| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Google-Treffer-ProblemWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.12.2012, 22:15
| #1 |
 |  Google-Treffer-Problem Hallo, beim Googeln tun sich nach 1 sec plötzlich Treffer auf, die mit dem Gesuchten gar nix zu tun haben. was kann ich machen? Ich habe Malwarebytes Anti-Malware durchgeführt: keine Funde! Grundsätzliche Frage: Ist dieser Google-Trojaner schädlich oder "nur nervig"? Der scheint ja wohl nicht so verbreitet zu sein, denn wenn man googelt findet man kaum Treffer, oder? |
|
22.12.2012, 12:30
| #2 | |
| /// TB-Ausbilder  | Google-Treffer-Problem Logfile bitte dennoch hier posten.
__________________
__________________ |
|
22.12.2012, 19:31
| #3 |
| | Google-Treffer-Problem Ich hab jetzt das OTL laufen lassen (nach der Anweisung von Markusg).
__________________Hier das log-file: Code:
ATTFilter OTL logfile created on: 22.12.2012 18:43:20 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Xxx\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,94 Gb Total Physical Memory | 2,04 Gb Available Physical Memory | 69,34% Memory free 5,87 Gb Paging File | 4,90 Gb Available in Paging File | 83,38% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 109,38 Gb Total Space | 76,91 Gb Free Space | 70,31% Space Free | Partition Type: NTFS Drive D: | 1397,26 Gb Total Space | 128,20 Gb Free Space | 9,17% Space Free | Partition Type: NTFS Drive E: | 931,51 Gb Total Space | 463,28 Gb Free Space | 49,73% Space Free | Partition Type: NTFS Drive G: | 9,86 Gb Total Space | 5,73 Gb Free Space | 58,14% Space Free | Partition Type: NTFS Drive H: | 1863,01 Gb Total Space | 486,36 Gb Free Space | 26,11% Space Free | Partition Type: NTFS Drive I: | 58,92 Gb Total Space | 1,41 Gb Free Space | 2,40% Space Free | Partition Type: NTFS Unable to calculate disk information. Computer Name: XXX | User Name: Xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.21 21:49:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe PRC - [2012.12.11 15:28:20 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.12.11 15:28:11 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.12.11 15:28:11 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.12.11 15:28:10 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.11.10 14:10:57 | 000,997,320 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe PRC - [2012.11.09 04:21:32 | 000,587,472 | ---- | M] (Crawler.com) -- C:\Programme\Spyware Terminator\st_rsser.exe PRC - [2012.10.16 22:43:38 | 000,711,112 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe PRC - [2012.10.02 20:29:14 | 000,864,616 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe PRC - [2012.10.02 20:28:55 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.08.30 20:13:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 03:17:58 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 03:17:48 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.02.18 11:49:40 | 000,357,448 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\GamePanel Software\LGDevAgt.exe PRC - [2009.09.06 05:06:20 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe PRC - [2009.03.30 14:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe PRC - [2008.01.22 10:13:32 | 001,201,448 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2008.01.22 10:13:20 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe ========== Modules (No Company Name) ========== MOD - [2012.11.10 14:10:57 | 000,997,320 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe MOD - [2012.10.16 22:43:38 | 000,566,728 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\DNTInstaller\13.2.0\avgdttbx.dll MOD - [2012.10.16 22:43:38 | 000,134,600 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\SiteSafety.dll MOD - [2009.02.27 15:38:20 | 000,139,264 | R--- | M] () -- C:\Programme\Brother\BrUtilities\BrLogAPI.dll ========== Services (SafeList) ========== SRV - [2012.12.11 20:30:29 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.11 15:28:20 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.12.11 15:28:11 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.12.07 12:27:47 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.11.09 04:21:32 | 000,587,472 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Programme\Spyware Terminator\st_rsser.exe -- (ST2012_Svc) SRV - [2012.10.16 22:43:38 | 000,711,112 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe -- (vToolbarUpdater13.2.0) SRV - [2012.10.08 21:02:21 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.08.30 20:13:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.11.20 03:17:58 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.01.09 20:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2010.01.09 20:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2009.09.06 05:06:20 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2012.12.11 15:28:23 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.12.11 15:28:23 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.11.15 19:38:07 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2012.10.16 22:43:38 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp) DRV - [2012.10.11 13:46:04 | 000,627,288 | ---- | M] (TechniSat Digital, S.A.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SkyNET.sys -- (SKYNET) DRV - [2012.10.10 21:14:28 | 010,837,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.08.23 15:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2012.08.23 15:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2011.07.29 12:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv) DRV - [2011.07.29 12:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv) DRV - [2011.06.21 11:24:06 | 000,032,768 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2) DRV - [2009.11.23 16:37:18 | 000,014,856 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LGVirHid.sys -- (LGVirHid) DRV - [2009.11.23 16:37:08 | 000,019,720 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LGBusEnum.sys -- (LGBusEnum) DRV - [2009.10.13 01:16:02 | 000,049,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\l160x86.sys -- (AtcL001) DRV - [2009.05.13 18:11:34 | 000,006,504 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) DRV - [2007.12.17 16:14:06 | 000,012,400 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AsIO.sys -- (AsIO) DRV - [2002.11.28 15:18:04 | 000,015,360 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={2D2E23E7-F325-4B1D-BC6E-F2423B4E132A}&mid=df8f1e9509e947d09000d151b5807a67-0186bff8005b8d3620226a7e245cc8de7d7d127a&lang=de&ds=bm015&pr=sa&d=2012-10-16 23:43:42&v=13.2.0.1&sap=hp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 56 74 EA 8A 18 A7 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={2D2E23E7-F325-4B1D-BC6E-F2423B4E132A}&mid=df8f1e9509e947d09000d151b5807a67-0186bff8005b8d3620226a7e245cc8de7d7d127a&lang=de&ds=bm015&pr=sa&d=2012-10-16 23:43:42&v=13.2.0.1&sap=dsp&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://web.de/" FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.3.4.1 FF - prefs.js..extensions.enabledAddons: %7Bdc572301-7619-498c-a57d-39143191b318%7D:0.4.0.3.1 FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.1 FF - prefs.js..extensions.enabledAddons: %7Bc50ca3c4-5656-43c2-a061-13e717f73fc8%7D:4.2.4 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - prefs.js..keyword.URL: "https://isearch.avg.com/search?cid={2D2E23E7-F325-4B1D-BC6E-F2423B4E132A}&mid=df8f1e9509e947d09000d151b5807a67-0186bff8005b8d3620226a7e245cc8de7d7d127a&lang=de&ds=bm015&pr=sa&d=2012-10-16 23:43:42&v=13.2.0.1&sap=ku&q=" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\13.2.0.5 [2012.11.10 14:11:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.07 12:27:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.07 12:27:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.07 12:27:47 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.07 12:27:43 | 000,000,000 | ---D | M] [2012.10.04 22:02:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Extensions [2012.12.15 18:20:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Firefox\Profiles\l4ouc8my.default\extensions [2012.12.02 21:37:50 | 000,566,966 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\toolbar@web.de.xpi [2012.12.09 17:44:28 | 000,347,581 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2012.12.15 18:20:43 | 000,316,317 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi [2012.11.25 16:01:25 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.11.30 13:59:10 | 000,710,866 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012.12.08 13:52:57 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.12.02 21:37:53 | 000,000,911 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\11-suche.xml [2012.12.02 21:37:53 | 000,002,273 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\englische-ergebnisse.xml [2012.12.02 21:37:53 | 000,010,563 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\gmx-suche.xml [2012.12.02 21:37:53 | 000,002,432 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\lastminute.xml [2012.12.02 21:37:53 | 000,005,545 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\webde-suche.xml [2012.12.07 12:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.12.07 12:27:47 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll [2012.11.02 09:12:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.11.10 14:10:58 | 000,003,573 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml [2012.11.02 09:12:26 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.11.02 09:12:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.11.02 09:12:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.11.02 09:12:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.11.02 09:12:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll () O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll () O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CloneCDElbyCDFL] C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe (Elaborate Bytes AG) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4 - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [ROC_roc_ssl_v12] C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe () O4 - HKLM..\Run: [SpywareTerminatorShield] C:\Programme\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com) O4 - HKLM..\Run: [SpywareTerminatorUpdater] C:\Programme\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com) O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe () O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7B9F1D5D-50DF-4CF7-8F33-5CB646D4F9B7}: DhcpNameServer = 0.0.0.0 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D75BEE7C-FAF2-453E-9A79-54EA6940B384}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll () O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - I:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {60702D8B-5E32-B289-79CA-87872305474F} - Microsoft Windows Media Player 12.0 ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.12.22 12:33:39 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Spyware Terminator [2012.12.22 12:33:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator [2012.12.22 12:33:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012 [2012.12.22 12:32:52 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator [2012.12.22 12:12:39 | 000,937,224 | ---- | C] (Crawler.com ) -- C:\Users\Xxx\Desktop\SpywareTerminator30074Setup.exe [2012.12.22 10:48:26 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Malwarebytes [2012.12.22 10:48:17 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.22 10:47:53 | 010,669,952 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Xxx\Desktop\mbam-setup-1.65.1.1000.exe [2012.12.21 21:49:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe [2012.12.21 21:47:47 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Xxx\Desktop\tdsskiller.exe [2012.12.20 20:38:53 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2012.12.20 20:38:53 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2012.12.18 03:19:09 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\Microsoft Games [2012.12.17 21:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exifer [2012.12.17 21:44:50 | 000,000,000 | ---D | C] -- C:\Program Files\Exifer [2012.12.12 21:37:33 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.12.12 21:37:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.12.12 21:37:32 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.12.12 21:37:31 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.12.12 21:37:31 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.12.12 21:37:30 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.12.12 21:37:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.12.12 21:37:28 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.12.12 21:27:50 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.12.12 21:27:47 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe [2012.12.12 21:27:47 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2012.12.12 21:27:46 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll [2012.12.12 21:27:46 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll [2012.12.12 21:27:42 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll [2012.12.12 21:27:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2012.12.11 13:20:49 | 000,000,000 | ---D | C] -- g:\Eigene Dateien\DVDFab Passkey [2012.12.11 09:54:54 | 000,000,000 | ---D | C] -- g:\Eigene Dateien\Eigene Projekte bei druckstdu [2012.12.10 22:58:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\druckstdu.de [2012.12.10 21:25:25 | 000,000,000 | ---D | C] -- C:\Program Files\druckstdu.de [2012.12.10 20:13:35 | 000,000,000 | ---D | C] -- C:\Users\Xxx\Desktop\Sabine [2012.12.07 23:12:16 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maniac Mansion Deluxe [2012.12.07 23:12:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maniac Mansion Deluxe [2012.12.07 23:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\LucasFan Games [2012.12.07 21:48:56 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\DVDFab [2012.12.07 12:27:43 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.12.05 23:08:37 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Media Player Classic [2012.12.05 23:07:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC [2012.12.05 23:07:57 | 000,000,000 | ---D | C] -- C:\Program Files\MPC-HC [2012.11.30 19:05:57 | 000,000,000 | ---D | C] -- C:\ISO [2012.11.30 18:59:07 | 000,000,000 | ---D | C] -- C:\ProgramData\dvdfab [2012.11.30 18:58:23 | 000,000,000 | ---D | C] -- C:\Temp [2012.11.30 18:54:28 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\NVIDIA [2012.11.30 18:54:28 | 000,000,000 | ---D | C] -- C:\Log [2012.11.30 18:54:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8 Qt [2012.11.30 18:54:19 | 000,000,000 | ---D | C] -- C:\Program Files\DVDFab 8 Qt [2012.11.30 14:00:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoGebra [2012.11.30 14:00:11 | 000,000,000 | ---D | C] -- C:\Program Files\GeoGebra [2012.11.30 13:58:51 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\mathegrafix [2012.10.07 12:11:19 | 000,270,406 | ---- | C] (DVD Shrink) -- C:\Program Files\DVD Shrink 3.0 Beta 5.exe ========== Files - Modified Within 30 Days ========== [2012.12.22 18:30:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.22 17:50:13 | 000,014,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.22 17:50:13 | 000,014,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.22 17:48:55 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.22 17:48:55 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.22 17:48:55 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.22 17:48:55 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.22 17:42:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.22 17:42:50 | 2364,940,288 | -HS- | M] () -- C:\hiberfil.sys [2012.12.22 12:33:36 | 000,001,007 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk [2012.12.22 12:12:39 | 000,937,224 | ---- | M] (Crawler.com ) -- C:\Users\Xxx\Desktop\SpywareTerminator30074Setup.exe [2012.12.22 10:48:18 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.22 10:47:56 | 010,669,952 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Xxx\Desktop\mbam-setup-1.65.1.1000.exe [2012.12.21 21:49:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe [2012.12.21 21:47:47 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Xxx\Desktop\tdsskiller.exe [2012.12.21 06:19:38 | 000,425,671 | ---- | M] () -- C:\Users\Xxx\Desktop\Weihnachtsbild.jpg [2012.12.21 06:17:46 | 000,620,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.12.17 21:44:50 | 000,000,888 | ---- | M] () -- C:\Users\Xxx\Desktop\Exifer.lnk [2012.12.16 15:13:28 | 000,295,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2012.12.16 15:13:20 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2012.12.11 20:30:18 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.12.11 20:30:18 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.12.11 15:28:23 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys [2012.12.11 15:28:23 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys [2012.12.11 13:22:01 | 000,000,336 | ---- | M] () -- C:\Users\Xxx\Desktop\BR-Laufwerk (X).lnk [2012.12.09 17:44:02 | 001,422,466 | ---- | M] () -- C:\Users\Xxx\Desktop\Ritterburg.mp4 [2012.12.05 16:12:56 | 000,220,298 | ---- | M] () -- C:\Users\Xxx\Desktop\Baustelle.jpg [2012.11.30 18:54:24 | 000,000,973 | ---- | M] () -- C:\Users\Xxx\Desktop\DVDFab 8 Qt.lnk [2012.11.30 17:17:20 | 000,050,277 | ---- | M] () -- C:\Users\Xxx\Desktop\Terminplan CSG.pdf [2012.11.30 14:00:13 | 000,001,778 | ---- | M] () -- C:\Users\Public\Desktop\GeoGebra.lnk ========== Files Created - No Company Name ========== [2012.12.22 12:33:39 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2012.12.22 12:33:36 | 000,001,007 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk [2012.12.22 10:48:18 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 06:19:38 | 000,425,671 | ---- | C] () -- C:\Users\Xxx\Desktop\Weihnachtsbild.jpg [2012.12.17 21:44:50 | 000,000,888 | ---- | C] () -- C:\Users\Xxx\Desktop\Exifer.lnk [2012.12.11 13:22:01 | 000,000,336 | ---- | C] () -- C:\Users\Xxx\Desktop\BR-Laufwerk (X).lnk [2012.12.09 17:44:02 | 001,422,466 | ---- | C] () -- C:\Users\Xxx\Desktop\Ritterburg.mp4 [2012.12.05 16:05:34 | 000,220,298 | ---- | C] () -- C:\Users\Xxx\Desktop\Baustelle.jpg [2012.11.30 18:54:24 | 000,000,973 | ---- | C] () -- C:\Users\Xxx\Desktop\DVDFab 8 Qt.lnk [2012.11.30 17:17:20 | 000,050,277 | ---- | C] () -- C:\Users\Xxx\Desktop\Terminplan CSG.pdf [2012.11.30 14:00:13 | 000,001,778 | ---- | C] () -- C:\Users\Public\Desktop\GeoGebra.lnk [2012.10.08 18:44:00 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll [2012.10.08 18:43:59 | 002,469,760 | ---- | C] () -- C:\Windows\System32\BootMan.exe [2012.10.08 18:43:59 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe [2012.10.08 18:43:59 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys [2012.10.08 18:43:59 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys [2012.10.05 21:35:35 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2012.10.05 21:35:34 | 000,000,065 | ---- | C] () -- C:\Windows\System32\BD7045N.DAT [2012.10.05 21:34:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL [2012.10.05 21:34:54 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI [2012.10.05 18:41:35 | 000,024,576 | ---- | C] () -- C:\Windows\System32\AsIO.dll [2012.10.05 18:41:35 | 000,012,400 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys [2012.10.04 21:20:44 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012.10.04 23:25:37 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2012.10.31 23:28:12 | 000,000,000 | -HSD | M] -- C:\Boot [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2012.10.04 21:20:44 | 000,000,000 | ---D | M] -- C:\Intel [2012.11.30 19:05:57 | 000,000,000 | ---D | M] -- C:\ISO [2012.11.30 19:00:47 | 000,000,000 | ---D | M] -- C:\Log [2012.10.04 22:22:01 | 000,000,000 | RH-D | M] -- C:\MSOCache [2012.10.10 11:49:35 | 000,000,000 | ---D | M] -- C:\NST [2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.12.22 12:32:52 | 000,000,000 | R--D | M] -- C:\Program Files [2012.12.22 12:33:39 | 000,000,000 | -H-D | M] -- C:\ProgramData [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\Programme [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\Recovery [2012.10.11 18:38:25 | 000,000,000 | ---D | M] -- C:\SharePoint-Entwürfe [2012.12.22 18:47:06 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.11.30 19:00:49 | 000,000,000 | ---D | M] -- C:\Temp [2012.10.04 21:25:24 | 000,000,000 | R--D | M] -- C:\Users [2012.11.18 10:45:05 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > [2003.08.16 01:57:36 | 000,270,406 | ---- | M] (DVD Shrink) -- C:\Program Files\DVD Shrink 3.0 Beta 5.exe < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < C:\Windows\system32\*.tsp > [2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp [2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp [2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp [2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp [2010.11.20 03:16:54 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe [2010.11.20 03:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe < MD5 for: IASTOR.SYS > [2009.06.04 11:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys [2009.06.04 11:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_4f144d6467fc7c22\iaStor.sys [2009.06.04 11:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_x86_neutral_10aa509d6843c6fc\iaStor.sys < MD5 for: IASTORV.SYS > [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010.11.20 03:29:56 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 03:29:56 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.11.20 03:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll [2010.11.20 03:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys [2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys [2010.11.20 03:30:08 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 03:30:08 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2010.11.20 03:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll [2010.11.20 03:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2010.11.20 03:21:34 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll [2010.11.20 03:21:34 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 03:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 03:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 03:17:56 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 03:17:56 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2012.09.29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2012.12.22 18:45:15 | 003,407,872 | -HS- | M] () -- C:\Users\Xxx\NTUSER.DAT [2012.12.22 18:45:15 | 000,262,144 | -HS- | M] () -- C:\Users\Xxx\ntuser.dat.LOG1 [2012.10.04 21:10:01 | 000,000,000 | -HS- | M] () -- C:\Users\Xxx\ntuser.dat.LOG2 [2012.10.04 21:18:10 | 000,065,536 | -HS- | M] () -- C:\Users\Xxx\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf [2012.10.04 21:18:10 | 000,524,288 | -HS- | M] () -- C:\Users\Xxx\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms [2012.10.04 21:18:10 | 000,524,288 | -HS- | M] () -- C:\Users\Xxx\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms [2012.10.04 21:10:01 | 000,000,020 | -HS- | M] () -- C:\Users\Xxx\ntuser.ini < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < > < End of report > |
|
22.12.2012, 19:47
| #4 | ||
| /// TB-Ausbilder | Google-Treffer-Problem
 Ich werde dir bei deinem Problem helfen. Eine Bereinigung ist mitunter mit viel Arbeit für Dich (und mich) verbunden. Bevor es los geht, habe ich etwas Lesestoff für dich. Gelesen und verstanden? Schritt 1: AdwCleaner: Werbeprogramme suchen und löschen
Schritt 2: Temporäre Dateien löschen mit TFC
Schritt 3: Scan mit DDS (+ attach) Downloade dir bitte DDS (von sUBs) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
22.12.2012, 20:22
| #5 |
| | Google-Treffer-Problem Danke schonmal! Hier die Logdatei von AdwCleaner: Code:
ATTFilter # AdwCleaner v2.101 - Datei am 22/12/2012 um 20:13:08 erstellt
# Aktualisiert am 16/12/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzer : Xxx - XXX
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Xxx\Downloads\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Users\Xxx\AppData\Roaming\Mozilla\Firefox\Profiles\l4ouc8my.default\searchplugins\11-suche.xml
Gelöscht mit Neustart : C:\Program Files\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Program Files\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\Users\Xxx\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\Xxx\AppData\LocalLow\AVG Secure Search
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AVG Secure Search
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\Software\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16457
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={2D2E23E7-F325-4B1D-BC6E-F2423B4E132A}&mid=df8f1e9509e947d09000d151b5807a67-0186bff8005b8d3620226a7e245cc8de7d7d127a&lang=de&ds=bm015&pr=sa&d=2012-10-16 23:43:42&v=13.2.0.1&sap=hp --> hxxp://www.google.com
-\\ Mozilla Firefox v17.0.1 (de)
Profilname : default
Datei : C:\Users\Xxx\AppData\Roaming\Mozilla\Firefox\Profiles\l4ouc8my.default\prefs.js
Gelöscht : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Gelöscht : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid={2D2E23E7-F325-4B1D-BC6E-F2423B4E132A}&[...]
*************************
AdwCleaner[S1].txt - [5212 octets] - [22/12/2012 20:13:08]
########## EOF - C:\AdwCleaner[S1].txt - [5272 octets] ##########
DDS Logfile: Code:
ATTFilter DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.9.2
Run by Xxx at 20:18:09 on 2012-12-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3007.2088 [GMT 1:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\IoctlSvc.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [CloneCDElbyCDFL] "c:\program files\elaborate bytes\clonecd\ElbyCheck.exe" /L ElbyCDFL
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_roc_ssl_v12] "c:\program files\avg secure search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
mRun: [Launch LgDeviceAgent] "c:\program files\logitech\gamepanel software\LgDevAgt.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [SpywareTerminatorShield] c:\program files\spyware terminator\SpywareTerminatorShield.exe
mRun: [SpywareTerminatorUpdater] c:\program files\spyware terminator\SpywareTerminatorUpdate.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: An OneNote s&enden - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.178.1
TCP: Interfaces\{7B9F1D5D-50DF-4CF7-8F33-5CB646D4F9B7} : DHCPNameServer = 0.0.0.0
TCP: Interfaces\{D75BEE7C-FAF2-453E-9A79-54EA6940B384} : DHCPNameServer = 192.168.178.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\Xxx\appdata\roaming\mozilla\firefox\profiles\l4ouc8my.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://web.de/
FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2012-12-02 21:37; toolbar@web.de; c:\users\Xxx\appdata\roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\toolbar@web.de.xpi
FF - ExtSQL: 2012-12-08 13:52; {DDC359D1-844A-42a7-9AA1-88A850A938A8}; c:\users\Xxx\appdata\roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
.
============= SERVICES / DRIVERS ===============
.
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-10-16 26984]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-10-4 36552]
R1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [2012-12-22 32768]
R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\adobe\elements organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-6 169312]
R2 AntiVirSchedulerService;Avira Planer;c:\program files\avira\antivir desktop\sched.exe [2012-10-4 85280]
R2 AntiVirService;Avira Echtzeit-Scanner;c:\program files\avira\antivir desktop\avguard.exe [2012-10-4 109344]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-10-4 83944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-10-2 382824]
R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\13.2.0\ToolbarUpdater.exe [2012-10-16 711112]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l160x86.sys [2009-10-13 49152]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 19720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files\spyware terminator\st_rsser.exe [2012-12-22 587472]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2012-10-8 14216]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2012-10-8 8456]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 14856]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-11-18 14848]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2010-5-10 627288]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-11-18 49664]
.
=============== Created Last 30 ================
.
2012-12-22 11:33:39 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2012-12-22 11:33:39 -------- d-----w- c:\users\Xxx\appdata\roaming\Spyware Terminator
2012-12-22 11:33:39 -------- d-----w- c:\programdata\Spyware Terminator
2012-12-22 11:32:52 -------- d-----w- c:\program files\Spyware Terminator
2012-12-22 09:48:26 -------- d-----w- c:\users\Xxx\appdata\roaming\Malwarebytes
2012-12-22 09:48:17 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-22 09:48:17 -------- d-----w- c:\programdata\Malwarebytes
2012-12-22 09:48:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-20 19:38:53 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-20 19:38:53 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-18 02:19:09 -------- d-----w- c:\users\Xxx\appdata\local\Microsoft Games
2012-12-17 20:44:50 -------- d-----w- c:\program files\Exifer
2012-12-12 20:27:50 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-12-10 20:25:25 -------- d-----w- c:\program files\druckstdu.de
2012-12-07 22:11:41 -------- d-----w- c:\program files\LucasFan Games
2012-12-07 20:48:56 -------- d-----w- c:\users\Xxx\appdata\roaming\DVDFab
2012-12-05 22:07:57 -------- d-----w- c:\program files\MPC-HC
2012-11-30 18:05:57 -------- d-----w- C:\ISO
2012-11-30 17:59:07 -------- d-----w- c:\programdata\dvdfab
2012-11-30 17:58:23 -------- d-----w- C:\Temp
2012-11-30 17:54:28 -------- d-----w- c:\users\Xxx\appdata\roaming\NVIDIA
2012-11-30 17:54:28 -------- d-----w- C:\Log
2012-11-30 17:54:19 -------- d-----w- c:\program files\DVDFab 8 Qt
2012-11-30 13:00:11 -------- d-----w- c:\program files\GeoGebra
2012-11-30 12:58:51 -------- d-----w- c:\users\Xxx\appdata\roaming\mathegrafix
.
==================== Find3M ====================
.
2012-12-11 19:30:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-11 19:30:18 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-11 14:28:23 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-11-15 18:38:07 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-11-14 02:09:22 1800704 ----a-w- c:\windows\system32\jscript9.dll
2012-11-14 01:58:15 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-14 01:57:37 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-11-14 01:49:25 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-11-14 01:48:27 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-11-14 01:44:42 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-09 04:42:49 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-02 05:11:31 376832 ----a-w- c:\windows\system32\dpnet.dll
2012-10-16 21:43:38 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-16 07:39:52 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-11 12:46:04 627288 ----a-w- c:\windows\system32\drivers\SkyNET.sys
2012-10-10 20:15:04 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15:00 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14:50 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14:50 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14:46 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14:44 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14:42 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14:28 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14:22 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14:22 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14:16 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14:16 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-09 17:40:31 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 17:40:31 193536 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-10-08 18:43:22 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-10-08 18:43:22 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-10-04 20:53:42 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-10-04 16:47:18 169984 ----a-w- c:\windows\system32\winsrv.dll
2012-10-04 16:43:05 293376 ----a-w- c:\windows\system32\KernelBase.dll
2012-10-04 14:57:58 271360 ----a-w- c:\windows\system32\conhost.exe
2012-10-04 14:41:50 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-04 14:41:50 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-04 14:41:50 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-04 14:41:50 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-10-03 16:58:30 1293680 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 16:42:26 52224 ----a-w- c:\windows\system32\nlaapi.dll
2012-10-03 16:42:26 242176 ----a-w- c:\windows\system32\nlasvc.dll
2012-10-03 16:42:24 18944 ----a-w- c:\windows\system32\netevent.dll
2012-10-03 16:42:24 175104 ----a-w- c:\windows\system32\netcorehc.dll
2012-10-03 16:42:23 156672 ----a-w- c:\windows\system32\ncsi.dll
2012-10-03 16:40:35 499712 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 15:21:38 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-10-02 19:29:42 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-10-02 19:29:41 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-10-02 19:29:41 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-10-02 19:29:41 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-10-02 19:29:22 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-10-02 19:28:53 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-10-02 12:15:52 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-09-25 22:47:43 78336 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 21:16:36 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2003-08-16 00:57:36 270406 ----a-w- c:\program files\DVD Shrink 3.0 Beta 5.exe
.
============= FINISH: 20:18:38,23 ===============
und Code:
ATTFilter . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 04.10.2012 22:09:48 System Uptime: 22.12.2012 20:14:01 (0 hours ago) . Motherboard: ASUSTeK Computer INC. | | P5B-E Processor: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz | Socket 775 | 2128/266mhz . ==== Disk Partitions ========================= . A: is Removable B: is FIXED (NTFS) - 640 GiB total, 153,263 GiB free. C: is FIXED (NTFS) - 109 GiB total, 78,767 GiB free. D: is FIXED (NTFS) - 1397 GiB total, 128,196 GiB free. E: is FIXED (NTFS) - 932 GiB total, 463,276 GiB free. G: is FIXED (NTFS) - 10 GiB total, 5,732 GiB free. H: is FIXED (NTFS) - 1863 GiB total, 486,361 GiB free. I: is FIXED (NTFS) - 59 GiB total, 1,412 GiB free. X: is CDROM (CDFS) . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP53: 18.11.2012 10:31:51 - Windows Update RP54: 27.11.2012 21:43:15 - Windows Update RP55: 05.12.2012 15:47:54 - Geplanter Prüfpunkt RP483: 10.12.2012 23:30:17 - Windows Update RP56: 12.12.2012 21:35:27 - Windows Update RP57: 20.12.2012 20:38:29 - Windows Update RP58: 21.12.2012 22:26:03 - OTL Restore Point - 21.12.2012 22:25:53 RP59: 22.12.2012 18:46:50 - OTL Restore Point - 22.12.2012 18:46:49 . ==== Installed Programs ====================== . Adobe Flash Player 11 Plugin Adobe Photoshop 7.0 Adobe Photoshop Elements 8.0 Adobe Reader X (10.1.4) - Deutsch Attansic L1 Gigabit Ethernet Driver Avira Free Antivirus Brother MFL-Pro Suite DCP-7045N CloneCD Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition druckstdu.de Designer 1.6.9 DVDFab 8.2.2.2 (23/11/2012) Qt EASEUS Partition Master 9.1.1 Home Edition EasyBCD 2.2 Exifer GeoGebra Java 7 Update 9 Java Auto Updater Logitech GamePanel Software 3.04.143 Malwarebytes Anti-Malware Version 1.65.1.1000 Maniac Mansion Deluxe MathType 5 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (German) 2010 Microsoft Office Excel MUI (German) 2010 Microsoft Office Home and Student 2010 Microsoft Office OneNote MUI (German) 2010 Microsoft Office Outlook MUI (German) 2010 Microsoft Office PowerPoint MUI (German) 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (German) 2010 Microsoft Office Proof (Italian) 2010 Microsoft Office Proofing (German) 2010 Microsoft Office Publisher MUI (German) 2010 Microsoft Office Shared MUI (German) 2010 Microsoft Office Single Image 2010 Microsoft Office Word MUI (German) 2010 Microsoft Silverlight Microsoft Sync Framework 2.0 Core Components (x86) ENU Microsoft Sync Framework 2.0 Provider Services (x86) ENU Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Mozilla Firefox 17.0.1 (x86 de) Mozilla Maintenance Service Mp3tag v2.52 MPC-HC 1.6.4.6052 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 7 Premium neroxml NVIDIA 3D Vision Controller-Treiber 306.23 NVIDIA 3D Vision Treiber 306.97 NVIDIA Grafiktreiber 306.97 NVIDIA Install Application NVIDIA PhysX NVIDIA PhysX-Systemsoftware 9.12.0604 NVIDIA Stereoscopic 3D Driver NVIDIA Systemsteuerung 306.97 NVIDIA Update 1.10.8 NVIDIA Update Components OpenOffice.org 3.4.1 pdfsam Personal Backup 5.4 Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition Spyware Terminator 2012 SyncToy 2.1 (x86) TV-Browser 3.2 UBitMenuDE Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition VLC media player 2.0.3 Winamp Winamp Erkennungs-Plug-in Wondershare PDF Password Remover (Build 1.3.0) . ==== End Of File =========================== |
|
22.12.2012, 21:30
| #6 | ||
| /// TB-Ausbilder | Google-Treffer-Problem Schritt 1: Deinstalliere SpywareTerminator Schritt 2: Scan mit Combofix
__________________ --> Google-Treffer-Problem |
|
23.12.2012, 10:42
| #7 |
| | Google-Treffer-Problem Hier mein combofix.txt: Code:
ATTFilter ComboFix 12-12-22.02 - Xxx 23.12.2012 10:20:11.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3007.1999 [GMT 1:00]
ausgeführt von:: c:\users\Xxx\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-11-23 bis 2012-12-23 ))))))))))))))))))))))))))))))
.
.
2012-12-22 11:33 . 2011-06-21 10:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2012-12-22 09:48 . 2012-12-22 09:48 -------- d-----w- c:\users\Xxx\AppData\Roaming\Malwarebytes
2012-12-22 09:48 . 2012-12-22 09:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-12-22 09:48 . 2012-12-22 09:48 -------- d-----w- c:\programdata\Malwarebytes
2012-12-22 09:48 . 2012-09-29 18:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-20 19:38 . 2012-12-16 14:13 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-20 19:38 . 2012-12-16 14:13 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-18 02:19 . 2012-12-18 02:33 -------- d-----w- c:\users\Xxx\AppData\Local\Microsoft Games
2012-12-17 20:44 . 2012-12-17 20:44 -------- d-----w- c:\program files\Exifer
2012-12-12 20:27 . 2012-11-22 02:56 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-12-10 20:25 . 2012-12-10 21:58 -------- d-----w- c:\program files\druckstdu.de
2012-12-07 22:11 . 2012-12-07 22:11 -------- d-----w- c:\program files\LucasFan Games
2012-12-07 20:48 . 2012-12-07 20:48 -------- d-----w- c:\users\Xxx\AppData\Roaming\DVDFab
2012-12-05 22:08 . 2012-12-05 22:08 -------- d-----w- c:\users\Xxx\AppData\Roaming\Media Player Classic
2012-12-05 22:07 . 2012-12-05 22:07 -------- d-----w- c:\program files\MPC-HC
2012-11-30 18:05 . 2012-11-30 18:05 -------- d-----w- C:\ISO
2012-11-30 17:59 . 2012-11-30 17:59 -------- d-----w- c:\programdata\dvdfab
2012-11-30 17:58 . 2012-11-30 18:00 -------- d-----w- C:\Temp
2012-11-30 17:54 . 2012-11-30 18:00 -------- d-----w- C:\Log
2012-11-30 17:54 . 2012-11-30 17:54 -------- d-----w- c:\users\Xxx\AppData\Roaming\NVIDIA
2012-11-30 17:54 . 2012-11-30 17:54 -------- d-----w- c:\program files\DVDFab 8 Qt
2012-11-30 13:00 . 2012-11-30 13:00 -------- d-----w- c:\program files\GeoGebra
2012-11-30 12:58 . 2012-11-30 12:58 -------- d-----w- c:\users\Xxx\AppData\Roaming\mathegrafix
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-11 19:30 . 2012-10-04 21:09 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-11 19:30 . 2012-10-04 21:09 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-11 14:28 . 2012-10-04 21:07 83944 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-12-11 14:28 . 2012-10-04 21:07 134336 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-11-15 18:38 . 2012-10-04 21:07 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-10-16 21:43 . 2012-10-16 21:43 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-16 07:39 . 2012-11-27 18:22 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-11 12:46 . 2010-05-10 07:09 627288 ----a-w- c:\windows\system32\drivers\SkyNET.sys
2012-10-10 20:15 . 2012-10-10 20:15 1867112 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-10-10 20:15 . 2012-10-10 20:15 2574696 ----a-w- c:\windows\system32\nvcuvid.dll
2012-10-10 20:14 . 2012-10-04 20:24 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-10-10 20:14 . 2012-10-04 20:24 12501352 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-10-10 20:14 . 2012-10-10 20:14 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-10-10 20:14 . 2012-10-04 20:24 2428776 ----a-w- c:\windows\system32\nvapi.dll
2012-10-10 20:14 . 2012-10-10 20:14 7697768 ----a-w- c:\windows\system32\nvcuda.dll
2012-10-10 20:14 . 2012-10-10 20:14 10837352 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-10-10 20:14 . 2012-10-10 20:14 19906920 ----a-w- c:\windows\system32\nvoglv32.dll
2012-10-10 20:14 . 2012-10-04 20:24 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-10-10 20:14 . 2012-10-10 20:14 6127464 ----a-w- c:\windows\system32\nvopencl.dll
2012-10-10 20:14 . 2012-10-04 20:24 15309160 ----a-w- c:\windows\system32\nvd3dum.dll
2012-10-09 17:40 . 2012-11-16 18:09 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-16 18:09 193536 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-10-08 18:43 . 2012-10-08 18:43 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-10-08 18:43 . 2012-10-08 18:43 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-10-05 18:39 . 2012-10-05 18:39 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-10-05 18:39 . 2012-10-05 18:39 161792 ----a-w- c:\windows\system32\msls31.dll
2012-10-05 18:39 . 2012-10-05 18:39 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-10-05 18:39 . 2012-10-05 18:39 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-10-05 18:39 . 2012-10-05 18:39 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-10-05 18:39 . 2012-10-05 18:39 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-10-05 18:39 . 2012-10-05 18:39 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-10-05 18:39 . 2012-10-05 18:39 367104 ----a-w- c:\windows\system32\html.iec
2012-10-05 18:39 . 2012-10-05 18:39 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-10-05 18:39 . 2012-10-05 18:39 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-10-05 18:39 . 2012-10-05 18:39 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-10-05 18:39 . 2012-10-05 18:39 152064 ----a-w- c:\windows\system32\wextract.exe
2012-10-05 18:39 . 2012-10-05 18:39 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-10-05 18:39 . 2012-10-05 18:39 11776 ----a-w- c:\windows\system32\mshta.exe
2012-10-05 18:39 . 2012-10-05 18:39 101888 ----a-w- c:\windows\system32\admparse.dll
2012-10-04 20:53 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-10-03 16:58 . 2012-11-16 18:09 1293680 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 16:42 . 2012-11-16 18:09 52224 ----a-w- c:\windows\system32\nlaapi.dll
2012-10-03 16:42 . 2012-11-16 18:09 242176 ----a-w- c:\windows\system32\nlasvc.dll
2012-10-03 16:42 . 2012-11-16 18:09 18944 ----a-w- c:\windows\system32\netevent.dll
2012-10-03 16:42 . 2012-11-16 18:09 175104 ----a-w- c:\windows\system32\netcorehc.dll
2012-10-03 16:42 . 2012-11-16 18:09 156672 ----a-w- c:\windows\system32\ncsi.dll
2012-10-03 16:40 . 2012-11-16 18:09 499712 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 15:21 . 2012-11-16 18:09 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-10-02 19:29 . 2012-10-04 20:24 645992 ----a-w- c:\windows\system32\nvvsvc.exe
2012-10-02 19:29 . 2012-10-04 20:24 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-10-02 19:29 . 2012-10-04 20:24 2557288 ----a-w- c:\windows\system32\nvsvcr.dll
2012-10-02 19:29 . 2012-10-04 20:24 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-10-02 19:29 . 2012-10-04 20:24 2853224 ----a-w- c:\windows\system32\nvsvc.dll
2012-10-02 19:28 . 2012-10-04 20:24 3965288 ----a-w- c:\windows\system32\nvcpl.dll
2012-10-02 12:15 . 2012-10-02 12:15 430952 ----a-w- c:\windows\system32\nvStreaming.exe
2012-09-25 22:47 . 2012-11-16 18:09 78336 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 21:16 . 2012-10-08 18:43 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2003-08-16 00:57 . 2012-10-07 11:11 270406 ----a-w- c:\program files\DVD Shrink 3.0 Beta 5.exe
2012-12-07 11:27 . 2012-12-07 11:27 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-12-11 384800]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"CloneCDElbyCDFL"="c:\program files\Elaborate Bytes\CloneCD\ElbyCheck.exe" [2002-11-02 45056]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-02-18 357448]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-02-18 3203144]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-10-7 110592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x86.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [x]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup REG_MULTI_SZ GPSvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-04 19:30]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Xxx\AppData\Roaming\Mozilla\Firefox\Profiles\l4ouc8my.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://web.de/
FF - ExtSQL: 2012-12-02 21:37; toolbar@web.de; c:\users\Xxx\AppData\Roaming\Mozilla\Firefox\Profiles\l4ouc8my.default\extensions\toolbar@web.de.xpi
FF - ExtSQL: 2012-12-08 13:52; {DDC359D1-844A-42a7-9AA1-88A850A938A8}; c:\users\Xxx\AppData\Roaming\Mozilla\Firefox\Profiles\l4ouc8my.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-vProt - c:\program files\AVG Secure Search\vprot.exe
HKLM-Run-ROC_roc_ssl_v12 - c:\program files\AVG Secure Search\ROC_roc_ssl_v12.exe
AddRemove-Adobe Photoshop 7.0 - c:\windows\ISUN0407.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-12-23 10:32:45
ComboFix-quarantined-files.txt 2012-12-23 09:32
.
Vor Suchlauf: 11 Verzeichnis(se), 84.035.747.840 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 83.948.466.176 Bytes frei
.
- - End Of File - - 4E35F508D5B369E452D4680762B1B400
|
|
23.12.2012, 11:17
| #8 |
| /// TB-Ausbilder | Google-Treffer-Problem Bevor es weiter geht: Hast du noch das Problem?
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 13:43
| #9 |
| | Google-Treffer-Problem Ja, das Problem ist noch da. Frage am Rande: kannst du sageb, ob das gefährlich für das System ist oder ob da was ausgespäht wurde? |
|
23.12.2012, 13:58
| #10 |
| /// TB-Ausbilder | Google-Treffer-Problem Das weiß man leider nie so genau. Zum Eingrenzen: Seit wann hast du das Problem ungefähr? Customscan mit OTL
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 16:03
| #11 |
| | Google-Treffer-Problem hier OTL.txt: Code:
ATTFilter OTL logfile created on: 23.12.2012 15:48:59 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Xxx\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,94 Gb Total Physical Memory | 2,21 Gb Available Physical Memory | 75,09% Memory free 5,87 Gb Paging File | 5,14 Gb Available in Paging File | 87,56% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 109,38 Gb Total Space | 78,25 Gb Free Space | 71,54% Space Free | Partition Type: NTFS Drive D: | 1397,26 Gb Total Space | 128,20 Gb Free Space | 9,17% Space Free | Partition Type: NTFS Drive E: | 931,51 Gb Total Space | 463,28 Gb Free Space | 49,73% Space Free | Partition Type: NTFS Drive G: | 9,86 Gb Total Space | 5,73 Gb Free Space | 58,14% Space Free | Partition Type: NTFS Drive H: | 1863,01 Gb Total Space | 486,36 Gb Free Space | 26,11% Space Free | Partition Type: NTFS Drive I: | 58,92 Gb Total Space | 1,41 Gb Free Space | 2,40% Space Free | Partition Type: NTFS Unable to calculate disk information. Computer Name: XXX | User Name: Xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Xxx\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe () PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Logitech\GamePanel Software\LGDevAgt.exe (Logitech Inc.) PRC - C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Windows\System32\PrintIsolationHost.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (vToolbarUpdater13.2.0) -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe () SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (AdobeActiveFileMonitor8.0) -- C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (catchme) -- C:\Users\Xxx\AppData\Local\Temp\catchme.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies) DRV - (SKYNET) -- C:\Windows\System32\drivers\SkyNET.sys (TechniSat Digital, S.A.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (epmntdrv) -- C:\Windows\System32\epmntdrv.sys () DRV - (EuGdiDrv) -- C:\Windows\System32\EuGdiDrv.sys () DRV - (LGVirHid) -- C:\Windows\System32\drivers\LGVirHid.sys (Logitech Inc.) DRV - (LGBusEnum) -- C:\Windows\System32\drivers\LGBusEnum.sys (Logitech Inc.) DRV - (AtcL001) -- C:\Windows\System32\drivers\l160x86.sys (Atheros Communications, Inc.) DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys () DRV - (AsIO) -- C:\Windows\System32\drivers\AsIO.sys () DRV - (ElbyCDFL) -- C:\Windows\System32\drivers\ElbyCDFL.sys (Elaborate Bytes AG) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 56 74 EA 8A 18 A7 CD 01 [binary data] IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2986282668-171375975-58925643-1003\..\SearchScopes,DefaultScope = ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://web.de/" FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.3.4.1 FF - prefs.js..extensions.enabledAddons: %7Bdc572301-7619-498c-a57d-39143191b318%7D:0.4.0.3.1 FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.1 FF - prefs.js..extensions.enabledAddons: %7Bc50ca3c4-5656-43c2-a061-13e717f73fc8%7D:4.2.4 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.07 12:27:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.07 12:27:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.07 12:27:47 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.07 12:27:43 | 000,000,000 | ---D | M] [2012.10.04 22:02:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Extensions [2012.12.15 18:20:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Firefox\Profiles\l4ouc8my.default\extensions [2012.12.02 21:37:50 | 000,566,966 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\toolbar@web.de.xpi [2012.12.09 17:44:28 | 000,347,581 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2012.12.15 18:20:43 | 000,316,317 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi [2012.11.25 16:01:25 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.11.30 13:59:10 | 000,710,866 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012.12.08 13:52:57 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.12.02 21:37:53 | 000,002,273 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\englische-ergebnisse.xml [2012.12.02 21:37:53 | 000,010,563 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\gmx-suche.xml [2012.12.02 21:37:53 | 000,002,432 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\lastminute.xml [2012.12.02 21:37:53 | 000,005,545 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\webde-suche.xml [2012.12.07 12:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.12.07 12:27:47 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll [2012.11.02 09:12:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.11.02 09:12:26 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.11.02 09:12:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.11.02 09:12:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.11.02 09:12:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.11.02 09:12:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.12.23 10:29:37 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CloneCDElbyCDFL] C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe (Elaborate Bytes AG) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4 - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKU\S-1-5-21-2986282668-171375975-58925643-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-2986282668-171375975-58925643-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2986282668-171375975-58925643-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-2986282668-171375975-58925643-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7B9F1D5D-50DF-4CF7-8F33-5CB646D4F9B7}: DhcpNameServer = 0.0.0.0 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D75BEE7C-FAF2-453E-9A79-54EA6940B384}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - I:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {60702D8B-5E32-B289-79CA-87872305474F} - Microsoft Windows Media Player 12.0 ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.12.23 10:32:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012.12.23 10:32:48 | 000,000,000 | ---D | C] -- C:\Windows\temp [2012.12.23 10:32:48 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\temp [2012.12.23 10:19:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012.12.23 10:19:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012.12.23 10:19:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012.12.23 10:14:51 | 000,000,000 | ---D | C] -- C:\Qoobox [2012.12.23 10:14:44 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2012.12.23 10:10:44 | 005,012,898 | R--- | C] (Swearware) -- C:\Users\Xxx\Desktop\ComboFix.exe [2012.12.22 20:12:25 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Xxx\Desktop\dds.com [2012.12.22 20:12:11 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Xxx\Desktop\TFC.exe [2012.12.22 12:12:39 | 000,937,224 | ---- | C] (Crawler.com ) -- C:\Users\Xxx\Desktop\SpywareTerminator30074Setup.exe [2012.12.22 10:48:26 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Malwarebytes [2012.12.22 10:48:17 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.22 10:47:53 | 010,669,952 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Xxx\Desktop\mbam-setup-1.65.1.1000.exe [2012.12.21 21:49:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe [2012.12.21 21:47:47 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Xxx\Desktop\tdsskiller.exe [2012.12.18 03:19:09 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\Microsoft Games [2012.12.17 21:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exifer [2012.12.17 21:44:50 | 000,000,000 | ---D | C] -- C:\Program Files\Exifer [2012.12.12 21:37:33 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.12.12 21:37:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.12.12 21:37:32 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.12.12 21:37:31 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.12.12 21:37:31 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.12.12 21:37:30 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.12.12 21:37:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.12.12 21:37:28 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.12.12 21:27:50 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.12.12 21:27:47 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe [2012.12.12 21:27:47 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2012.12.12 21:27:46 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll [2012.12.12 21:27:46 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll [2012.12.12 21:27:46 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll [2012.12.12 21:27:46 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll [2012.12.12 21:27:42 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll [2012.12.12 21:27:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2012.12.11 13:20:49 | 000,000,000 | ---D | C] -- g:\Eigene Dateien\DVDFab Passkey [2012.12.11 09:54:54 | 000,000,000 | ---D | C] -- g:\Eigene Dateien\Eigene Projekte bei druckstdu [2012.12.10 22:58:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\druckstdu.de [2012.12.10 21:25:25 | 000,000,000 | ---D | C] -- C:\Program Files\druckstdu.de [2012.12.10 20:13:35 | 000,000,000 | ---D | C] -- C:\Users\Xxx\Desktop\Sabine [2012.12.07 23:12:16 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maniac Mansion Deluxe [2012.12.07 23:12:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maniac Mansion Deluxe [2012.12.07 23:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\LucasFan Games [2012.12.07 21:48:56 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\DVDFab [2012.12.07 12:27:43 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.12.05 23:08:37 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Media Player Classic [2012.12.05 23:07:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC [2012.12.05 23:07:57 | 000,000,000 | ---D | C] -- C:\Program Files\MPC-HC [2012.11.30 19:05:57 | 000,000,000 | ---D | C] -- C:\ISO [2012.11.30 18:59:07 | 000,000,000 | ---D | C] -- C:\ProgramData\dvdfab [2012.11.30 18:58:23 | 000,000,000 | ---D | C] -- C:\Temp [2012.11.30 18:54:28 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\NVIDIA [2012.11.30 18:54:28 | 000,000,000 | ---D | C] -- C:\Log [2012.11.30 18:54:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8 Qt [2012.11.30 18:54:19 | 000,000,000 | ---D | C] -- C:\Program Files\DVDFab 8 Qt [2012.11.30 14:00:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoGebra [2012.11.30 14:00:11 | 000,000,000 | ---D | C] -- C:\Program Files\GeoGebra [2012.11.30 13:58:51 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\mathegrafix [2012.10.07 12:11:19 | 000,270,406 | ---- | C] (DVD Shrink) -- C:\Program Files\DVD Shrink 3.0 Beta 5.exe ========== Files - Modified Within 30 Days ========== [2012.12.23 15:38:44 | 000,014,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 15:38:44 | 000,014,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 15:38:26 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.23 15:38:26 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.23 15:38:26 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.23 15:38:26 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.23 15:31:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.23 15:31:22 | 2364,940,288 | -HS- | M] () -- C:\hiberfil.sys [2012.12.23 10:30:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.23 10:29:37 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2012.12.23 10:10:56 | 005,012,898 | R--- | M] (Swearware) -- C:\Users\Xxx\Desktop\ComboFix.exe [2012.12.22 20:12:26 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Xxx\Desktop\dds.com [2012.12.22 20:12:13 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Xxx\Desktop\TFC.exe [2012.12.22 20:12:02 | 000,547,175 | ---- | M] () -- C:\Users\Xxx\Desktop\adwcleaner.exe [2012.12.22 12:12:39 | 000,937,224 | ---- | M] (Crawler.com ) -- C:\Users\Xxx\Desktop\SpywareTerminator30074Setup.exe [2012.12.22 10:48:18 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.22 10:47:56 | 010,669,952 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Xxx\Desktop\mbam-setup-1.65.1.1000.exe [2012.12.21 21:49:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe [2012.12.21 21:47:47 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Xxx\Desktop\tdsskiller.exe [2012.12.21 06:19:38 | 000,425,671 | ---- | M] () -- C:\Users\Xxx\Desktop\Weihnachtsbild.jpg [2012.12.21 06:17:46 | 000,620,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.12.17 21:44:50 | 000,000,888 | ---- | M] () -- C:\Users\Xxx\Desktop\Exifer.lnk [2012.12.11 15:28:23 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys [2012.12.11 15:28:23 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys [2012.12.11 13:22:01 | 000,000,336 | ---- | M] () -- C:\Users\Xxx\Desktop\BR-Laufwerk (X).lnk [2012.12.09 17:44:02 | 001,422,466 | ---- | M] () -- C:\Users\Xxx\Desktop\Ritterburg.mp4 [2012.12.05 16:12:56 | 000,220,298 | ---- | M] () -- C:\Users\Xxx\Desktop\Baustelle.jpg [2012.11.30 18:54:24 | 000,000,973 | ---- | M] () -- C:\Users\Xxx\Desktop\DVDFab 8 Qt.lnk [2012.11.30 17:17:20 | 000,050,277 | ---- | M] () -- C:\Users\Xxx\Desktop\Terminplan CSG.pdf [2012.11.30 14:00:13 | 000,001,778 | ---- | M] () -- C:\Users\Public\Desktop\GeoGebra.lnk ========== Files Created - No Company Name ========== [2012.12.23 10:19:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012.12.23 10:19:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012.12.23 10:19:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012.12.23 10:19:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012.12.23 10:19:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.12.22 20:12:02 | 000,547,175 | ---- | C] () -- C:\Users\Xxx\Desktop\adwcleaner.exe [2012.12.22 12:33:39 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2012.12.22 10:48:18 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 06:19:38 | 000,425,671 | ---- | C] () -- C:\Users\Xxx\Desktop\Weihnachtsbild.jpg [2012.12.17 21:44:50 | 000,000,888 | ---- | C] () -- C:\Users\Xxx\Desktop\Exifer.lnk [2012.12.11 13:22:01 | 000,000,336 | ---- | C] () -- C:\Users\Xxx\Desktop\BR-Laufwerk (X).lnk [2012.12.09 17:44:02 | 001,422,466 | ---- | C] () -- C:\Users\Xxx\Desktop\Ritterburg.mp4 [2012.12.05 16:05:34 | 000,220,298 | ---- | C] () -- C:\Users\Xxx\Desktop\Baustelle.jpg [2012.11.30 18:54:24 | 000,000,973 | ---- | C] () -- C:\Users\Xxx\Desktop\DVDFab 8 Qt.lnk [2012.11.30 17:17:20 | 000,050,277 | ---- | C] () -- C:\Users\Xxx\Desktop\Terminplan CSG.pdf [2012.11.30 14:00:13 | 000,001,778 | ---- | C] () -- C:\Users\Public\Desktop\GeoGebra.lnk [2012.10.08 18:44:00 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll [2012.10.08 18:43:59 | 002,469,760 | ---- | C] () -- C:\Windows\System32\BootMan.exe [2012.10.08 18:43:59 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe [2012.10.08 18:43:59 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys [2012.10.08 18:43:59 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys [2012.10.05 21:35:35 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2012.10.05 21:35:34 | 000,000,065 | ---- | C] () -- C:\Windows\System32\BD7045N.DAT [2012.10.05 21:34:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL [2012.10.05 21:34:54 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI [2012.10.05 18:41:35 | 000,024,576 | ---- | C] () -- C:\Windows\System32\AsIO.dll [2012.10.05 18:41:35 | 000,012,400 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys [2012.10.04 21:20:44 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.10.07 12:13:10 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Design Science [2012.12.07 21:48:56 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\DVDFab [2012.10.09 23:15:59 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\FastCopy [2012.11.30 13:58:51 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\mathegrafix [2012.10.08 20:33:03 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Mp3tag [2012.10.07 12:05:50 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\OpenOffice.org [2012.12.16 11:40:03 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\PersBackup5 [2012.12.18 21:34:31 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\TV-Browser [2012.10.04 22:57:47 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\UBitMenu ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012.12.23 10:32:53 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2012.10.31 23:28:12 | 000,000,000 | ---D | M] -- C:\Boot [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2012.10.04 21:20:44 | 000,000,000 | ---D | M] -- C:\Intel [2012.11.30 19:05:57 | 000,000,000 | ---D | M] -- C:\ISO [2012.11.30 19:00:47 | 000,000,000 | ---D | M] -- C:\Log [2012.10.04 22:22:01 | 000,000,000 | R--D | M] -- C:\MSOCache [2012.10.10 11:49:35 | 000,000,000 | ---D | M] -- C:\NST [2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.12.23 10:10:20 | 000,000,000 | R--D | M] -- C:\Program Files [2012.12.23 10:10:20 | 000,000,000 | ---D | M] -- C:\ProgramData [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\Programme [2012.12.23 10:32:50 | 000,000,000 | ---D | M] -- C:\Qoobox [2012.10.04 21:09:47 | 000,000,000 | ---D | M] -- C:\Recovery [2012.10.11 18:38:25 | 000,000,000 | ---D | M] -- C:\SharePoint-Entwürfe [2012.12.23 15:50:14 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.11.30 19:00:49 | 000,000,000 | ---D | M] -- C:\Temp [2012.10.04 21:25:24 | 000,000,000 | R--D | M] -- C:\Users [2012.12.23 10:32:48 | 000,000,000 | ---D | M] -- C:\Windows < %SYSTEMDRIVE%\*.* > [2012.12.22 20:13:15 | 000,005,341 | ---- | M] () -- C:\AdwCleaner[S1].txt [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2012.10.10 11:49:41 | 000,000,345 | RHS- | M] () -- C:\boot.ini [2004.08.04 13:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin [2012.10.30 09:47:14 | 000,383,786 | RHS- | M] () -- C:\bootmgr [2012.12.23 10:32:46 | 000,012,919 | ---- | M] () -- C:\ComboFix.txt [2009.06.10 22:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys [2012.12.23 15:31:22 | 2364,940,288 | -HS- | M] () -- C:\hiberfil.sys [2012.10.10 11:39:23 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2012.10.10 13:39:41 | 000,118,904 | ---- | M] () -- C:\metal.jpg [2012.10.10 11:39:23 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2012.10.10 11:49:41 | 000,047,772 | RHS- | M] () -- C:\NTDETECT.COM [2008.04.13 23:01:56 | 000,251,712 | RHS- | M] () -- C:\ntldr [2012.12.23 15:31:23 | 3153,256,448 | -HS- | M] () -- C:\pagefile.sys [2012.12.21 21:48:15 | 000,257,784 | ---- | M] () -- C:\TDSSKiller.2.8.15.0_21.12.2012_21.47.55_log.txt < %PROGRAMFILES%\*.* > [2009.07.14 05:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini [2003.08.16 01:57:36 | 000,270,406 | ---- | M] (DVD Shrink) -- C:\Program Files\DVD Shrink 3.0 Beta 5.exe Invalid Environment Variable: PROGRAMFILES(X86) < %appdata%\*. > [2012.10.20 14:29:39 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Adobe [2012.10.10 07:13:28 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Ahead [2012.10.04 22:12:57 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Avira [2012.10.07 12:13:10 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Design Science [2012.11.30 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\DVD Shrink 3.0 [2012.11.08 10:53:06 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\dvdcss [2012.12.07 21:48:56 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\DVDFab [2012.10.09 23:15:59 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\FastCopy [2012.10.04 21:10:10 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Identities [2012.10.05 21:34:36 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\InstallShield [2012.10.04 22:10:02 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Macromedia [2012.12.22 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Malwarebytes [2012.11.30 13:58:51 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\mathegrafix [2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Media Center Programs [2012.12.05 23:08:37 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Media Player Classic [2012.10.11 15:09:04 | 000,000,000 | --SD | M] -- C:\Users\Xxx\AppData\Roaming\Microsoft [2012.10.04 22:02:31 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Mozilla [2012.10.08 20:33:03 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Mp3tag [2012.11.30 18:54:28 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\NVIDIA [2012.10.07 12:05:50 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\OpenOffice.org [2012.12.16 11:40:03 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\PersBackup5 [2012.12.18 21:34:31 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\TV-Browser [2012.10.04 22:57:47 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\UBitMenu [2012.12.18 09:03:39 | 000,000,000 | -H-D | M] -- C:\Users\Xxx\AppData\Roaming\vlc [2012.10.04 22:49:34 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Winamp < %appdata%\*.* > < %localappdata%\*. > [2012.10.12 19:02:28 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Adobe [2012.10.08 21:23:17 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Ahead [2012.10.04 21:10:01 | 000,000,000 | -HSD | M] -- C:\Users\Xxx\AppData\Local\Anwendungsdaten [2012.12.08 08:47:49 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Diagnostics [2012.10.20 13:15:54 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Logitech [2012.10.04 22:10:02 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Macromedia [2012.12.17 21:31:12 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Microsoft [2012.12.18 03:33:25 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Microsoft Games [2012.10.10 07:30:36 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Microsoft Help [2012.10.04 22:02:27 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\Mozilla [2012.10.09 18:12:29 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\NeoSmart_Technologies [2012.12.23 15:48:39 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\temp [2012.10.04 21:10:01 | 000,000,000 | -HSD | M] -- C:\Users\Xxx\AppData\Local\Temporary Internet Files [2012.10.04 21:10:01 | 000,000,000 | -HSD | M] -- C:\Users\Xxx\AppData\Local\Verlauf [2012.10.08 20:25:37 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Local\VirtualStore < %localappdata%\*.* > [2012.12.10 21:25:45 | 000,137,488 | ---- | M] () -- C:\Users\Xxx\AppData\Local\GDIPFONTCACHEV1.DAT [2012.12.23 14:03:39 | 004,875,487 | -H-- | M] () -- C:\Users\Xxx\AppData\Local\IconCache.db < %allusersprofile%\*. > [2012.11.13 14:43:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe [2012.10.08 21:16:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Ahead [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2012.10.04 22:07:06 | 000,000,000 | ---D | M] -- C:\ProgramData\Avira [2012.11.06 17:10:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Battle.net [2012.11.18 10:22:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Blizzard Entertainment [2012.10.05 21:34:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Brother [2012.10.11 13:51:46 | 000,000,000 | ---D | M] -- C:\ProgramData\CMUV [2012.10.16 22:43:35 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente [2012.11.30 18:59:07 | 000,000,000 | ---D | M] -- C:\ProgramData\dvdfab [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2012.10.16 19:53:36 | 000,000,000 | -H-D | M] -- C:\ProgramData\FLEXnet [2012.10.20 13:15:39 | 000,000,000 | ---D | M] -- C:\ProgramData\Logitech [2012.12.22 10:48:17 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes [2012.10.11 15:09:04 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft [2012.12.12 21:38:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help [2012.10.04 22:02:19 | 000,000,000 | ---D | M] -- C:\ProgramData\Mozilla [2012.10.08 21:14:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Nero [2012.12.23 15:31:28 | 000,000,000 | ---D | M] -- C:\ProgramData\NVIDIA [2012.10.04 21:24:32 | 000,000,000 | ---D | M] -- C:\ProgramData\NVIDIA Corporation [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü [2012.10.08 19:43:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\Sun [2012.10.08 18:32:47 | 000,000,000 | ---D | M] -- C:\ProgramData\Synology [2012.10.11 13:50:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Technisat [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2012.10.04 21:09:47 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen < %allusersprofile%\*.* > < > [2009.07.14 05:53:46 | 000,032,630 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2009.07.14 05:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2012.10.04 22:09:29 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job < End of report > Code:
ATTFilter OTL Extras logfile created on: 23.12.2012 15:48:59 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Xxx\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,94 Gb Total Physical Memory | 2,21 Gb Available Physical Memory | 75,09% Memory free
5,87 Gb Paging File | 5,14 Gb Available in Paging File | 87,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 109,38 Gb Total Space | 78,25 Gb Free Space | 71,54% Space Free | Partition Type: NTFS
Drive D: | 1397,26 Gb Total Space | 128,20 Gb Free Space | 9,17% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 463,28 Gb Free Space | 49,73% Space Free | Partition Type: NTFS
Drive G: | 9,86 Gb Total Space | 5,73 Gb Free Space | 58,14% Space Free | Partition Type: NTFS
Drive H: | 1863,01 Gb Total Space | 486,36 Gb Free Space | 26,11% Space Free | Partition Type: NTFS
Drive I: | 58,92 Gb Total Space | 1,41 Gb Free Space | 2,40% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Computer Name: XXX | User Name: Xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{260ECEF8-52FE-4CE4-83FA-467B97E894FC}" = rport=138 | protocol=17 | dir=out | app=system |
"{41A0709A-827F-4025-B57D-74BB2F9950FA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{545EACDB-DBC3-4B6B-897F-6DD43827A346}" = rport=139 | protocol=6 | dir=out | app=system |
"{559E74D7-9B52-4217-9A92-5C21E5F0F7D9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{659B67BA-4FA0-4DC1-8823-8ED1ECFC184B}" = rport=445 | protocol=6 | dir=out | app=system |
"{7E9A995B-DEEB-4201-87A1-16D85605DFF7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{84CD4A86-27B2-4C35-9B92-7F44F1D5C95F}" = lport=445 | protocol=6 | dir=in | app=system |
"{8A2C4E55-0506-4F1A-957D-59CD2398C685}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8DAB3CCD-E003-4445-84D1-F1D7FFDC50B2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8E0E4018-0DB3-489C-9A74-A022139A8C5B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ABBADDA1-F2ED-4660-985D-BAB53B1067C8}" = rport=137 | protocol=17 | dir=out | app=system |
"{B0474B44-05B5-4757-9CF5-B9E18873FC66}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B82868D5-A801-4322-AC5F-E69E5C02280F}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B8D885D1-F707-4A94-8A43-878A0D7535F1}" = lport=139 | protocol=6 | dir=in | app=system |
"{C1F587F0-AED2-4BA5-B0FB-0874C516C39D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C6152428-57E2-44D9-A445-F03F6E77893C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D99AEA42-00B3-41B9-9A84-F96240CE15AF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DAF53D5E-15A0-422E-8D7F-6C951724DD0B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DBFD28BB-8052-413D-BE88-BB75E07155EB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EB6F6967-6F63-4E66-988F-FA80CB196702}" = lport=138 | protocol=17 | dir=in | app=system |
"{EE8D16DC-15AA-46B0-AF5A-AA65AE6B60FB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F1B44D30-2543-41C2-BAE5-4E0DEAA9E962}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FD5131B6-D822-4E61-9D1D-5544548D5440}" = lport=137 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{19796979-1808-43DB-9B89-9320BEFADBBA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{31EE915A-503B-4AE2-8DA2-E3CB579EF921}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{331CE90D-5850-4B1F-9978-68F835FF82F5}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{4EAEE201-599C-4A4B-A876-F39181903BCC}" = protocol=17 | dir=in | app=c:\program files\tv-browser\tvbrowser_nodd.exe |
"{5A2F64AA-9801-4449-B914-B910C9E88939}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5B6CDA8C-E0FE-4D11-B257-033ECD8EE054}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5D64DB2B-F68C-4111-AF60-6E408548E813}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6BDE143B-10F2-41EB-B38E-54BC2C6BE088}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{71DAFC11-BB9E-43F0-B8C5-CABD4FAB3B0A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{72021E8C-6E99-485F-AE3D-3027F95ABB83}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{734FE830-5927-4BF1-B1C9-CADCFB0FAFFD}" = protocol=6 | dir=out | app=system |
"{80BBD45E-DB51-433F-9F7C-C630D3F416E4}" = protocol=6 | dir=in | app=c:\program files\tv-browser\tvbrowser_nodd.exe |
"{96CEEA04-C5B3-473D-A2F1-07D4394AC1FD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A02DFE4C-6965-4AB8-B580-4C51DAD967C7}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{AFA82716-CA98-43A0-B7DE-C3208F270DCA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B7176462-52C7-4BF3-BD5D-213FB5E2E6CD}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{C1107AFA-4F09-400B-8581-048D026475DC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D02EABCC-219E-4002-B381-B4BE5B898167}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D87F70C5-EAA3-454C-8006-9FB8467511D0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DA608886-664D-4EC7-8AC0-746C9C2A6F5E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{E407F026-8824-4A0D-863F-EDA8279B416D}" = protocol=17 | dir=in | app=c:\program files\tv-browser\tvbrowser.exe |
"{E5422EBC-023F-41A7-9BF8-0E3D7A1DCA8C}" = protocol=6 | dir=in | app=c:\program files\tv-browser\tvbrowser.exe |
"{E759D9F3-F553-44F7-89BC-B4D5F66EE3A4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FEB7DCAB-AD02-4E9E-BA39-2FAF60695CA2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{2165B3DD-AFEA-4CD2-B281-B9F8779EB888}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{78542CE7-F2B5-416C-8177-8010FF71E7E9}C:\users\Xxx\desktop\dsassistant_1920\win\dsassistant.exe" = protocol=6 | dir=in | app=c:\users\Xxx\desktop\dsassistant_1920\win\dsassistant.exe |
"TCP Query User{943F4162-5872-42B4-AFFC-AB43B3B68AEE}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{A84A81F1-72BB-4A81-8C4E-5DE1F2870A12}I:\program files\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=i:\program files\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{1B4C0DC6-C1E8-4899-93E3-9E0207C0157B}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"UDP Query User{7C8E696C-9BC7-409F-B0C2-D24E179402BA}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{84BE70BB-F338-41BA-8BF4-54E4428CAA65}C:\users\Xxx\desktop\dsassistant_1920\win\dsassistant.exe" = protocol=17 | dir=in | app=c:\users\Xxx\desktop\dsassistant_1920\win\dsassistant.exe |
"UDP Query User{93F511FF-F405-48BD-AADE-EFF271973B63}I:\program files\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=i:\program files\starcraft ii\versions\base23260\sc2.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{109945A8-D8D5-48B8-B4A5-195D3F99B56D}" = Logitech GamePanel Software 3.04.143
"{1719FAD6-2F6A-4F5E-BF2B-1F6F6F1E3806_PasswordRemover}_is1" = Wondershare PDF Password Remover (Build 1.3.0)
"{17DFE37C-064E-4834-AD8F-A4B2B4DF68F8}" = Adobe Photoshop Elements 8.0
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = MPC-HC 1.6.4.6052
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite DCP-7045N
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{6E19F210-3813-4002-B561-94D66AA182B6}" = Attansic L1 Gigabit Ethernet Driver
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{98EFD8F0-08DE-48DB-B922-A2EBAB711031}" = Nero 7 Premium
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A066194B-DC8F-449A-8E0F-B57BDD3A2072}" = SyncToy 2.1 (x86)
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1" = UBitMenuDE
"{D3A80508-CD83-4CA3-8671-914A1BC78B61}" = Microsoft Sync Framework 2.0 Provider Services (x86) ENU
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF63121D-91C6-42CC-B341-F1AA729728E7}" = Microsoft Sync Framework 2.0 Core Components (x86) ENU
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 8.0" = Adobe Photoshop Elements 8.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"CloneCD" = CloneCD
"druckstdu.de Designer 1.6.9_is1" = druckstdu.de Designer 1.6.9
"DSMT5" = MathType 5
"DVDFab 8 Qt_is1" = DVDFab 8.2.2.2 (23/11/2012) Qt
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.1 Home Edition
"EasyBCD" = EasyBCD 2.2
"Exifer_is1" = Exifer
"GeoGebra" = GeoGebra
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Maniac Mansion Deluxe" = Maniac Mansion Deluxe
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.52
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"pdfsam" = pdfsam
"Personal Backup 5_is1" = Personal Backup 5.4
"tvbrowser" = TV-Browser 3.2
"VLC media player" = VLC media player 2.0.3
"Winamp" = Winamp
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 16.12.2012 07:36:24 | Computer Name = Xxx | Source = Application Hang | ID = 1002
Description = Programm Persbackup.exe, Version 5.4.2.1 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: e4c Startzeit:
01cddb7ebfd5d00b Endzeit: 16 Anwendungspfad: C:\Program Files\Personal Backup 5\Persbackup.exe
Berichts-ID:
Error - 17.12.2012 17:52:50 | Computer Name = Xxx | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2012/12/17 22:52:50.687]: [00000360]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 17.12.2012 18:23:02 | Computer Name = Xxx | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2012/12/17 23:23:02.671]: [00000360]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 17.12.2012 22:08:19 | Computer Name = Xxx | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: druckstdu.exe, Version: 2.0.0.3,
Zeitstempel: 0x4f15946b Name des fehlerhaften Moduls: druckstdu.exe, Version: 2.0.0.3,
Zeitstempel: 0x4f15946b Ausnahmecode: 0xc0000005 Fehleroffset: 0x001bc899 ID des fehlerhaften
Prozesses: 0x550 Startzeit der fehlerhaften Anwendung: 0x01cddc91ddbe8bdc Pfad der
fehlerhaften Anwendung: C:\Program Files\druckstdu.de\druckstdu.exe Pfad des fehlerhaften
Moduls: C:\Program Files\druckstdu.de\druckstdu.exe Berichtskennung: ca328a1b-48b7-11e2-8107-0018f3649394
Error - 22.12.2012 13:12:01 | Computer Name = Xxx | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199,
Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: winamp.exe, Version: 5.6.2.3199,
Zeitstempel: 0x4ee2440b Ausnahmecode: 0xc0000005 Fehleroffset: 0x0004029b ID des fehlerhaften
Prozesses: 0xbb4 Startzeit der fehlerhaften Anwendung: 0x01cde0676c690782 Pfad der
fehlerhaften Anwendung: C:\Program Files\Winamp\winamp.exe Pfad des fehlerhaften
Moduls: C:\Program Files\Winamp\winamp.exe Berichtskennung: b2bf2ac4-4c5a-11e2-9447-0018f3649394
Error - 22.12.2012 14:13:38 | Computer Name = Xxx | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2012/12/22 19:13:38.888]: [00000288]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 22.12.2012 14:13:49 | Computer Name = Xxx | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2012/12/22 19:13:49.749]: [00000288]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 22.12.2012 14:13:50 | Computer Name = Xxx | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2012/12/22 19:13:50.763]: [00000288]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 22.12.2012 14:13:51 | Computer Name = Xxx | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2012/12/22 19:13:51.777]: [00000288]: CUsbScnDev: DeviceIoControl()
failed. ErrorCode = 5
Error - 23.12.2012 05:24:45 | Computer Name = Xxx | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PEV.exe, Version: 0.0.0.0, Zeitstempel:
0x4e06cfe8 Name des fehlerhaften Moduls: PEV.exe, Version: 0.0.0.0, Zeitstempel:
0x4e06cfe8 Ausnahmecode: 0x40000015 Fehleroffset: 0x0008d1c0 ID des fehlerhaften Prozesses:
0xe4c Startzeit der fehlerhaften Anwendung: 0x01cde0ef58025e54 Pfad der fehlerhaften
Anwendung: C:\ComboFix\PEV.exe Pfad des fehlerhaften Moduls: C:\ComboFix\PEV.exe
Berichtskennung:
966af5ea-4ce2-11e2-916d-0018f3649394
[ System Events ]
Error - 18.12.2012 16:34:37 | Computer Name = Xxx | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
Error - 18.12.2012 16:34:38 | Computer Name = Xxx | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
Error - 18.12.2012 16:34:39 | Computer Name = Xxx | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
Error - 18.12.2012 16:34:39 | Computer Name = Xxx | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
Error - 18.12.2012 16:41:42 | Computer Name = Xxx | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR6 gefunden.
Error - 22.12.2012 15:15:42 | Computer Name = Xxx | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 22.12.2012 15:16:05 | Computer Name = Xxx | Source = Service Control Manager | ID = 7034
Description = Dienst "Spyware Terminator 2012 Realtime Shield Service" wurde unerwartet
beendet. Dies ist bereits 1 Mal passiert.
Error - 23.12.2012 05:19:58 | Computer Name = Xxx | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 23.12.2012 05:22:27 | Computer Name = Xxx | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 23.12.2012 05:29:43 | Computer Name = Xxx | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
< End of report >
|
|
23.12.2012, 16:11
| #12 | |
| /// TB-Ausbilder | Google-Treffer-Problem Fix mit OTL
Immer noch Probleme?
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 20:57
| #13 |
| | Google-Treffer-Problem Die Google Probleme sind noch da. Ich weiß ja nicht, aber normal ist doch nicht, dass nach ca. 1 sec. auf der google-Treffer-Seite plözlich neue Treffer wie: worddictionary.co.uk/; premiumdatingclub.com/; premium-dating-club.com/; topbrandgifts.com/; ... unter den ersten fünf auftauchen, oder?!? Was hat eigentlicg OTL jetzt gemacht, mein TabMixPlus ist z.B. nicht mehr da. die OTL.txt Datei: Code:
ATTFilter All processes killed
========== OTL ==========
Service vToolbarUpdater13.2.0 stopped successfully!
Service vToolbarUpdater13.2.0 deleted successfully!
C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe moved successfully.
Prefs.js: %7Bc50ca3c4-5656-43c2-a061-13e717f73fc8%7D:4.2.4 removed from extensions.enabledAddons
C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi moved successfully.
========== FILES ==========
C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0 folder moved successfully.
C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater folder moved successfully.
C:\Programme\Common Files\AVG Secure Search folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Xxx
->Temp folder emptied: 31813 bytes
->Temporary Internet Files folder emptied: 531038 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 103769811 bytes
->Flash cache emptied: 1190 bytes
User: Public
->Temp folder emptied: 0 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5708 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 100,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 12232012_204907
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
23.12.2012, 21:06
| #14 |
| /// TB-Ausbilder | Google-Treffer-Problem Natürlich ist das nicht normal. Ich brauche jetzt nochmal ein Kontroll-Logfile und muss mir das nochmal genau ansehen: Kontrollscan mit OTL
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
23.12.2012, 23:04
| #15 |
| | Google-Treffer-Problem Hier das OTL.txt-file: Code:
ATTFilter OTL logfile created on: 23.12.2012 23:00:12 - Run 5 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Xxx\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,94 Gb Total Physical Memory | 2,19 Gb Available Physical Memory | 74,54% Memory free 5,87 Gb Paging File | 5,10 Gb Available in Paging File | 86,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 109,38 Gb Total Space | 79,34 Gb Free Space | 72,54% Space Free | Partition Type: NTFS Drive D: | 1397,26 Gb Total Space | 128,20 Gb Free Space | 9,17% Space Free | Partition Type: NTFS Drive E: | 931,51 Gb Total Space | 463,28 Gb Free Space | 49,73% Space Free | Partition Type: NTFS Drive F: | 14,92 Gb Total Space | 8,66 Gb Free Space | 58,05% Space Free | Partition Type: FAT32 Drive G: | 9,86 Gb Total Space | 5,73 Gb Free Space | 58,14% Space Free | Partition Type: NTFS Drive H: | 1863,01 Gb Total Space | 486,36 Gb Free Space | 26,11% Space Free | Partition Type: NTFS Drive I: | 58,92 Gb Total Space | 1,41 Gb Free Space | 2,40% Space Free | Partition Type: NTFS Unable to calculate disk information. Computer Name: XXX | User Name: Xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Xxx\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Logitech\GamePanel Software\LGDevAgt.exe (Logitech Inc.) PRC - C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.) PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) ========== Modules (No Company Name) ========== MOD - C:\Programme\Brother\BrUtilities\BrLogAPI.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (AdobeActiveFileMonitor8.0) -- C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (catchme) -- C:\Users\Xxx\AppData\Local\Temp\catchme.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies) DRV - (SKYNET) -- C:\Windows\System32\drivers\SkyNET.sys (TechniSat Digital, S.A.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (epmntdrv) -- C:\Windows\System32\epmntdrv.sys () DRV - (EuGdiDrv) -- C:\Windows\System32\EuGdiDrv.sys () DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (LGVirHid) -- C:\Windows\System32\drivers\LGVirHid.sys (Logitech Inc.) DRV - (LGBusEnum) -- C:\Windows\System32\drivers\LGBusEnum.sys (Logitech Inc.) DRV - (AtcL001) -- C:\Windows\System32\drivers\l160x86.sys (Atheros Communications, Inc.) DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys () DRV - (AsIO) -- C:\Windows\System32\drivers\AsIO.sys () DRV - (ElbyCDFL) -- C:\Windows\System32\drivers\ElbyCDFL.sys (Elaborate Bytes AG) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 56 74 EA 8A 18 A7 CD 01 [binary data] IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-2986282668-171375975-58925643-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2986282668-171375975-58925643-1003\..\SearchScopes,DefaultScope = ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://web.de/" FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.3.4.1 FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.1 FF - prefs.js..extensions.enabledAddons: %7Bc50ca3c4-5656-43c2-a061-13e717f73fc8%7D:4.2.4 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.07 12:27:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.07 12:27:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.07 12:27:47 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.12.07 12:27:43 | 000,000,000 | ---D | M] [2012.10.04 22:02:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Extensions [2012.12.23 20:49:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Firefox\Profiles\l4ouc8my.default\extensions [2012.12.02 21:37:50 | 000,566,966 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\toolbar@web.de.xpi [2012.12.09 17:44:28 | 000,347,581 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2012.12.15 18:20:43 | 000,316,317 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi [2012.11.25 16:01:25 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.12.08 13:52:57 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.12.23 20:51:07 | 000,000,911 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\11-suche.xml [2012.12.02 21:37:53 | 000,002,273 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\englische-ergebnisse.xml [2012.12.02 21:37:53 | 000,010,563 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\gmx-suche.xml [2012.12.02 21:37:53 | 000,002,432 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\lastminute.xml [2012.12.02 21:37:53 | 000,005,545 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mozilla\firefox\profiles\l4ouc8my.default\searchplugins\webde-suche.xml [2012.12.07 12:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.12.07 12:27:47 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll [2012.11.02 09:12:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.11.02 09:12:26 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.11.02 09:12:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.11.02 09:12:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.11.02 09:12:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.11.02 09:12:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.12.23 10:29:37 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CloneCDElbyCDFL] C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe (Elaborate Bytes AG) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4 - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKU\S-1-5-21-2986282668-171375975-58925643-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-2986282668-171375975-58925643-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2986282668-171375975-58925643-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2986282668-171375975-58925643-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-2986282668-171375975-58925643-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7B9F1D5D-50DF-4CF7-8F33-5CB646D4F9B7}: DhcpNameServer = 0.0.0.0 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D75BEE7C-FAF2-453E-9A79-54EA6940B384}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - I:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.12.23 20:49:07 | 000,000,000 | ---D | C] -- C:\_OTL [2012.12.23 10:32:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012.12.23 10:32:48 | 000,000,000 | ---D | C] -- C:\Windows\temp [2012.12.23 10:32:48 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\temp [2012.12.23 10:19:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012.12.23 10:19:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012.12.23 10:19:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012.12.23 10:14:51 | 000,000,000 | ---D | C] -- C:\Qoobox [2012.12.23 10:14:44 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2012.12.23 10:10:44 | 005,012,898 | R--- | C] (Swearware) -- C:\Users\Xxx\Desktop\ComboFix.exe [2012.12.22 20:12:25 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Xxx\Desktop\dds.com [2012.12.22 20:12:11 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Xxx\Desktop\TFC.exe [2012.12.22 12:12:39 | 000,937,224 | ---- | C] (Crawler.com ) -- C:\Users\Xxx\Desktop\SpywareTerminator30074Setup.exe [2012.12.22 10:48:26 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Malwarebytes [2012.12.22 10:48:17 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.12.22 10:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.22 10:47:53 | 010,669,952 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Xxx\Desktop\mbam-setup-1.65.1.1000.exe [2012.12.21 21:49:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe [2012.12.21 21:47:47 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Xxx\Desktop\tdsskiller.exe [2012.12.18 03:19:09 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\Microsoft Games [2012.12.17 21:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exifer [2012.12.17 21:44:50 | 000,000,000 | ---D | C] -- C:\Program Files\Exifer [2012.12.11 13:20:49 | 000,000,000 | ---D | C] -- g:\Eigene Dateien\DVDFab Passkey [2012.12.11 09:54:54 | 000,000,000 | ---D | C] -- g:\Eigene Dateien\Eigene Projekte bei druckstdu [2012.12.10 22:58:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\druckstdu.de [2012.12.10 21:25:25 | 000,000,000 | ---D | C] -- C:\Program Files\druckstdu.de [2012.12.10 20:13:35 | 000,000,000 | ---D | C] -- C:\Users\Xxx\Desktop\Sabine [2012.12.07 23:12:16 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maniac Mansion Deluxe [2012.12.07 23:12:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maniac Mansion Deluxe [2012.12.07 23:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\LucasFan Games [2012.12.07 21:48:56 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\DVDFab [2012.12.07 12:27:43 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.12.05 23:08:37 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Media Player Classic [2012.12.05 23:07:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC [2012.12.05 23:07:57 | 000,000,000 | ---D | C] -- C:\Program Files\MPC-HC [2012.11.30 19:05:57 | 000,000,000 | ---D | C] -- C:\ISO [2012.11.30 18:59:07 | 000,000,000 | ---D | C] -- C:\ProgramData\dvdfab [2012.11.30 18:58:23 | 000,000,000 | ---D | C] -- C:\Temp [2012.11.30 18:54:28 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\NVIDIA [2012.11.30 18:54:28 | 000,000,000 | ---D | C] -- C:\Log [2012.11.30 18:54:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8 Qt [2012.11.30 18:54:19 | 000,000,000 | ---D | C] -- C:\Program Files\DVDFab 8 Qt [2012.11.30 14:00:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoGebra [2012.11.30 14:00:11 | 000,000,000 | ---D | C] -- C:\Program Files\GeoGebra [2012.11.30 13:58:51 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\mathegrafix [2012.10.07 12:11:19 | 000,270,406 | ---- | C] (DVD Shrink) -- C:\Program Files\DVD Shrink 3.0 Beta 5.exe ========== Files - Modified Within 30 Days ========== [2012.12.23 22:56:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.23 22:56:46 | 2364,940,288 | -HS- | M] () -- C:\hiberfil.sys [2012.12.23 20:57:24 | 000,014,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 20:57:24 | 000,014,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.23 20:54:25 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.23 20:54:25 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.23 20:54:25 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.23 20:54:25 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.23 16:08:53 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.12.23 10:30:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.23 10:29:37 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2012.12.23 10:10:56 | 005,012,898 | R--- | M] (Swearware) -- C:\Users\Xxx\Desktop\ComboFix.exe [2012.12.22 20:12:26 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Xxx\Desktop\dds.com [2012.12.22 20:12:13 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Xxx\Desktop\TFC.exe [2012.12.22 20:12:02 | 000,547,175 | ---- | M] () -- C:\Users\Xxx\Desktop\adwcleaner.exe [2012.12.22 12:12:39 | 000,937,224 | ---- | M] (Crawler.com ) -- C:\Users\Xxx\Desktop\SpywareTerminator30074Setup.exe [2012.12.22 10:48:18 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.22 10:47:56 | 010,669,952 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Xxx\Desktop\mbam-setup-1.65.1.1000.exe [2012.12.21 21:49:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Xxx\Desktop\OTL.exe [2012.12.21 21:47:47 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Xxx\Desktop\tdsskiller.exe [2012.12.21 06:19:38 | 000,425,671 | ---- | M] () -- C:\Users\Xxx\Desktop\Weihnachtsbild.jpg [2012.12.21 06:17:46 | 000,620,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.12.17 21:44:50 | 000,000,888 | ---- | M] () -- C:\Users\Xxx\Desktop\Exifer.lnk [2012.12.11 15:28:23 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys [2012.12.11 15:28:23 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys [2012.12.11 13:22:01 | 000,000,336 | ---- | M] () -- C:\Users\Xxx\Desktop\BR-Laufwerk (X).lnk [2012.12.09 17:44:02 | 001,422,466 | ---- | M] () -- C:\Users\Xxx\Desktop\Ritterburg.mp4 [2012.12.05 16:12:56 | 000,220,298 | ---- | M] () -- C:\Users\Xxx\Desktop\Baustelle.jpg [2012.11.30 18:54:24 | 000,000,973 | ---- | M] () -- C:\Users\Xxx\Desktop\DVDFab 8 Qt.lnk [2012.11.30 17:17:20 | 000,050,277 | ---- | M] () -- C:\Users\Xxx\Desktop\Terminplan CSG.pdf [2012.11.30 14:00:13 | 000,001,778 | ---- | M] () -- C:\Users\Public\Desktop\GeoGebra.lnk ========== Files Created - No Company Name ========== [2012.12.23 16:08:53 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.12.23 10:19:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012.12.23 10:19:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012.12.23 10:19:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012.12.23 10:19:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012.12.23 10:19:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.12.22 20:12:02 | 000,547,175 | ---- | C] () -- C:\Users\Xxx\Desktop\adwcleaner.exe [2012.12.22 12:33:39 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2012.12.22 10:48:18 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.21 06:19:38 | 000,425,671 | ---- | C] () -- C:\Users\Xxx\Desktop\Weihnachtsbild.jpg [2012.12.17 21:44:50 | 000,000,888 | ---- | C] () -- C:\Users\Xxx\Desktop\Exifer.lnk [2012.12.11 13:22:01 | 000,000,336 | ---- | C] () -- C:\Users\Xxx\Desktop\BR-Laufwerk (X).lnk [2012.12.09 17:44:02 | 001,422,466 | ---- | C] () -- C:\Users\Xxx\Desktop\Ritterburg.mp4 [2012.12.05 16:05:34 | 000,220,298 | ---- | C] () -- C:\Users\Xxx\Desktop\Baustelle.jpg [2012.11.30 18:54:24 | 000,000,973 | ---- | C] () -- C:\Users\Xxx\Desktop\DVDFab 8 Qt.lnk [2012.11.30 17:17:20 | 000,050,277 | ---- | C] () -- C:\Users\Xxx\Desktop\Terminplan CSG.pdf [2012.11.30 14:00:13 | 000,001,778 | ---- | C] () -- C:\Users\Public\Desktop\GeoGebra.lnk [2012.10.08 18:44:00 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll [2012.10.08 18:43:59 | 002,469,760 | ---- | C] () -- C:\Windows\System32\BootMan.exe [2012.10.08 18:43:59 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe [2012.10.08 18:43:59 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys [2012.10.08 18:43:59 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys [2012.10.05 21:35:35 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2012.10.05 21:35:34 | 000,000,065 | ---- | C] () -- C:\Windows\System32\BD7045N.DAT [2012.10.05 21:34:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL [2012.10.05 21:34:54 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI [2012.10.05 18:41:35 | 000,024,576 | ---- | C] () -- C:\Windows\System32\AsIO.dll [2012.10.05 18:41:35 | 000,012,400 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys [2012.10.04 21:20:44 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.10.07 12:13:10 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Design Science [2012.12.07 21:48:56 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\DVDFab [2012.10.09 23:15:59 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\FastCopy [2012.11.30 13:58:51 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\mathegrafix [2012.10.08 20:33:03 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Mp3tag [2012.10.07 12:05:50 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\OpenOffice.org [2012.12.16 11:40:03 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\PersBackup5 [2012.12.18 21:34:31 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\TV-Browser [2012.10.04 22:57:47 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\UBitMenu ========== Purity Check ========== < End of report > |
|
| Themen zu Google-Treffer-Problem |
| gesuch, gesuchte, googel, googeln, plötzlich, treffer |
Textbox.
Linear-Darstellung
