D | C] -- F:\Programme\Ask.com
[2012.11.08 11:47:53 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\Leopold Kern\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2012.11.08 11:47:23 | 000,028,520 | ---- | C] (Avira GmbH) -- F:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.11.08 11:47:18 | 000,133,824 | ---- | C] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avipbb.sys
[2012.11.08 11:47:18 | 000,083,432 | ---- | C] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avgntflt.sys
[2012.11.08 11:47:18 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avkmgr.sys
[2012.11.08 11:47:10 | 000,000,000 | ---D | C] -- F:\Programme\Avira
[2012.11.07 20:33:48 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\WISO Mein Geld
[2012.11.07 19:51:26 | 000,000,000 | ---D | C] -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WISO Mein Geld 2013
[2012.10.28 12:39:59 | 000,000,000 | ---D | C] -- F:\Programme\Mozilla Firefox
[2012.10.27 20:40:21 | 000,000,000 | R--D | C] -- D:\Eigene Dateien\Eigene Musik
[2011.01.08 12:05:44 | 037,719,448 | ---- | C] (Adobe Systems Incorporated) -- F:\Programme\AdbeRdr1000_de_DE.exe
[2010.12.11 18:44:35 | 007,290,568 | ---- | C] (Uniblue Systems Ltd                                                                                                                                                                                                                                                                                         ) -- F:\Programme\registrybooster.exe
[2010.12.11 18:40:59 | 011,237,760 | ---- | C] (Mozilla) -- F:\Programme\Firefox Setup 4.0 Beta 7.exe
[2010.10.23 20:08:39 | 014,259,704 | ---- | C] (Google Inc.) -- F:\Programme\picasa38-setup.exe
[2010.09.04 17:32:53 | 017,010,016 | ---- | C] (Microsoft Corporation) -- F:\Programme\IE8-WindowsXP-x86-DEU.exe
[2010.04.12 17:26:19 | 002,025,768 | ---- | C] (Skype Technologies S.A.) -- F:\Programme\SkypeSetup.exe
[8 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 60 Days ==========
 
[2012.12.03 18:38:01 | 000,000,240 | ---- | M] () -- F:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.12.03 18:38:00 | 000,000,294 | ---- | M] () -- F:\WINDOWS\tasks\Browser Manager.job
[2012.12.03 17:57:00 | 000,000,884 | ---- | M] () -- F:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.12.03 17:51:00 | 000,001,100 | ---- | M] () -- F:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.03 17:51:00 | 000,000,486 | ---- | M] () -- F:\WINDOWS\tasks\PrintProjects Communicator.job
[2012.12.03 17:43:54 | 000,000,432 | -H-- | M] () -- F:\WINDOWS\tasks\User_Feed_Synchronization-{0E24EDD0-64F5-48B7-95C0-549FFC98A668}.job
[2012.12.03 16:27:21 | 000,000,724 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.12.03 15:43:36 | 000,012,700 | ---- | M] () -- F:\WINDOWS\System32\wpa.dbl
[2012.12.03 15:43:31 | 000,001,096 | ---- | M] () -- F:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.03 15:43:28 | 000,000,460 | ---- | M] () -- F:\WINDOWS\tasks\PCCT - MAGIX AG.job
[2012.12.03 15:42:53 | 000,002,048 | --S- | M] () -- F:\WINDOWS\bootstat.dat
[2012.12.03 15:42:51 | 670,666,752 | -HS- | M] () -- F:\hiberfil.sys
[2012.12.03 12:46:57 | 000,001,404 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\Lange Version CD-Progressive-Muskelentspannung-Langversion-128kbps.lnk
[2012.12.03 12:07:09 | 000,000,000 | ---- | M] () -- F:\autoexec.bat
[2012.12.03 12:05:55 | 000,002,003 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\SpyHunter.lnk
[2012.12.02 20:39:19 | 000,000,676 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\CCleaner v3.25.1872 (26 Nov 2012).lnk
[2012.12.02 15:46:20 | 000,000,796 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.21 18:53:45 | 000,000,724 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox 17.0, 21.11.2012.lnk
[2012.11.18 17:25:13 | 000,527,798 | ---- | M] () -- F:\WINDOWS\System32\perfh007.dat
[2012.11.18 17:25:13 | 000,496,492 | ---- | M] () -- F:\WINDOWS\System32\perfh009.dat
[2012.11.18 17:25:13 | 000,125,526 | ---- | M] () -- F:\WINDOWS\System32\perfc007.dat
[2012.11.18 17:25:13 | 000,101,944 | ---- | M] () -- F:\WINDOWS\System32\perfc009.dat
[2012.11.18 13:25:20 | 000,001,940 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\Launch GLUCOFACTS(TM) Deluxe Update Utility.lnk
[2012.11.18 10:55:19 | 000,269,392 | ---- | M] () -- F:\WINDOWS\System32\FNTCACHE.DAT
[2012.11.14 18:04:12 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avipbb.sys
[2012.11.14 18:04:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avkmgr.sys
[2012.11.14 18:04:11 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) -- F:\WINDOWS\System32\drivers\avgntflt.sys
[2012.11.08 19:28:06 | 000,026,984 | ---- | M] (AVG Technologies) -- F:\WINDOWS\System32\drivers\avgtpx86.sys
[2012.11.08 11:48:46 | 000,001,699 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center 2013.lnk
[2012.11.08 11:28:20 | 000,028,520 | ---- | M] (Avira GmbH) -- F:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.11.07 19:51:27 | 000,000,788 | ---- | M] () -- F:\Dokumente und Einstellungen\All Users\Desktop\WISO Mein Geld 2013 (07.11.2012).lnk
[2012.10.22 20:56:29 | 001,866,496 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\System32\win32k.sys
[2012.10.22 20:56:29 | 001,866,496 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\System32\dllcache\win32k.sys
[2012.10.14 18:57:27 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- F:\WINDOWS\System32\FlashPlayerApp.exe
[2012.10.14 18:57:27 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- F:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.10.12 07:34:54 | 000,086,528 | ---- | M] (pdfforge GbR) -- F:\WINDOWS\System32\pdfcmon.dll
[8 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.12.03 16:27:21 | 000,000,730 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2012.12.03 16:27:21 | 000,000,724 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.12.03 12:07:09 | 000,000,000 | ---- | C] () -- F:\autoexec.bat
[2012.12.03 12:05:55 | 000,002,003 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\SpyHunter.lnk
[2012.12.02 15:46:20 | 000,000,796 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.12.02 13:48:47 | 000,000,294 | ---- | C] () -- F:\WINDOWS\tasks\Browser Manager.job
[2012.11.21 18:53:44 | 000,000,724 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox 17.0, 21.11.2012.lnk
[2012.11.18 13:25:19 | 000,001,940 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Desktop\Launch GLUCOFACTS(TM) Deluxe Update Utility.lnk
[2012.11.08 11:48:46 | 000,001,699 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center 2013.lnk
[2012.11.08 11:48:19 | 000,000,240 | ---- | C] () -- F:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.11.07 19:51:27 | 000,000,788 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\WISO Mein Geld 2013 (07.11.2012).lnk
[2012.11.07 18:14:39 | 000,000,676 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Desktop\CCleaner v3.25.1872 (26 Nov 2012).lnk
[2012.06.22 12:01:30 | 000,019,984 | ---- | C] () -- F:\WINDOWS\System32\ESGScanner.sys
[2012.06.22 12:01:30 | 000,019,984 | ---- | C] () -- F:\WINDOWS\System32\drivers\EsgScanner.sys
[2012.06.18 16:36:11 | 000,159,672 | ---- | C] () -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.05.11 22:50:04 | 000,272,974 | ---- | C] () -- F:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012.02.16 13:02:48 | 000,003,072 | ---- | C] () -- F:\WINDOWS\System32\iacenc.dll
[2012.02.14 16:18:25 | 000,002,518 | ---- | C] () -- F:\WINDOWS\System32\ASOROSet.bin
[2011.12.23 13:02:27 | 000,000,145 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2011.06.25 11:36:40 | 000,003,776 | ---- | C] () -- F:\WINDOWS\System32\fxsperf.ini
[2011.05.17 09:45:16 | 000,000,265 | ---- | C] () -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2011.03.26 13:11:31 | 000,000,022 | -HS- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Sys2662.Config.Repository.bin
[2011.03.24 21:27:24 | 000,000,552 | ---- | C] () -- F:\WINDOWS\System32\d3d8caps.dat
[2011.02.10 10:17:28 | 000,737,721 | ---- | C] () -- F:\Programme\wot-20100908-fx_sm.zip
[2011.01.09 12:33:14 | 000,001,324 | ---- | C] () -- F:\WINDOWS\System32\d3d9caps.dat
[2010.04.26 12:42:12 | 008,256,440 | ---- | C] () -- F:\Programme\Babylon8_setup.exe
[2010.03.05 20:06:14 | 000,023,552 | ---- | C] () -- F:\Dokumente und Einstellungen\Leopold Kern\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2012.11.09 23:09:20 | 000,000,596 | ---- | M] () -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}\defaults\printing\icons\@.png
[2010.02.24 18:54:10 | 000,000,227 | RHS- | M] () -- F:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 07:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = F:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = F:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.11.08 19:30:51 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search
[2012.03.18 12:38:33 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012.11.18 16:39:45 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BayerLogs
[2012.11.16 12:45:16 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Browser Manager
[2010.02.24 21:04:22 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2012.07.20 18:45:09 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2012.03.18 12:48:48 | 000,000,000 | -H-D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2011.05.16 19:18:40 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Deutsche Post AG
[2011.01.02 17:46:51 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Mender
[2010.07.01 13:15:17 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Driver Whiz
[2012.06.13 17:17:15 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2012.02.26 13:07:38 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fighters
[2012.05.11 15:45:44 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Garmin
[2010.08.02 18:26:30 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX
[2010.12.27 13:30:38 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010.06.19 11:15:40 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2012.09.05 15:52:13 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PrintProjects
[2012.04.29 13:10:23 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UUdb
[2012.02.15 12:50:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Visan
[2011.01.02 16:07:15 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2011.09.09 11:21:50 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Default User\Anwendungsdaten\Temp
[2011.12.20 13:29:13 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Abelssoft
[2012.01.06 21:18:03 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\AllDup
[2011.12.18 17:50:45 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\ASCOMP Software
[2012.03.18 12:49:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\AVG Secure Search
[2012.03.18 12:38:32 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Babylon
[2012.04.14 20:50:03 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\BabylonToolbar
[2010.02.24 21:04:58 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Buhl Data Service
[2012.11.07 20:29:48 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Buhl Data Service GmbH
[2012.11.20 11:10:05 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\CallingID
[2010.07.10 11:25:43 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\CheckPoint
[2010.04.19 19:21:55 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\COMPUTERBILD-Abzockschutz
[2010.02.24 21:08:30 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\DataDesign
[2012.06.13 17:17:54 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\elsterformular
[2012.02.26 13:07:40 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Fighters
[2012.01.07 04:05:38 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Garmin
[2010.02.22 17:22:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\GHISLER
[2010.08.02 18:28:48 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\GMX
[2010.07.12 09:38:44 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\JGoodies
[2010.08.22 07:38:14 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Leadertech
[2010.02.24 21:04:39 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\LetsTrade
[2010.12.23 20:36:54 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\MAGIX
[2012.07.14 13:12:02 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\OpenCandy
[2011.05.20 12:37:35 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Opera
[2012.11.16 12:42:13 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\pdfforge
[2012.04.14 20:59:34 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Search Settings
[2010.10.13 11:38:45 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Serif
[2012.02.14 16:19:15 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Systweak
[2012.04.16 10:51:16 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\TeamViewer
[2012.02.15 11:32:59 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Temp
[2010.03.02 18:52:34 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Thunderbird
[2010.07.01 12:59:22 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Uniblue
[2012.02.15 12:50:41 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\Visan
[2010.02.22 20:56:54 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\Leopold Kern\Anwendungsdaten\webpdf.jclient
[2012.11.08 11:52:17 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\BabylonToolbar
[2010.12.27 13:37:00 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Fighters
[2011.06.22 10:50:20 | 000,000,000 | ---D | M] -- F:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Temp
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---

hi
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten