Guten Abend ihr Helfer,
jetzt hat es auch mich erwischt ich bitte um eure Hilfe.

Also ich fange mal an, ich hatte mir vor ca. 3 Monaten den GVU Trojaner auf mein Rechner eingefangen habe ihn durch eine avira rescue cd entfernt (was ich aber nicht so richtig weiß) ob er richtig runter ist.

Dann wäre da jetzt noch ein Problem mit ad.yieldmanager.com der ständig popups öffnet.
Ich habe versucht ihn selber zu entfernen mit Spyhunter hat aber nicht geklappt.

Hier meine Logfiles von OTL

OTL logfile created on: 31.01.2013 17:29:47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dennis\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

4,00 Gb Total Physical Memory | 2,15 Gb Available Physical Memory | 53,72% Memory free
8,20 Gb Paging File | 6,26 Gb Available in Paging File | 76,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 11,23 Gb Free Space | 11,50% Space Free | Partition Type: NTFS
Drive D: | 368,10 Gb Total Space | 158,66 Gb Free Space | 43,10% Space Free | Partition Type: NTFS
Drive F: | 2,01 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 2,01 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: DENNIS-PC | User Name: Dennis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.01.31 17:26:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dennis\Desktop\OTL.exe
PRC - [2013.01.31 17:23:36 | 000,050,477 | ---- | M] () -- C:\Users\Dennis\Downloads\Defogger.exe
PRC - [2013.01.20 12:05:18 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.01.09 12:43:19 | 001,808,392 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.10.02 12:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.07.02 17:12:50 | 000,021,432 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2012.07.02 17:12:42 | 003,524,536 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2012.07.02 17:12:40 | 000,975,288 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
PRC - [2012.06.16 03:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.9.0.9\ccSvcHst.exe
PRC - [2012.05.23 16:20:18 | 000,364,544 | ---- | M] (Secure Banking) -- C:\Program Files (x86)\Secure Banking\SecureBanking.exe
PRC - [2012.01.30 16:17:44 | 000,001,536 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\sbservice.exe
PRC - [2011.12.27 16:28:01 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.10 10:17:04 | 003,514,176 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2011.09.28 01:37:56 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe
PRC - [2011.03.30 07:01:08 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2010.10.12 13:56:40 | 000,979,328 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
PRC - [2009.05.14 17:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
PRC - [2006.12.19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe


========== Modules (No Company Name) ==========

MOD - [2013.01.31 17:23:36 | 000,050,477 | ---- | M] () -- C:\Users\Dennis\Downloads\Defogger.exe
MOD - [2013.01.20 12:05:18 | 003,022,232 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.01.10 15:34:32 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\5d5b1b0c6e8a714de39a06e3b61f35fe\System.Management.ni.dll
MOD - [2013.01.10 15:31:52 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7f6c86879d27a285cc97c12d59424dd0\System.ServiceProcess.ni.dll
MOD - [2013.01.10 15:31:31 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\07753c0a8ed7f9bc61b0ee718f3c779d\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 15:30:29 | 001,812,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\40c7a89fe2cbf3c12a2c39e034da54cf\System.Xaml.ni.dll
MOD - [2013.01.10 12:30:28 | 018,022,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\b8e60f81fd56934c9f9da7b15bee3376\PresentationFramework.ni.dll
MOD - [2013.01.10 12:30:06 | 011,522,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\932901ff0ad5e365ffbe705d7459a37e\PresentationCore.ni.dll
MOD - [2013.01.10 12:30:00 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\af7e2da8fcdb0d788cea0638e157c54b\System.Windows.Forms.ni.dll
MOD - [2013.01.10 12:29:53 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\60674dde4b56087c189f576f36f6720f\PresentationFramework.Aero.ni.dll
MOD - [2013.01.10 12:29:52 | 007,070,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b519f42484e1d488662a9a8a87cb8849\System.Core.ni.dll
MOD - [2013.01.10 12:29:48 | 003,883,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\8abaedf6aecb073b22f8801aa0b8babf\WindowsBase.ni.dll
MOD - [2013.01.10 12:29:46 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\fc476bbac36944e352c2f547352ffa64\System.Xml.ni.dll
MOD - [2013.01.10 12:29:45 | 001,667,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\78ecbee4a7444353dce52afb9d9d795c\System.Drawing.ni.dll
MOD - [2013.01.10 12:29:41 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7cd4aa51f6e6b9330b8f50bba8bb62c6\System.Configuration.ni.dll
MOD - [2013.01.10 12:29:39 | 009,095,168 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\f93dca0e4baa1dcb37cf75392b7c89da\System.ni.dll
MOD - [2013.01.10 12:29:30 | 014,416,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6a1ccc1e1a79ce267d3d1808af382cd6\mscorlib.ni.dll
MOD - [2013.01.09 12:43:19 | 014,586,888 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll
MOD - [2013.01.06 19:35:06 | 000,115,137 | ---- | M] () -- C:\Users\Dennis\AppData\Local\Temp\99cab429-f99d-4f69-9d04-113ad532bd0f\CliSecureRT.dll
MOD - [2012.07.02 17:12:50 | 000,021,432 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2012.05.22 15:10:52 | 000,007,680 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\funcs.dll
MOD - [2012.05.22 15:09:44 | 000,012,800 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\SecureBanking.dll
MOD - [2012.01.30 16:17:44 | 000,001,536 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\sbservice.exe


========== Services (SafeList) ==========

SRV - [2013.01.20 12:05:18 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.19 11:52:42 | 000,541,608 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.01.09 12:43:21 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.10.04 16:07:17 | 006,371,192 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService)
SRV - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 12:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.06.16 03:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\19.9.0.9\ccSvcHst.exe -- (NIS)
SRV - [2011.12.27 16:28:01 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.04.20 08:57:02 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.05.14 17:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0)
SRV - [2009.03.29 20:42:16 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2006.12.19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe -- (EpsonBidirectionalService)


========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.09.14 19:02:41 | 000,175,736 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2012.07.06 03:17:58 | 000,037,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309000.009\SRTSPX64.SYS -- (SRTSPX)
DRV:64bit: - [2012.07.06 03:17:57 | 000,737,952 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1309000.009\SRTSP64.SYS -- (SRTSP)
DRV:64bit: - [2012.07.03 16:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.06.07 05:43:38 | 000,167,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309000.009\ccSetx64.sys -- (ccSet_NIS)
DRV:64bit: - [2012.06.04 08:59:20 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.06.04 08:59:20 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.05.22 02:37:12 | 001,129,120 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1309000.009\SYMEFA64.SYS -- (SymEFA)
DRV:64bit: - [2012.04.18 03:13:32 | 000,445,560 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\NISx64\1309000.009\SYMTDIV.SYS -- (SYMTDIv)
DRV:64bit: - [2012.04.18 02:42:14 | 000,190,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309000.009\Ironx64.SYS -- (SymIRON)
DRV:64bit: - [2012.02.29 14:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.15 21:58:57 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.07.25 19:18:36 | 000,451,192 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1309000.009\SYMDS64.SYS -- (SymDS)
DRV:64bit: - [2010.08.24 10:55:33 | 000,075,888 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\L1C60x64.sys -- (L1C)
DRV:64bit: - [2009.11.25 14:06:02 | 001,276,928 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2009.10.01 01:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2006.10.31 16:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV - [2013.01.19 12:13:35 | 002,087,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130130.033\ex64.sys -- (NAVEX15)
DRV - [2013.01.19 12:13:35 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2013.01.19 12:13:35 | 000,126,192 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130130.033\eng64.sys -- (NAVENG)
DRV - [2013.01.16 03:51:11 | 001,388,120 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20130116.013\BHDrvx64.sys -- (BHDrvx64)
DRV - [2012.09.14 18:11:45 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012.09.13 14:45:12 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20130130.001\IDSviA64.sys -- (IDSVia64)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=117025&babsrc=SP_ss&mntrId=746ac20400000000000014dae98ef54b
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.wer-kennt-wen.de/error/rights"
FF - prefs.js..extensions.enabledAddons: addlyrics%40addlyrics.net:1.3
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130129
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:11.1.1.5%20-%202
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Dennis\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Users\Dennis\Desktop\Amazone\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPlgn\ [2012.09.14 18:17:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\coFFPlgn\ [2013.01.31 16:58:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.20 12:05:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.20 12:05:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\addlyrics@addlyrics.net: C:\Users\Dennis\AppData\Local\AddLyrics\FF\ [2013.01.26 15:37:01 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.20 12:05:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.20 12:05:15 | 000,000,000 | ---D | M]

[2011.12.26 00:46:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dennis\AppData\Roaming\mozilla\Extensions
[2011.12.26 00:46:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dennis\AppData\Roaming\mozilla\Extensions\prism@developer.mozilla.org
[2013.01.30 23:18:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dennis\AppData\Roaming\mozilla\Firefox\Profiles\zurtgwtv.default\extensions
[2013.01.30 23:18:15 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Dennis\AppData\Roaming\mozilla\Firefox\Profiles\zurtgwtv.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.11.07 13:32:05 | 000,000,000 | ---D | M] (uTorrentBar_DE Community Toolbar) -- C:\Users\Dennis\AppData\Roaming\mozilla\Firefox\Profiles\zurtgwtv.default\extensions\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}
[2013.01.30 15:49:05 | 000,000,000 | ---D | M] (Wörterbuch Deutsch (de-DE), Hunspell-unterstützt) -- C:\Users\Dennis\AppData\Roaming\mozilla\Firefox\Profiles\zurtgwtv.default\extensions\de_DE@dicts.j3e.de
[2013.01.20 12:05:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.14 18:17:24 | 000,000,000 | ---D | M] (Norton Vulnerability Protection) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPLGN
[2013.01.26 15:37:01 | 000,000,000 | ---D | M] ("AddLyrics") -- C:\USERS\DENNIS\APPDATA\LOCAL\ADDLYRICS\FF
[2013.01.20 12:05:18 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.03 00:18:02 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 15:20:40 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.03 00:18:02 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.03 00:18:02 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.03 00:18:02 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.03 00:18:02 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========


O1 HOSTS File: ([2013.01.27 18:13:59 | 000,445,336 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 15297 more lines...
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (AddLyrics) - {4145006D-47F8-42F2-8186-2225AAFECDD3} - C:\Users\Dennis\AppData\Local\AddLyrics\AddLyrics.dll (AddLyrics)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.0.9\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.0.9\IPS\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo0.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.0.9\coIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar_DE Toolbar) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo0.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LGODDFU] "C:\Program Files (x86)\lg_fwupdate\fwupdate.exe" blrun File not found
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Epson Stylus SX430(Netzwerk)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE /FU "C:\Users\Dennis\AppData\Local\Temp\E_S9B29.tmp" /EF "HKCU" File not found
O4 - HKCU..\Run: [EPSON SX430 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE /FU "C:\Users\Dennis\AppData\Local\Temp\E_S9A5E.tmp" /EF "HKCU" File not found
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKCU..\Run: [SecureBanking] C:\Program Files (x86)\Secure Banking\SecureBanking.exe (Secure Banking)
O4 - HKCU..\Run: [Steam] D:\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5597662E-E67E-4976-A18C-C1FD080FD931}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EDC1BD2A-CC61-4767-8575-379089AA288A}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll) - File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Dennis\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Dennis\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013.01.30 21:05:52 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.08.23 17:23:12 | 000,003,033 | ---- | M] () - D:\autocam.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.07.15 08:17:14 | 000,000,070 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006.06.19 16:44:02 | 000,213,330 | R--- | M] () - F:\autorunE14.exe -- [ CDFS ]
O32 - AutoRun File - [2006.06.14 09:46:08 | 000,213,575 | R--- | M] () - F:\autorunSE14.exe -- [ CDFS ]
O32 - AutoRun File - [2010.07.15 08:17:14 | 000,000,070 | R--- | M] () - G:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006.06.19 16:44:02 | 000,213,330 | R--- | M] () - G:\autorunE14.exe -- [ CDFS ]
O32 - AutoRun File - [2006.06.14 09:46:08 | 000,213,575 | R--- | M] () - G:\autorunSE14.exe -- [ CDFS ]
O33 - MountPoints2\{b9e7556d-2730-11e1-9f70-14dae98ef54b}\Shell - "" = AutoRun
O33 - MountPoints2\{b9e7556d-2730-11e1-9f70-14dae98ef54b}\Shell\AutoRun\command - "" = F:\Start.exe -- [2008.03.13 10:45:56 | 000,143,480 | R--- | M] (MatchWare A/S)
O33 - MountPoints2\{e1837581-acf7-11e1-8a4c-14dae98ef54b}\Shell - "" = AutoRun
O33 - MountPoints2\{e1837581-acf7-11e1-8a4c-14dae98ef54b}\Shell\AutoRun\command - "" = G:\Start.exe -- [2008.03.13 10:45:56 | 000,143,480 | R--- | M] (MatchWare A/S)
O33 - MountPoints2\{f0a57ae0-d171-11e0-ac7c-14dae98ef54b}\Shell - "" = AutoRun
O33 - MountPoints2\{f0a57ae0-d171-11e0-ac7c-14dae98ef54b}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.01.31 17:26:05 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Dennis\Desktop\OTL.exe
[2013.01.30 23:11:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secure Banking
[2013.01.30 23:11:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secure Banking
[2013.01.30 22:05:07 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Malwarebytes
[2013.01.30 22:04:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.01.30 22:04:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.30 22:04:26 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.01.30 22:04:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.01.30 21:03:52 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.01.30 21:02:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013.01.28 20:18:51 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\UseNeXT
[2013.01.28 20:18:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
[2013.01.28 20:18:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UseNeXT
[2013.01.26 20:15:49 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Desktop\alt.binaries.mp3.complete_cd
[2013.01.26 15:40:07 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Desktop\exe
[2013.01.26 15:37:16 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Local Settings
[2013.01.26 15:37:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2013.01.26 15:37:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2013.01.26 15:37:01 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\AddLyrics
[2013.01.25 12:51:12 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\UseNeXT
[2013.01.20 12:05:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.01.17 20:48:42 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Mixed_In_Key_LLC
[2013.01.17 20:48:40 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Mixed In Key
[2013.01.17 20:48:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mixed In Key 5
[2013.01.17 20:48:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mixed In Key 5
[2013.01.17 20:46:37 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Mixed In Key LLC
[2013.01.14 20:50:54 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Suxyur
[2013.01.10 12:26:35 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\MAGIX Downloads
[2013.01.10 12:26:34 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\MAGIX
[2013.01.06 20:36:16 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Desktop\Odin
[2013.01.06 19:35:01 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Samsung
[2013.01.06 19:34:54 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Samsung
[2013.01.06 19:34:44 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\samsung
[2013.01.06 19:25:27 | 000,203,320 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2013.01.06 19:25:27 | 000,099,384 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2013.01.06 19:23:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2013.01.06 19:23:42 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2013.01.06 19:23:09 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2013.01.06 19:23:09 | 000,020,032 | ---- | C] (Devguru Co., Ltd) -- C:\Windows\SysWow64\drivers\dgderdrv.sys
[2013.01.06 19:23:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MarkAny
[2013.01.06 17:11:48 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Downloaded Installations
[2013.01.05 20:05:31 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Durchstarten mit Ponky
[2013.01.05 20:05:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Durchstarten mit Ponky
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.01.31 17:26:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dennis\Desktop\OTL.exe
[2013.01.31 17:24:28 | 000,000,168 | ---- | M] () -- C:\Users\Dennis\defogger_reenable
[2013.01.31 16:55:41 | 000,004,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.31 16:55:41 | 000,004,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.31 16:55:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.31 03:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.30 23:11:27 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Secure Banking.lnk
[2013.01.30 22:04:29 | 000,000,948 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.01.30 21:05:52 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2013.01.30 21:03:55 | 000,002,091 | ---- | M] () -- C:\Users\Dennis\Desktop\SpyHunter.lnk
[2013.01.30 15:42:02 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\AddLyrics update.job
[2013.01.29 22:22:40 | 000,052,224 | ---- | M] () -- C:\Users\Dennis\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.29 19:35:59 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2013.01.28 20:18:47 | 000,001,696 | ---- | M] () -- C:\Users\Dennis\Desktop\UseNeXT.lnk
[2013.01.27 18:33:20 | 000,000,000 | ---- | M] () -- C:\Windows\EEventManager.INI
[2013.01.27 18:33:18 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2013.01.27 18:13:59 | 000,445,336 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.01.27 16:35:53 | 000,001,127 | ---- | M] () -- C:\Users\Dennis\Desktop\Spybot - Search & Destroy.lnk
[2013.01.26 17:25:51 | 001,538,358 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.01.26 17:25:51 | 000,671,212 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.01.26 17:25:51 | 000,631,942 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.01.26 17:25:51 | 000,144,380 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.01.26 17:25:51 | 000,118,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.01.26 17:25:44 | 001,538,358 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.01.24 21:23:10 | 665,411,628 | ---- | M] () -- C:\Users\Dennis\Desktop\prohouse.wav
[2013.01.21 16:12:55 | 860,147,756 | ---- | M] () -- C:\Users\Dennis\Desktop\Andres Blow Mixi.wav
[2013.01.20 22:00:20 | 776,470,598 | ---- | M] () -- C:\Users\Dennis\Desktop\Techmit cue.wav
[2013.01.19 23:22:01 | 681,001,030 | ---- | M] () -- C:\Users\Dennis\Desktop\ElectroHouse.wav
[2013.01.19 12:46:57 | 481,730,604 | ---- | M] () -- C:\Users\Dennis\Desktop\rumdiedum.wav
[2013.01.18 21:28:45 | 720,355,372 | ---- | M] () -- C:\Users\Dennis\Desktop\rumfumel2.wav
[2013.01.17 20:48:58 | 000,000,095 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2013.01.17 20:48:09 | 000,000,930 | ---- | M] () -- C:\Users\Public\Desktop\Mixed In Key 5.lnk
[2013.01.14 23:16:28 | 000,489,608 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.01.10 15:48:10 | 000,000,051 | ---- | M] () -- C:\Windows\DurchstartenM12.ini
[2013.01.10 14:01:22 | 000,000,053 | ---- | M] () -- C:\Windows\DurchstartenD12.ini
[2013.01.06 19:34:41 | 000,001,788 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2013.01.05 18:54:25 | 000,111,017 | ---- | M] () -- C:\Users\Dennis\Desktop\Sprach_2.pdf
[2013.01.03 16:30:37 | 000,000,680 | ---- | M] () -- C:\Users\Dennis\AppData\Local\d3d9caps.dat
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.01.31 17:24:28 | 000,000,168 | ---- | C] () -- C:\Users\Dennis\defogger_reenable
[2013.01.30 23:11:27 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Secure Banking.lnk
[2013.01.30 22:04:29 | 000,000,948 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.01.30 21:05:52 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2013.01.30 21:03:55 | 000,002,091 | ---- | C] () -- C:\Users\Dennis\Desktop\SpyHunter.lnk
[2013.01.28 20:18:47 | 000,001,696 | ---- | C] () -- C:\Users\Dennis\Desktop\UseNeXT.lnk
[2013.01.27 18:33:20 | 000,000,000 | ---- | C] () -- C:\Windows\EEventManager.INI
[2013.01.27 18:33:18 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013.01.26 15:37:05 | 000,000,340 | ---- | C] () -- C:\Windows\tasks\AddLyrics update.job
[2013.01.24 21:21:18 | 665,411,628 | ---- | C] () -- C:\Users\Dennis\Desktop\prohouse.wav
[2013.01.21 16:10:42 | 860,147,756 | ---- | C] () -- C:\Users\Dennis\Desktop\Andres Blow Mixi.wav
[2013.01.20 21:58:12 | 776,470,598 | ---- | C] () -- C:\Users\Dennis\Desktop\Techmit cue.wav
[2013.01.19 23:20:21 | 681,001,030 | ---- | C] () -- C:\Users\Dennis\Desktop\ElectroHouse.wav
[2013.01.19 12:45:52 | 481,730,604 | ---- | C] () -- C:\Users\Dennis\Desktop\rumdiedum.wav
[2013.01.18 21:26:33 | 720,355,372 | ---- | C] () -- C:\Users\Dennis\Desktop\rumfumel2.wav
[2013.01.17 20:48:58 | 000,000,095 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2013.01.17 20:48:08 | 000,000,930 | ---- | C] () -- C:\Users\Public\Desktop\Mixed In Key 5.lnk
[2013.01.10 15:48:10 | 000,000,051 | ---- | C] () -- C:\Windows\DurchstartenM12.ini
[2013.01.06 19:34:41 | 000,001,788 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2013.01.05 20:05:31 | 000,000,053 | ---- | C] () -- C:\Windows\DurchstartenD12.ini
[2013.01.05 18:54:25 | 000,111,017 | ---- | C] () -- C:\Users\Dennis\Desktop\Sprach_2.pdf
[2012.07.08 02:29:06 | 004,503,728 | ---- | C] () -- C:\ProgramData\go_0molg.pad
[2012.07.04 21:21:46 | 000,001,433 | ---- | C] () -- C:\Users\Dennis\AppData\Local\RecConfig.xml
[2012.06.26 16:02:40 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.06.26 16:02:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.06.26 16:02:38 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.06.26 16:02:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.06.26 16:02:38 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.05.23 19:30:28 | 000,000,342 | ---- | C] () -- C:\Windows\lgfwup.ini
[2012.03.17 17:31:17 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\mgxasio2.dll
[2012.03.17 17:30:27 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2012.03.17 17:29:37 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2012.02.23 21:49:17 | 000,001,800 | ---- | C] () -- C:\Users\Dennis\Documentskdh-watchmen.xvid.cd1.sfv
[2012.01.28 23:00:20 | 000,000,038 | ---- | C] () -- C:\Windows\VjammRender.ini
[2012.01.28 23:00:13 | 000,002,292 | ---- | C] () -- C:\Windows\vjammstandard.ini
[2012.01.22 23:08:17 | 000,004,425 | ---- | C] () -- C:\Users\Dennis\AppData\Roaming\CamStudio.cfg
[2012.01.22 23:08:17 | 000,000,408 | ---- | C] () -- C:\Users\Dennis\AppData\Roaming\CamShapes.ini
[2012.01.22 23:08:17 | 000,000,408 | ---- | C] () -- C:\Users\Dennis\AppData\Roaming\CamLayout.ini
[2012.01.22 23:08:17 | 000,000,117 | ---- | C] () -- C:\Users\Dennis\AppData\Roaming\Camdata.ini
[2011.12.27 16:28:09 | 000,281,656 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.12.27 16:28:01 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.09.09 19:20:35 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.09.09 19:20:35 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.08.14 13:47:12 | 000,000,680 | ---- | C] () -- C:\Users\Dennis\AppData\Local\d3d9caps.dat
[2011.08.09 22:20:00 | 000,146,217 | ---- | C] () -- C:\Windows\hpoins18.dat
[2011.08.09 22:19:19 | 000,006,600 | ---- | C] () -- C:\Windows\hpomdl18.dat
[2011.08.08 22:00:23 | 000,021,801 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2011.08.08 22:00:23 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.08.05 21:47:18 | 000,000,004 | ---- | C] () -- C:\Users\Dennis\AppData\Roaming\steam_md4.dat
[2011.08.05 19:24:28 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2011.08.05 19:24:21 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2011.08.05 19:24:11 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2011.08.05 19:24:11 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2011.08.05 19:15:24 | 000,000,732 | ---- | C] () -- C:\Users\Dennis\AppData\Local\d3d9caps64.dat
[2011.08.05 15:41:53 | 001,538,358 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.08.05 14:21:19 | 000,052,224 | ---- | C] () -- C:\Users\Dennis\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006.11.02 16:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.08 18:59:03 | 012,899,840 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.04.10 23:11:16 | 000,891,392 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 22:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008.01.21 03:50:58 | 000,513,024 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012.02.10 19:58:28 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Amazon
[2013.01.25 22:15:32 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Audacity
[2012.01.22 14:01:40 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\BeatportDownloader.EE670286545758FAB4A69D4439CF6054F83E0AC2.1
[2011.08.05 15:36:34 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Canneverbe Limited
[2012.02.01 23:26:43 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Cycling '74
[2013.01.15 21:46:45 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\DAEMON Tools Lite
[2011.09.23 14:39:31 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\DAEMON Tools Pro
[2012.05.15 20:04:42 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\dp3d
[2011.10.23 20:35:18 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\DVDVideoSoft
[2011.09.12 19:58:53 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.05 08:53:06 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Epson
[2011.09.24 17:27:50 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\FileZilla
[2012.01.18 19:50:37 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Image Zone Express
[2012.05.23 21:53:51 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\ImgBurn
[2012.07.26 19:12:51 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\IrfanView
[2012.02.01 23:32:21 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Livid
[2012.03.17 18:17:34 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\MAGIX
[2013.01.17 20:46:37 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Mixed In Key LLC
[2011.12.09 16:23:47 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\OpenOffice.org
[2012.01.18 19:50:37 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Printer Info Cache
[2011.12.26 00:46:04 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Prism
[2012.01.04 17:18:01 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Resolume
[2012.01.22 20:15:53 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Resolume Avenue 3
[2012.01.22 20:16:03 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Resolume Avenue 4
[2013.01.06 19:34:54 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Samsung
[2012.01.22 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\SoundSpectrum
[2013.01.15 21:27:58 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Suxyur
[2011.12.09 16:47:54 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\TeamViewer
[2012.08.17 13:34:53 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\TS3Client
[2011.11.20 11:40:33 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\ts3overlay
[2013.01.30 22:04:14 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\UseNeXT
[2011.12.15 21:55:18 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\uTorrent
[2012.05.20 16:49:00 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Xilisoft

========== Purity Check ==========



< End of report >





OTL Extras logfile created on: 31.01.2013 17:29:47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dennis\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

4,00 Gb Total Physical Memory | 2,15 Gb Available Physical Memory | 53,72% Memory free
8,20 Gb Paging File | 6,26 Gb Available in Paging File | 76,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 11,23 Gb Free Space | 11,50% Space Free | Partition Type: NTFS
Drive D: | 368,10 Gb Total Space | 158,66 Gb Free Space | 43,10% Space Free | Partition Type: NTFS
Drive F: | 2,01 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 2,01 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: DENNIS-PC | User Name: Dennis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = 18 4C 07 FD 9E 53 CC 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{031569C6-6F60-43BD-B656-1263D34C95A8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{309FBD21-D98B-44CC-B51F-EF88304E8D58}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{40883165-583E-483F-9CF1-03E7DAFF31CC}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{418EF2F8-F55E-4B36-92D0-4EA65540BBA9}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{50AF0389-3E6F-4A15-A67A-51E78B9408B5}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{521BFF62-E66E-46CA-ACAA-977ABBFA9CEE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{62C293C1-AE95-49F4-BE34-1CF0AB37DAF3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6654FDF4-4FB5-4E9A-9013-CC3DD50B78C6}" = rport=139 | protocol=6 | dir=out | app=system |
"{66F2B414-7131-4CC2-8F06-19362AE08FF1}" = lport=445 | protocol=6 | dir=in | app=system |
"{68472AB7-9F63-4909-B07D-FEE8FC0A47AB}" = lport=139 | protocol=6 | dir=in | app=system |
"{6BECEDE5-E7A5-46A2-8625-7840968FE27A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6F08B588-E9A8-4726-82C5-EE8F2DEB6E39}" = rport=445 | protocol=6 | dir=out | app=system |
"{8BA33178-BE86-452F-A5AA-B6C492C879B8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9DDFF643-7BB7-44AC-BA63-FCD86C1A5C12}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{AC5623B8-BDE4-4F00-B512-93120C5C9CDC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D8558091-5305-45E8-A8C4-BEC559C4ACF9}" = lport=138 | protocol=17 | dir=in | app=system |
"{DAC2A1D1-4836-464F-84BA-5ECA9C26F4D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{E05E5D0A-A789-47F3-903C-DE70A17A9E69}" = lport=137 | protocol=17 | dir=in | app=system |
"{E6704EB3-C6EA-4CFA-99A6-3FF1736F4BDF}" = rport=138 | protocol=17 | dir=out | app=system |
"{EAE2C7D1-CF98-4386-B417-EF7719D9314D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06A34A85-E125-499B-995C-59D0E08E497E}" = protocol=17 | dir=in | app=e:\network\epsonnetsetup\eneasyapp.exe |
"{129FF22D-D8EB-49A4-99BC-933374A855DE}" = protocol=6 | dir=in | app=e:\network\epsonnetsetup\eneasyapp.exe |
"{1B1E6042-1A86-4063-902A-B40F00D50CCF}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{24702DEA-BFE0-4FFB-989A-BF36A8F78112}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
"{4575A193-8A4D-4A2F-A6F1-5BC1E7D1356A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{48D1F23A-0A64-4C20-9C6B-6EE889D86DF3}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{4BDBA937-E9C6-409C-975B-1E5E651751B5}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{526687CF-AD01-4622-8B9F-1738BC8B1686}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5857367F-96B0-44F1-85A7-B16E3DB46996}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{5CF8FA87-C2C7-4427-8F00-EFBD24C23857}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{60644985-AE84-4BC2-86A6-28FE3283C4B8}" = protocol=6 | dir=in | app=d:\steam\steam.exe |
"{6C09DF6F-B594-46AE-AF40-1642824DB96A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6DE66519-9085-4717-8720-CA1BDCC39CE4}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{93DD71FC-EDA5-419D-8465-B68E4FD2CDC8}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{A9830FAC-20EB-4AE1-BF6B-0B807DA9A864}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
"{BDE6E0B5-A790-4249-83BB-EF62394149C6}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{C2474E44-296F-4515-8778-96025B0E970E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C3DDD73D-F234-4D30-9A25-E0DFB39BAEEE}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{C45D7714-89C0-49B9-B3AC-6505A561B72D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{CA589768-D629-4EB5-82B2-EAA6B34102DC}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{CB991D13-C095-49A7-8832-2AA47E574FE0}" = protocol=17 | dir=in | app=d:\steam\steam.exe |
"{D1B07306-2A31-46B0-BA5A-54353C779094}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{DD145AB0-D858-4428-9976-F8E1FA1BEA64}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{DF70709F-8921-49A6-BDDD-F2FB52863ECF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E9165307-8C97-499D-BCB5-438AFFAB4558}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{EE4BAE73-C7AC-4B20-86C8-98DCE4E6B4C3}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{EE756276-FD72-4C00-853E-EF5A65A1C8A2}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{F74B6264-B365-4D41-B871-E73486E03D27}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{FACFB847-0B7D-4E18-88FF-57701C319634}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{15A77C13-147E-4968-9ECF-DDE78A4AFDE4}C:\program files\guillemot\tools\giwebupdater.exe" = protocol=6 | dir=in | app=c:\program files\guillemot\tools\giwebupdater.exe |
"TCP Query User{A84EEB9B-06B5-41B8-A96B-AF134271D19E}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"TCP Query User{C42767C2-6632-4A9D-B14F-A8153F0E6543}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe |
"TCP Query User{C974CFE6-9B5E-4D59-8ABE-A675707FE9BF}C:\Program Files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe |
"UDP Query User{794DF42A-9898-4F39-84FC-A763BF62611E}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe |
"UDP Query User{8D118F95-FB4C-45C2-BA2D-ED375741D701}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{AD592FE7-D6B2-4DFB-802B-7AFFF50D8E8B}C:\program files\guillemot\tools\giwebupdater.exe" = protocol=17 | dir=in | app=c:\program files\guillemot\tools\giwebupdater.exe |
"UDP Query User{FF2ABB92-2FFB-46DB-AE13-6EED0E26F151}C:\Program Files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{013CCA52-DA56-4133-AC2B-1988A9568C30}" = Native Instruments Audio 4 DJ Driver
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0886900B-B2F3-452C-B580-60F1253F7F80}" = Native Instruments Controller Editor
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{23A66953-369C-4d22-A189-C6E403D4A19F}" = Native Instruments Audio 2 DJ Driver
"{24873332-B98B-4235-ABBA-CCDEACC62BB9}" = Native Instruments Traktor Audio 6 Driver
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{3054FEFA-4748-4cf0-8C3C-8DB887DE379F}" = Native Instruments Traktor Audio 2 Driver
"{305CA7E5-C739-48e2-B247-584C0E1B717C}" = Native Instruments Traktor Audio 10 Driver
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{470BB39A-7231-4077-AD3D-86067AD04604}" = Native Instruments Audio 8 DJ Driver
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{9F560BEB-021F-43AC-825F-AA60442D8DE4}" = 64 Bit HP CIO Components Installer
"{A8EC0CC0-AD8D-4244-B080-424EDF7A7634}" = Native Instruments Traktor 2
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CA0D2F09-F811-48D4-843E-C87696C6A9D9}" = Bonjour
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"EPSON SX430 Series" = EPSON SX430 Series Printer Uninstall
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.00 (64-Bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
""Durchstarten mit Ponky - Deutsch 1+2"" = "Durchstarten mit Ponky - Deutsch 1+2"
""Durchstarten mit Ponky - Mathe 1+2"" = "Durchstarten mit Ponky - Mathe 1+2"
"{02C6615A-A8FF-4175-8B25-9DADCE1D02B7}_is1" = Secure Banking Version 1.4.6
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2D2D8FE2-605C-4D3C-B706-36E981E7EEF0}" = LG CyberLink BD Advisor
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{43888693-9D3C-4CC6-9399-64F926B05E90}" = MAGIX Music Maker MX Production Suite Download-Version (Instrumenten-Paket 4)
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5310C7A5-A385-6E26-66E9-C0F0CA5A7E45}" = BeatportDownloader
"{59B6CD4A-C676-4B05-B8D6-73BA3AE159E5}" = MAGIX Music Maker MX Production Suite Download-Version (Instrumenten-Paket 2)
"{5C64CCE1-D944-4E81-94AD-B340070048A3}" = Mixed In Key 5
"{5CB429E8-A68B-48BB-9681-9CFF6D3C7AA6}" = MAGIX Music Maker MX Production Suite Download-Version (Instrumenten-Paket 6)
"{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}" = Suite
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{78D8C01E-388C-4623-AF8C-B355411DAC7C}" = MAGIX Music Maker MX Production Suite Download-Version (Instrumenten-Paket 5)
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}" = Epson Event Manager
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}" = Epson Easy Photo Print 2
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{AD8E39D7-19BF-4A4E-8484-828FB01D63A0}" = MAGIX Music Maker MX Production Suite Download-Version
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BA24C9CA-7806-4556-959C-E242BF813449}" = MAGIX Music Maker MX Production Suite Download-Version (Soundpaket)
"{D8E3A26A-E06B-43BA-A841-0A93A3E9E770}" = MAGIX Music Maker MX Production Suite Download-Version (Synthesizer und Effekte)
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = LG CyberLink PowerDVD
"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software
"{E26DEDC7-1A99-4F8C-9615-6DB112E6495B}_is1" = Texas Hold'em Poker 3D - Deluxe Edition 1.0
"{E511636F-C3AA-46C4-9832-D1BE79D907EC}" = MAGIX Music Maker MX Production Suite Download-Version (Instrumenten-Paket 1)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7A7D9B3-A142-4957-AC8E-530D1DE1A91A}" = Activision(R)
"{F8BD7716-7362-4553-9890-378322F2C0CC}" = DENON DJ ASIO Driver
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FBDB34D6-9D27-4EC9-969E-FDAAA367F888}" = MAGIX Music Maker MX Production Suite Download-Version (Instrumenten-Paket 3)
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" =
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"addlyrics@addlyrics.net" = AddLyrics
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Aeon" = Aeon
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17
"Audacity_is1" = Audacity 2.0
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 8
"BeatportDownloader.EE670286545758FAB4A69D4439CF6054F83E0AC2.1" = BeatportDownloader
"bi_uninstaller" = 7-Zip Uninstaller
"bwin Poker JPC_is1" = bwin Poker JPC 1.0.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"Deep Blue Sea – Die Schatztaucherin_is1" = Deep Blue Sea – Die Schatztaucherin
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Scanner" = EPSON Scan
"EPSON SX430 Series Bog" = Benutzerhandbuch - Grundlagen EPSON SX430 Series
"EPSON SX430 Series Netg" = Netzwerkhandbuch EPSON SX430 Series
"EPSON SX430 Series Useg" = Benutzerhandbuch EPSON SX430 Series
"G-Force" = G-Force
"ImgBurn" = ImgBurn
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = LG CyberLink PowerDVD
"InstallShield_{F7A7D9B3-A142-4957-AC8E-530D1DE1A91A}" = Ice Age(TM) 4 - Voll Verschoben! Die arktischen Spiele demo
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Native Instruments Audio 2 DJ Driver" = Native Instruments Audio 2 DJ Driver
"Native Instruments Audio 4 DJ Driver" = Native Instruments Audio 4 DJ Driver
"Native Instruments Audio 8 DJ Driver" = Native Instruments Audio 8 DJ Driver
"Native Instruments Controller Editor" = Native Instruments Controller Editor
"Native Instruments Service Center" = Native Instruments Service Center
"Native Instruments Traktor 2" = Native Instruments Traktor 2
"Native Instruments Traktor Audio 10 Driver" = Native Instruments Traktor Audio 10 Driver
"Native Instruments Traktor Audio 2 Driver" = Native Instruments Traktor Audio 2 Driver
"Native Instruments Traktor Audio 6 Driver" = Native Instruments Traktor Audio 6 Driver
"NIS" = Norton Internet Security
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"Switch" = Switch Audiodatei-Konverter
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UseNeXT_is1" = UseNeXT
"uTorrentBar_DE Toolbar" = uTorrentBar_DE Toolbar
"VLC media player" = VLC media player 1.1.11

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 27.01.2013 11:31:51 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 27.01.2013 13:11:00 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 27.01.2013 13:35:54 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 28.01.2013 11:32:57 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 29.01.2013 11:14:44 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 29.01.2013 11:23:44 | Computer Name = Dennis-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 29.01.2013 11:23:44 | Computer Name = Dennis-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 29.01.2013 16:01:33 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842830
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\Dennis\Downloads\SoftonicDownloader_fuer_samsung-kies.exe".
Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche
Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die
widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Error - 30.01.2013 10:29:17 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 30.01.2013 12:21:29 | Computer Name = Dennis-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 31.01.2013 01:07:23 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

Error - 31.01.2013 11:57:09 | Computer Name = Dennis-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 30.01.2013 10:30:10 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7038
Description =

Error - 30.01.2013 10:30:10 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 31.01.2013 01:07:25 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 31.01.2013 01:08:11 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7038
Description =

Error - 31.01.2013 01:08:11 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 31.01.2013 11:57:10 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 31.01.2013 11:57:55 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7038
Description =

Error - 31.01.2013 11:57:55 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 31.01.2013 12:27:18 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7038
Description =

Error - 31.01.2013 12:27:18 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >







Ich hoffe ihr ihr könnt Helfen.

Gruß Dennis

hi
öffne bitte Malwarebytes, Logdateien, poste alle Berichte mit Funden.

Hi ich habe da noch etwas von gestern Abend.

Schutz: Aktiviert

30.01.2013 22:08:12
mbam-log-2013-01-30 (22-08-12).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 520184
Laufzeit: 3 Stunde(n), 9 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


2013/01/31 06:06:05 +0100 DENNIS-PC Dennis MESSAGE Executing scheduled update: Daily
2013/01/31 06:06:07 +0100 DENNIS-PC Dennis ERROR Scheduled update failed: I/O error failed with error code 0
2013/01/31 06:06:09 +0100 DENNIS-PC Dennis MESSAGE Starting protection
2013/01/31 06:06:09 +0100 DENNIS-PC Dennis MESSAGE Protection started successfully
2013/01/31 06:06:09 +0100 DENNIS-PC Dennis MESSAGE Starting IP protection
2013/01/31 06:06:15 +0100 DENNIS-PC Dennis MESSAGE IP Protection started successfully
2013/01/31 16:55:57 +0100 DENNIS-PC Dennis MESSAGE Starting protection
2013/01/31 16:55:57 +0100 DENNIS-PC Dennis MESSAGE Protection started successfully
2013/01/31 16:55:57 +0100 DENNIS-PC Dennis MESSAGE Starting IP protection
2013/01/31 16:56:02 +0100 DENNIS-PC Dennis MESSAGE IP Protection started successfully
2013/01/31 17:27:06 +0100 DENNIS-PC Dennis MESSAGE Stopping protection
2013/01/31 17:27:06 +0100 DENNIS-PC Dennis MESSAGE Protection stopped successfully
2013/01/31 17:27:06 +0100 DENNIS-PC Dennis MESSAGE Stopping IP protection
2013/01/31 17:27:07 +0100 DENNIS-PC Dennis MESSAGE IP Protection stopped successfully
2013/01/31 17:27:07 +0100 DENNIS-PC Dennis MESSAGE Protection stopped
2013/01/31 18:08:57 +0100 DENNIS-PC Dennis MESSAGE Starting protection
2013/01/31 18:08:57 +0100 DENNIS-PC Dennis MESSAGE Protection started successfully
2013/01/31 18:08:57 +0100 DENNIS-PC Dennis MESSAGE Starting IP protection
2013/01/31 18:09:02 +0100 DENNIS-PC Dennis MESSAGE IP Protection started successfully
2013/01/31 21:47:48 +0100 DENNIS-PC Dennis MESSAGE Executing scheduled update: Daily
2013/01/31 21:48:05 +0100 DENNIS-PC Dennis MESSAGE Scheduled update executed successfully: database updated from version v2013.01.30.07 to version v2013.01.31.09
2013/01/31 21:48:05 +0100 DENNIS-PC Dennis MESSAGE Starting database refresh
2013/01/31 21:48:05 +0100 DENNIS-PC Dennis MESSAGE Stopping IP protection
2013/01/31 21:48:05 +0100 DENNIS-PC Dennis MESSAGE IP Protection stopped successfully
2013/01/31 21:48:18 +0100 DENNIS-PC Dennis MESSAGE Database refreshed successfully
2013/01/31 21:48:18 +0100 DENNIS-PC Dennis MESSAGE Starting IP protection
2013/01/31 21:48:24 +0100 DENNIS-PC Dennis MESSAGE IP Protection started successfully
2013/01/31 22:46:30 +0100 DENNIS-PC Dennis IP-BLOCK 62.219.81.122 (Type: outgoing, Port: 51710, Process: firefox.exe)
2013/01/31 22:49:43 +0100 DENNIS-PC Dennis IP-BLOCK 62.219.81.122 (Type: outgoing, Port: 51801, Process: firefox.exe)
2013/01/31 22:53:11 +0100 DENNIS-PC Dennis IP-BLOCK 62.219.81.122 (Type: outgoing, Port: 52003, Process: firefox.exe)
2013/01/31 22:53:11 +0100 DENNIS-PC Dennis IP-BLOCK 62.219.81.122 (Type: outgoing, Port: 52004, Process: firefox.exe)

Hallo ich habe mal ein scan gemacht mit Superantispyware .

Aber dieser ad-yieldmanager ist immer noch da!

Was kann ich jetzt noch machen? Ich bitte um Hilfe!




SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 02/01/2013 at 02:38 PM

Application Version : 5.6.1014

Core Rules Database Version : 9957
Trace Rules Database Version: 7769

Scan type : Quick Scan
Total Scan Time : 00:04:42

Operating System Information
Windows Vista Home Premium 64-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Administrator

Memory items scanned : 531
Memory threats detected : 0
Registry items scanned : 60479
Registry threats detected : 0
File items scanned : 10669
File threats detected : 59

Adware.Tracking Cookie
C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\GXM8D30H.txt [ /www.usenext.de ]
C:\USERS\DENNIS\Cookies\GXM8D30H.txt [ Cookie:dennis@www.usenext.de/ ]
.invitemedia.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
ads1.heimtierheim.eu [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adform.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.banner.t-online.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
ad4.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.vinsight.de [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.server.cpmstar.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.server.cpmstar.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.server.cpmstar.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.content-ssl.yieldmanager.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
ad3.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.guj.122.2o7.net [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.content.yieldmanager.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.content.yieldmanager.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZURTGWTV.DEFAULT\COOKIES.SQLITE ]

Hi Marcus ich habe Firefox gelöscht und neu Installiert Problem ad.yieldmanager erledigt.

Vom GVU Trojaner ist auch nichts mehr vorhanden.

Mein Thema kann geschlossen werden.

Ich bedanke mich für eure guten Tips

Mit freundlichen Gruß

Dennis