| |
| |||||||
Log-Analyse und Auswertung: Versteckte Viren/Trojaner?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
19.01.2013, 12:35
| #1 |
| |  Versteckte Viren/Trojaner? Guten Tag, ich habe mir am 15.01.2013 eine Erweiterung für "Rocket Dock" heruntergeladen (Digital_Clock_V1.3: hxxp://ge.tt/api/1/files/3Yyz6NV/0/blob?download) Als ich den Ordner entzippt habe, hat Avira AntiVir Free Personal 3 Funde gemeldet: Code:
ATTFilter Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 15. Januar 2013 16:29
Es wird nach 4668153 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ******-PC
Versionsinformationen:
BUILD.DAT : 12.1.9.1236 40872 Bytes 11.10.2012 15:29:00
AVSCAN.EXE : 12.3.0.48 468256 Bytes 14.11.2012 14:43:23
AVSCAN.DLL : 12.3.0.15 66256 Bytes 02.05.2012 00:02:50
LUKE.DLL : 12.3.0.15 68304 Bytes 01.05.2012 23:31:47
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 01.05.2012 22:13:36
AVREG.DLL : 12.3.0.17 232200 Bytes 02.07.2012 11:07:12
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 23:22:12
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 23:31:36
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 09:58:50
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 10:43:53
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 11:06:36
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 07:46:40
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 14:44:02
VBASE008.VDF : 7.11.55.142 2214912 Bytes 03.01.2013 14:00:28
VBASE009.VDF : 7.11.55.143 2048 Bytes 03.01.2013 14:00:28
VBASE010.VDF : 7.11.55.144 2048 Bytes 03.01.2013 14:00:28
VBASE011.VDF : 7.11.55.145 2048 Bytes 03.01.2013 14:00:28
VBASE012.VDF : 7.11.55.146 2048 Bytes 03.01.2013 14:00:28
VBASE013.VDF : 7.11.55.196 260096 Bytes 04.01.2013 14:00:30
VBASE014.VDF : 7.11.56.23 206848 Bytes 07.01.2013 14:00:43
VBASE015.VDF : 7.11.56.83 186880 Bytes 08.01.2013 14:50:37
VBASE016.VDF : 7.11.56.145 135168 Bytes 09.01.2013 14:50:51
VBASE017.VDF : 7.11.56.211 139776 Bytes 11.01.2013 14:50:40
VBASE018.VDF : 7.11.57.11 153088 Bytes 13.01.2013 14:50:36
VBASE019.VDF : 7.11.57.75 165888 Bytes 15.01.2013 14:50:36
VBASE020.VDF : 7.11.57.76 2048 Bytes 15.01.2013 14:50:36
VBASE021.VDF : 7.11.57.77 2048 Bytes 15.01.2013 14:50:36
VBASE022.VDF : 7.11.57.78 2048 Bytes 15.01.2013 14:50:36
VBASE023.VDF : 7.11.57.79 2048 Bytes 15.01.2013 14:50:36
VBASE024.VDF : 7.11.57.80 2048 Bytes 15.01.2013 14:50:36
VBASE025.VDF : 7.11.57.81 2048 Bytes 15.01.2013 14:50:36
VBASE026.VDF : 7.11.57.82 2048 Bytes 15.01.2013 14:50:36
VBASE027.VDF : 7.11.57.83 2048 Bytes 15.01.2013 14:50:36
VBASE028.VDF : 7.11.57.84 2048 Bytes 15.01.2013 14:50:36
VBASE029.VDF : 7.11.57.85 2048 Bytes 15.01.2013 14:50:36
VBASE030.VDF : 7.11.57.86 2048 Bytes 15.01.2013 14:50:36
VBASE031.VDF : 7.11.57.94 11776 Bytes 15.01.2013 14:50:36
Engineversion : 8.2.10.230
AEVDF.DLL : 8.1.2.10 102772 Bytes 10.07.2012 11:00:57
AESCRIPT.DLL : 8.1.4.80 467322 Bytes 10.01.2013 14:51:02
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 17:05:37
AESBX.DLL : 8.2.5.12 606578 Bytes 02.07.2012 11:07:11
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 14:51:02
AEPACK.DLL : 8.3.1.2 819574 Bytes 27.12.2012 20:14:08
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 06.11.2012 21:11:35
AEHEUR.DLL : 8.1.4.174 5615991 Bytes 10.01.2013 14:51:00
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 15:43:47
AEGEN.DLL : 8.1.6.14 434548 Bytes 10.01.2013 14:50:53
AEEXP.DLL : 8.3.0.8 188788 Bytes 12.01.2013 14:50:47
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 11:00:50
AECORE.DLL : 8.1.30.0 201079 Bytes 13.12.2012 17:05:34
AEBB.DLL : 8.1.1.4 53619 Bytes 06.11.2012 21:11:27
AVWINLL.DLL : 12.3.0.15 27344 Bytes 01.05.2012 22:59:21
AVPREF.DLL : 12.3.0.32 50720 Bytes 14.11.2012 14:43:22
AVREP.DLL : 12.3.0.15 179208 Bytes 01.05.2012 22:13:35
AVARKT.DLL : 12.3.0.33 209696 Bytes 14.11.2012 14:43:20
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 01.05.2012 22:28:49
SQLITE3.DLL : 3.7.0.1 398288 Bytes 16.04.2012 21:11:02
AVSMTP.DLL : 12.3.0.32 63480 Bytes 08.08.2012 18:38:23
NETNT.DLL : 12.3.0.15 17104 Bytes 01.05.2012 23:33:29
RCIMAGE.DLL : 12.3.0.31 4444408 Bytes 08.08.2012 18:38:14
RCTEXT.DLL : 12.3.0.32 98848 Bytes 14.11.2012 14:43:18
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_50f5552e\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Beginn des Suchlaufs: Dienstag, 15. Januar 2013 16:29
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'saui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IELowutil.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'APSDaemon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'distnoted.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunes.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlbrowser.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WinList.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'VirtuaWin.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WinExpose.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'XLefty.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'YzShadow.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BcmSqlStartupSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RocketDock.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PMB.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSCKbdHk.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WCScheduler.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'EasySpeedUpManager.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'dmhkcore.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3.exe'
C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3.exe
[FUND] Enthält Erkennungsmuster des Droppers DR/Delphi.Gen
Beginne mit der Suche in 'C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3\Digital_Clock_V1.3.exe'
C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3\Digital_Clock_V1.3.exe
[FUND] Enthält Erkennungsmuster des Droppers DR/Delphi.Gen
Beginne mit der Suche in 'C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3\commont.dll'
C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3\commont.dll
[FUND] Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/DarkKomet.GR
Beginne mit der Desinfektion:
C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3\commont.dll
[FUND] Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/DarkKomet.GR
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3\Digital_Clock_V1.3.exe
[FUND] Enthält Erkennungsmuster des Droppers DR/Delphi.Gen
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\******\Downloads\Digital_Clock_V1.3\Digital_Clock_V1.3.exe
[FUND] Enthält Erkennungsmuster des Droppers DR/Delphi.Gen
[WARNUNG] Die Datei wurde ignoriert.
Ende des Suchlaufs: Dienstag, 15. Januar 2013 16:32
Benötigte Zeit: 00:00 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
36 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
33 Dateien ohne Befall
0 Archive wurden durchsucht
3 Warnungen
0 Hinweise
Die Suchergebnisse werden an den Guard übermittelt.
Als ich am 16.01.2013 dann meinen Rechner hochgefahren habe, war zwischen Ende der Bootgrafik und erscheinen des Anmeldebildschirms ein relativ, für mich unbekannter, langer blackscreen gefolgt von einem "Bitte warten..." anstatt meines Profilbildes und des Feldes zur Passworteingabe. Nach ca. 30-40 Sekunden kam dann endlich das Bild samt Passwortfeld. Ich dachte mir schon, da stimmt etwas nicht. Darüber hinaus wird der Windows Anmeldeton sowie der Ton beim Herunterfahren immer 2mal kurz hintereinander gespielt, was normalerweise nicht so ist und auch noch nie so war. Heute habe ich mal bei Avira Antivir die Berichte angeschaut und komischerweise ist bei dem Bericht dieser 3 Funde keine Datei gelöscht noch in Quarantäne verschoben worden, obwohl ich dies ja befohlen hatte. Ich habe in Folge dessen den .zip Ordner online scannen lassen: https://www.virustotal.com/file/c30ccdf8edea62d76b5c4cd857e6495a11f370c0dfdeb83a384088c7db307cc6/analysis/1358604951/ MD5: 099852b136a015f4b62b85662912a302 SHA1: 88866be2fd792c8a49815230869ab09fdf9c46ef Detect: 40 / 46 Win32/DfInject.BZ (TotalDefense) Trojan.Keylogger.ADY (MicroWorld-eScan) Trojan.Keylogger.ADY (nProtect) Win32.Backdoor.Rbot.hyj.8 (CAT-QuickHeal) BackDoor-EFI (McAfee) Backdoor (K7AntiVirus) Backdoor/Azbreg.tn (TheHacker) Trojan.Win32.Rbot.pojk (NANO-Antivirus) W32/Backdoor2.XVS (F-Prot) Suspicious.BredoLab (Symantec) W32/Rbot.BOI (Norman) TROJ_DELF.SMX (TrendMicro-HouseCall) Win32:Agent-QUZ [Trj] (Avast) Trojan.Mybot-10022 (ClamAV) Backdoor.Win32.Rbot.hyj (Kaspersky) Trojan.Keylogger.ADY (BitDefender) Worm.Rbot.AATS (Agnitum) Backdoor.Win32.Agent.674304.A (ViRobot) Troj/Delf-FFY (Sophos) Backdoor.Win32.Trojan.Rbot.~A (Comodo) Trojan.Keylogger.ADY (F-Secure) Trojan.DownLoader.50961 (DrWeb) Trojan-Dropper.Win32.Agent.xzr (v) (VIPRE) DR/Delphi.Gen (AntiVir) TROJ_DELF.SMX (TrendMicro) Trojan.Keylogger.ADY (B) (Emsisoft) Backdoor/RBot.ibm (Jiangmin) Backdoor/Win32.DarkKomet.gen (Antiy-AVL) VIRUS_UNKNOWN (Kingsoft) TrojanDropper:Win32/Agent.BAD (Microsoft) Trojan.Keylogger.ADY (GData) W32/Backdoor2.XVS (Commtouch) Backdoor/Win32.Graybird (AhnLab-V3) Backdoor.Win32.Rbot.hyj (VBA32) Win32/TrojanDropper.Delf.NJH (ESET-NOD32) Trojan.DL.Win32.Mnless.fhz (Rising) Trojan.Win32.ProcessHijack (Ikarus) W32/Dropper.DB!tr (Fortinet) IRC/BackDoor.SdBot4.SEO (AVG) Trj/Genetic.gen (Panda) Nun bin ich mir sicher, dass mein System infiziert ist. Hier ist der OTL log: Code:
ATTFilter OTL logfile created on: 1/19/2013 9:09:44 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\******\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.97 Gb Total Physical Memory | 2.34 Gb Available Physical Memory | 59.13% Memory free 7.93 Gb Paging File | 5.87 Gb Available in Paging File | 74.05% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 297.44 Gb Total Space | 145.61 Gb Free Space | 48.95% Space Free | Partition Type: NTFS Drive D: | 153.23 Gb Total Space | 103.00 Gb Free Space | 67.22% Space Free | Partition Type: NTFS Computer Name: ******-PC | User Name: ****** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days ========== Processes (SafeList) ========== PRC - C:\Users\******\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\RarmaRadio\RarmaRadio.exe (Raimersoft) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe () PRC - C:\Program Files (x86)\UX Pack\XLefty\XLefty.exe (windows7themes.net) PRC - C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.) PRC - C:\Program Files (x86)\UX Pack\VirtuaWin\VirtuaWin.exe (VirtuaWin) PRC - C:\Program Files (x86)\UX Pack\VirtuaWin\modules\WinList.exe () PRC - C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics) PRC - C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.) PRC - C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC) PRC - C:\Program Files (x86)\UX Pack\WinExpose\WinExpose.exe (Matías Moreno) PRC - C:\Program Files (x86)\UX Pack\YzShadow\YzShadow.exe (Y'z) PRC - C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files (x86)\RarmaRadio\sqlite3.dll () MOD - C:\Program Files (x86)\UX Pack\VirtuaWin\modules\WinList.exe () MOD - C:\Program Files (x86)\UX Pack\YzShadow\Languages\English.lang () MOD - C:\Program Files (x86)\RocketDock\Docklets\DigitalClock\DigitalClockDocklet.dll () MOD - C:\Program Files (x86)\RocketDock\RocketDock.exe () MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll () MOD - C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll () MOD - C:\Program Files (x86)\RocketDock\Docklets\iCal\calendardocklet2.dll () MOD - C:\Program Files (x86)\RocketDock\Docklets\iCal\audioplay.func () MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\1031\nsextint.dll () ========== Services (SafeList) ========== SRV:64bit: - (MsDepSvc) -- C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation) SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (yksvc) -- C:\Windows\SysNative\yk62x64.dll (Marvell) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV:64bit: - (AgereModemAudio) -- C:\Program Files\LSI SoftModem\agr64svc.exe (LSI Corporation) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (McAfee SiteAdvisor Service) -- c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe (McAfee, Inc.) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (SystemExplorerHelpService) -- C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe (Mister Group) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (UnsignedThemes) -- C:\Windows\UnsignedThemesSvc.exe (The Within Network, LLC) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (Rezip) -- C:\Windows\SysWOW64\Rezip.exe () SRV - (BcmSqlStartupSvc) -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (USBTINSP) -- C:\Windows\SysNative\drivers\tinspusb.sys (Texas Instruments) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation) DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys () DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corporation) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (uxpatch) -- C:\Windows\SysNative\drivers\uxpatch.sys () DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (SABI) -- C:\Windows\SysNative\drivers\SABI.sys (SAMSUNG ELECTRONICS) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (VL807) -- C:\Windows\SysNative\drivers\VL807.sys () DRV:64bit: - (GWHid) -- C:\Windows\SysNative\drivers\GWHid.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (NPF_devolo) -- C:\Windows\SysWOW64\drivers\npf_devolo.sys (CACE Technologies) DRV - (VL807) -- C:\Windows\SysWOW64\drivers\VL807.sys () DRV - (GWHid) -- C:\Windows\SysWOW64\drivers\GWHid.sys (Microsoft Corporation) DRV - (StarOpen) -- C:\windows\SysWow64\drivers\StarOpen.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=559e93ae-74e7-41f9-8fef-57d61741d107&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=559e93ae-74e7-41f9-8fef-57d61741d107&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=559e93ae-74e7-41f9-8fef-57d61741d107&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=559e93ae-74e7-41f9-8fef-57d61741d107&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback> IE - HKU\S-1-5-21-691484766-175042921-2864471598-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8888;https=127.0.0.1:8888 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3 FF - prefs.js..extensions.enabledAddons: stealthyextension%40gmail.com:2.4 FF - prefs.js..extensions.enabledAddons: VacuumPlacesImproved%40lultimouomo-gmail.com:1.2 FF - prefs.js..extensions.enabledAddons: youtube2mp3%40mondayx.de:1.2.3 FF - prefs.js..extensions.enabledAddons: %7Bad48108d-92a6-4eb9-87e4-978aca1dbae4%7D:1.2.1 FF - prefs.js..extensions.enabledAddons: %7Bdd05fd3d-18df-4ce4-ae53-e795339c5f01%7D:1.21 FF - prefs.js..extensions.enabledAddons: %7B888d99e7-e8b5-46a3-851e-1ec45da1e644%7D:17.0.0 FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.3 FF - prefs.js..extensions.enabledAddons: toolbar%40web.de:2.4 FF - prefs.js..extensions.enabledAddons: %7B4ED1F68A-5463-4931-9384-8FFF5ED91D92%7D:3.6.0 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0 FF - prefs.js..extensions.enabledItems: helperbar@helperbar.com:1.0 FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: djziggy@gmail.com:1.3.1 FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=mcafee&p=" FF - prefs.js..network.proxy.ftp: "212.119.105.65" FF - prefs.js..network.proxy.ftp_port: 3128 FF - prefs.js..network.proxy.http: "212.119.105.65" FF - prefs.js..network.proxy.http_port: 3128 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "212.119.105.65" FF - prefs.js..network.proxy.socks_port: 3128 FF - prefs.js..network.proxy.ssl: "212.119.105.65" FF - prefs.js..network.proxy.ssl_port: 3128 FF - prefs.js..network.proxy.type: 0 FF - user.js..browser.search.openintab: false FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/11/23 16:42:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2013/01/09 17:34:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/01/11 14:26:23 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2008/02/22 16:24:06 | 000,095,832 | ---- | M] () FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/11/23 16:42:16 | 000,000,000 | ---D | M] [2012/09/12 11:41:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Extensions [2012/12/25 21:24:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com [2013/01/17 18:16:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions [2011/11/02 21:57:16 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2011/11/02 21:57:01 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions\ffxtlbr@babylon.com [2012/09/15 14:43:59 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions\ich@maltegoetz.de [2011/11/08 18:38:35 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions\toolbar@ask.com [2012/09/14 15:39:39 | 000,000,000 | ---D | M] (Download Youtube Videos +) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions\video.downloader.plugin@ffpimp.com [2012/03/27 14:50:47 | 000,000,000 | ---D | M] (vShare) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\pe2qqq6i.default\extensions\vshare@toolbar [2012/11/18 11:25:40 | 000,284,001 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\compatibility@addons.mozilla.org.xpi [2012/11/01 19:01:31 | 000,183,174 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\stealthyextension@gmail.com.xpi [2013/01/17 18:16:09 | 000,538,938 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\toolbar@web.de.xpi [2012/11/23 18:28:22 | 000,024,038 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\VacuumPlacesImproved@lultimouomo-gmail.com.xpi [2012/09/14 15:49:56 | 000,011,510 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\youtube2mp3@mondayx.de.xpi [2013/01/11 13:37:00 | 000,347,812 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011/11/12 15:28:47 | 000,079,681 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}.xpi [2012/12/24 18:14:00 | 000,030,502 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2012/12/11 13:11:51 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012/01/13 15:55:46 | 000,292,116 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{ad48108d-92a6-4eb9-87e4-978aca1dbae4}.xpi [2012/11/23 18:00:02 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011/09/10 15:18:33 | 000,089,388 | ---- | M] () (No name found) -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}.xpi [2013/01/17 18:16:12 | 000,000,911 | ---- | M] () -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\searchplugins\11-suche.xml [2013/01/17 18:16:12 | 000,002,273 | ---- | M] () -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\searchplugins\englische-ergebnisse.xml [2013/01/17 18:16:12 | 000,010,563 | ---- | M] () -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\searchplugins\gmx-suche.xml [2013/01/17 18:16:12 | 000,002,432 | ---- | M] () -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\searchplugins\lastminute.xml [2013/01/17 18:16:12 | 000,005,545 | ---- | M] () -- C:\Users\******\AppData\Roaming\mozilla\firefox\profiles\pe2qqq6i.default\searchplugins\webde-suche.xml [2013/01/11 14:26:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013/01/19 09:11:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\updated\extensions [2013/01/19 09:11:33 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\updated\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013/01/09 17:34:38 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES (X86)\MCAFEE\SITEADVISOR [2013/01/11 14:26:23 | 000,262,704 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012/12/07 14:01:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/12/07 14:01:08 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012/12/07 14:01:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012/12/07 14:01:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012/12/14 13:31:38 | 000,002,027 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\McSiteAdvisor.xml [2012/09/11 22:26:09 | 000,002,515 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml [2012/12/07 14:01:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012/12/07 14:01:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010/04/09 18:09:58 | 000,000,822 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg64.dll (Google Inc.) O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found. O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly Technologies Ltd) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - !{94366e2c-9923-431c-b0d6-747447dd0f2b} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{94366e2c-9923-431c-b0d6-747447dd0f2b} - No CLSID value found. O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-691484766-175042921-2864471598-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-691484766-175042921-2864471598-1000\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll () O3 - HKU\S-1-5-21-691484766-175042921-2864471598-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [UX Launcher] C:\Program Files (x86)\UX Pack\uxlaunch.exe () O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-691484766-175042921-2864471598-1000..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe () O4 - HKU\S-1-5-21-691484766-175042921-2864471598-1000..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe () O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileAssociate = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0 O7 - HKU\S-1-5-21-691484766-175042921-2864471598-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1 O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66073BC5-1DC8-4773-96AF-506A15FBF11F}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9D07C869-74F5-43C7-8DCC-BD925A258217}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll (Bandoo Media, inc) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll (Bandoo Media, inc) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-691484766-175042921-2864471598-1000 Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{9ba59e74-ea80-11df-a983-c0cf58a487a5}\Shell - "" = AutoRun O33 - MountPoints2\{9ba59e74-ea80-11df-a983-c0cf58a487a5}\Shell\AutoRun\command - "" = H:\iStudio.exe O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\iStudio.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 7 Days ========== [2013/01/18 16:24:59 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Local\{9F758A7D-2A12-40A0-8F69-9C33BE5F2BED} [2013/01/16 14:54:02 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Roaming\MyPhoneExplorer [2013/01/16 14:53:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer [2013/01/16 14:53:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPhoneExplorer [2013/01/16 14:51:45 | 000,000,000 | ---D | C] -- C:\Users\******\Local Settings [2013/01/16 14:51:29 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Roaming\Outlook [2013/01/16 14:49:32 | 000,000,000 | ---D | C] -- C:\Users\******\Documents\My Photos [2013/01/16 14:49:32 | 000,000,000 | ---D | C] -- C:\Users\******\Documents\My Documents [2013/01/15 17:02:02 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Local\{4D174D0D-D3A6-43FC-AE4F-B1593A1A6A7F} [2013/01/15 16:49:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Artdocks Software ========== Files - Modified Within 7 Days ========== [2013/01/19 08:59:58 | 000,019,808 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/01/19 08:59:58 | 000,019,808 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/01/19 08:54:02 | 000,001,110 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2013/01/19 08:51:34 | 000,001,106 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2013/01/19 08:50:26 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013/01/19 08:50:13 | 3193,393,152 | -HS- | M] () -- C:\hiberfil.sys [2013/01/17 18:18:22 | 000,281,120 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.xtr [2013/01/17 18:18:22 | 000,281,120 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.exe [2013/01/16 21:13:00 | 000,281,120 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.ex0 [2013/01/16 15:36:16 | 001,820,132 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2013/01/16 15:36:16 | 000,774,988 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2013/01/16 15:36:16 | 000,716,912 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2013/01/16 15:36:16 | 000,182,500 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2013/01/16 15:36:16 | 000,147,520 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2013/01/13 11:20:00 | 000,000,880 | ---- | M] () -- C:\windows\tasks\Google Software Updater.job ========== Files Created - No Company Name ========== [2013/01/03 10:29:24 | 000,000,214 | ---- | C] () -- C:\Users\******\.swfinfo [2012/12/15 16:33:49 | 000,281,120 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe [2012/12/15 16:33:47 | 000,076,888 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe [2012/12/14 14:07:56 | 000,339,968 | ---- | C] ( ) -- C:\windows\SysWow64\Interop.WMPLib.dll [2012/12/14 14:07:56 | 000,061,440 | ---- | C] () -- C:\windows\SysWow64\AxInterop.WMPLib.dll [2012/12/10 18:42:43 | 095,023,320 | ---- | C] () -- C:\ProgramData\0tbpw.pad [2012/12/02 17:15:33 | 000,083,968 | ---- | C] () -- C:\windows\SysWow64\bvcsky.dll [2012/11/05 17:16:36 | 000,000,841 | ---- | C] () -- C:\Users\******\AppData\Local\recently-used.xbel [2012/10/26 16:07:05 | 000,925,184 | ---- | C] () -- C:\windows\expstart.exe [2012/10/23 15:12:49 | 000,000,132 | ---- | C] () -- C:\Users\******\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen [2012/09/14 12:48:19 | 000,157,224 | -H-- | C] () -- C:\windows\SysWow64\mlfcache.dat [2012/09/13 16:31:00 | 000,076,288 | ---- | C] () -- C:\windows\SysWow64\moveex.exe [2012/04/29 09:09:08 | 000,000,094 | ---- | C] () -- C:\Users\******\AppData\Local\fusioncache.dat [2011/09/28 16:44:14 | 000,179,271 | ---- | C] () -- C:\windows\SysWow64\xlive.dll.cat [2011/06/26 11:39:21 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat [2011/02/10 17:04:05 | 000,000,400 | ---- | C] () -- C:\windows\ODBC.INI [2010/12/06 15:11:09 | 000,007,596 | ---- | C] () -- C:\Users\******\AppData\Local\resmon.resmoncfg [2010/10/06 18:42:24 | 000,017,408 | ---- | C] () -- C:\Users\******\AppData\Local\WebpageIcons.db [2009/12/27 20:26:52 | 000,011,264 | ---- | C] () -- C:\Users\******\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/12/25 17:23:18 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009/12/22 18:56:38 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt ========== ZeroAccess Check ========== [2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 06:43:12 | 021,667,328 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011/10/13 16:16:25 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\.minecraft [2013/01/03 10:27:45 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Apowersoft [2012/04/29 20:14:16 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Autodesk [2011/11/02 21:56:53 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Babylon [2012/12/25 23:50:41 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\banshee-1 [2012/12/12 21:31:07 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\CheckPoint [2012/10/22 13:54:50 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2012/11/05 16:45:32 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\CustomBrushesMini [2013/01/05 13:51:24 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Dropbox [2013/01/05 11:34:41 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\DVDVideoSoft [2011/11/02 10:10:44 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\DVDVideoSoftIEHelpers [2010/07/29 16:05:28 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\DynaGeo [2012/09/11 22:26:49 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\FreeFLVConverter [2011/04/23 07:29:50 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\GetRightToGo [2012/12/16 10:06:10 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\GoforFiles [2011/04/01 20:55:44 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\GrabPro [2012/11/05 17:16:32 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\gtk-2.0 [2012/07/18 14:49:15 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Iconoid [2011/04/22 20:52:00 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\IrfanView [2010/03/09 14:53:48 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\jpg-Illuminator [2011/11/20 10:47:18 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Leadertech [2011/11/09 19:27:59 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\LolClient [2012/05/24 16:56:12 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\LolClient2 [2012/02/18 12:15:42 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Media Finder [2010/05/12 15:03:56 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Mount&Blade [2011/08/12 19:46:59 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Mount&Blade Warband [2012/12/27 09:40:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\mp3DirectCut [2012/06/24 08:49:39 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\MusicBrainz [2013/01/16 14:58:38 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\MyPhoneExplorer [2011/05/07 18:11:20 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Need for Speed World [2012/12/27 09:40:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Notepad++ [2009/12/19 20:40:30 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Nvu [2012/07/16 16:03:37 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\OpenCandy [2009/12/20 15:17:47 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\OpenOffice.org [2012/07/31 15:55:59 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Opera [2013/01/18 16:24:17 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Orbit [2013/01/16 14:51:29 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Outlook [2012/10/22 15:29:23 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\PDAppFlex [2012/07/16 16:04:45 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\pdfforge [2011/03/05 18:43:54 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\ProgSense [2012/09/16 15:36:01 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\RaimaRadioPro [2009/12/22 19:22:20 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Samsung [2012/12/27 09:40:39 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Songbird2 [2010/01/17 11:07:14 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\SPORE [2012/10/22 15:53:38 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2012/11/04 19:58:34 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\TeamViewer [2012/10/27 11:50:41 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Texas Instruments [2011/02/24 20:23:15 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\The Creative Assembly [2012/10/27 11:54:08 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\TI-Nspire [2012/06/23 15:05:29 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\TS3Client [2012/07/16 15:05:01 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\TuneUp Software [2012/12/27 09:40:51 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\UPT [2012/07/22 14:42:40 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Webocton - Scriptly [2010/01/24 13:10:33 | 000,000,000 | ---D | M] -- C:\Users\******\AppData\Roaming\Windows SideBar ========== Purity Check ========== < End of report > Für den OTL Extra log war wegen maximaler Zeichennutzung kein Platz mehr. Ich nutze Windows 7 Home Premium 64-bit Version, Intel Core Duo T6500 2.10 Ghz CPU, 4 GB RAM, ATI Mobility Radeon HD 4650. Ich bedanke mich jetzt schonmal für jeden, der mir bei der Lösung dieses Problems hilft. Geändert von HellHour (19.01.2013 um 12:40 Uhr) Grund: Links sind nicht übernommen worden. |
Baum-Darstellung