Falsche Weiterleitung von Browserlinks

abaldus

Hallo,

wie bereits einige andere in diesem Forum habe ich das Problem, dass das Anklicken von Links im Browser zu falschen Zielen führt.

Bei Eingabe der Adresse in die Adressleiste funktioniert alles.

Betroffen sind IE9, Firefox, Chrome, jeweils in aktueller Version.

Suchanbieter sind ebenfalls alle betroffen, Eingabe in Suchleiste oder Suchfeld ebenfalls gleich, der entstehende Link wird immer falsch verlinkt.

Ich habe mit Spybot, Malwarebytes und Norton Internet Security nach Ursachen gesucht, aber keine Lösung in Sicht.

Anbei die ersten LOG Files:


defogger.txt

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 07:16 on 03/02/2013 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


OTL.txt

OTL logfile created on: 2/3/2013 7:17:46 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\*****\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.96 Gb Total Physical Memory | 1.18 Gb Available Physical Memory | 39.92% Memory free
5.92 Gb Paging File | 4.06 Gb Available in Paging File | 68.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.49 Gb Total Space | 73.12 Gb Free Space | 51.67% Space Free | Partition Type: NTFS
Drive D: | 141.50 Gb Total Space | 140.52 Gb Free Space | 99.31% Space Free | Partition Type: NTFS
Drive E: | 99.82 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: *****-7 | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/02/03 07:11:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
PRC - [2012/12/05 02:40:03 | 000,143,928 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\20.2.1.22\ccsvchst.exe
PRC - [2012/11/30 03:55:25 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2012/11/23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012/11/22 10:50:02 | 000,166,424 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe
PRC - [2012/11/13 14:08:14 | 003,500,568 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe
PRC - [2012/11/13 14:07:52 | 003,906,584 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
PRC - [2012/11/13 14:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2012/11/13 14:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2012/07/16 18:28:36 | 006,974,360 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer.exe
PRC - [2012/07/16 18:28:36 | 002,025,368 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2012/02/24 02:29:58 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
PRC - [2012/02/23 11:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
PRC - [2012/02/23 11:22:56 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
PRC - [2012/02/20 20:28:32 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
PRC - [2011/09/09 16:01:16 | 001,804,648 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/30 01:23:56 | 001,037,672 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe
PRC - [2010/11/30 01:23:56 | 000,406,888 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrvProxy.exe
PRC - [2010/11/30 01:23:44 | 001,029,480 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe
PRC - [2010/11/30 01:23:44 | 000,406,888 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrvProxy.exe
PRC - [2009/11/11 15:17:02 | 000,771,360 | ---- | M] (Apple Inc.) -- C:\Program Files\AirPort\APAgent.exe
PRC - [2009/11/04 05:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/26 12:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/10/20 10:12:58 | 000,013,312 | ---- | M] (DoctorSoft) -- C:\Program Files\AnyPC Client\APLangApp.exe
PRC - [2009/10/13 11:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/10/07 02:31:56 | 002,246,144 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
PRC - [2009/01/12 02:52:00 | 000,354,304 | ---- | M] ((C) Michael Schiel) -- C:\Program Files\TrayBackup\traybackup.exe


========== Modules (No Company Name) ==========

MOD - [2012/11/13 14:06:32 | 000,158,624 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2012/11/13 14:06:30 | 000,108,960 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2012/11/13 14:06:28 | 000,554,400 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
MOD - [2012/11/13 14:06:28 | 000,528,288 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl
MOD - [2012/11/13 14:06:28 | 000,416,160 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012/08/23 09:38:24 | 000,574,840 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
MOD - [2012/05/30 07:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files\Norton Internet Security\Engine\20.2.1.22\wincfi39.dll
MOD - [2012/02/20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2006/08/12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
SRV - [2013/01/18 08:02:44 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/05 02:40:03 | 000,143,928 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Internet Security\Engine\20.2.1.22\ccSvcHst.exe -- (NIS)
SRV - [2012/11/22 10:50:02 | 000,166,424 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe -- (BingDesktopUpdate)
SRV - [2012/07/16 18:28:36 | 002,025,368 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2010/11/30 01:23:56 | 001,037,672 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe -- (SpeedDiskService)
SRV - [2010/11/30 01:23:44 | 001,029,480 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe -- (DiskDoctorService)
SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/29 16:09:02 | 000,394,704 | ---- | M] (Symantec, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe -- (Symantec RemoteAssist)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2013/01/18 10:28:56 | 001,603,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130201.033\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/01/18 10:28:56 | 000,093,296 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130201.033\NAVENG.SYS -- (NAVENG)
DRV - [2013/01/17 16:30:20 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130201.001\IDSvix86.sys -- (IDSVix86)
DRV - [2013/01/16 03:51:12 | 000,997,464 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130116.013\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/10/21 14:03:05 | 000,142,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012/10/09 02:00:02 | 000,586,400 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\srtsp.sys -- (SRTSP)
DRV - [2012/10/04 02:40:35 | 000,927,904 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\symefa.sys -- (SymEFA)
DRV - [2012/10/04 02:40:20 | 000,368,288 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\symds.sys -- (SymDS)
DRV - [2012/09/07 03:05:14 | 000,338,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\symnets.sys -- (SymNetS)
DRV - [2012/09/07 02:48:08 | 000,175,264 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\ironx86.sys -- (SymIRON)
DRV - [2012/08/23 15:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012/08/23 15:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012/08/20 20:49:49 | 000,134,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\ccsetx86.sys -- (ccSet_NIS)
DRV - [2012/08/09 07:04:29 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/08/09 07:04:29 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/05/24 22:36:56 | 000,032,888 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1402010.016\srtspx.sys -- (SRTSPX)
DRV - [2011/12/13 03:32:24 | 002,228,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/11/30 01:24:00 | 000,108,800 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SymSpeedDisk.sys -- (SYMSpeedDisk)
DRV - [2010/11/30 01:23:58 | 000,128,248 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SymDSMon.sys -- (SymDSMon)
DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:11.1.1.5%20-%202
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2010.9.0.6
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\windows\system32\C2MP\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ [2013/02/03 06:31:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ [2012/10/21 14:29:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/01/23 08:45:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/01/23 08:45:09 | 000,000,000 | ---D | M]

[2012/02/03 15:14:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions
[2010/02/22 15:16:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/02/03 15:14:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012/10/25 09:13:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\urn0o53f.default\extensions
[2012/10/21 14:29:02 | 000,000,000 | ---D | M] (Norton Vulnerability Protection) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPLGN

O1 HOSTS File: ([2013/02/02 14:12:59 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.2.1.22\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.)
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BingDesktop] C:\Program Files\Microsoft\BingDesktop\BingDesktop.exe (Microsoft Corp.)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKCU..\Run: [HP Officejet Pro 8600 (NET)] C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKCU..\Run: [TrayBackup] C:\Program Files\TrayBackup\traybackup.exe ((C) Michael Schiel)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: fritz.repeater ([]* in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A9BECE1-AC4C-49E8-9A78-FC0628D26295}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{52354A84-BE2E-4B44-BF08-91B1DCBFBB9D}: DhcpNameServer = 192.168.1.250
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{95DE52F9-5E06-47C9-BE22-4B7FE2603F77}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/02/03 07:16:29 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2013/02/02 15:28:44 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes
[2013/02/02 15:28:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/02/02 15:28:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/02/02 15:28:32 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2013/02/02 15:28:32 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/02/02 14:27:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013/02/02 14:14:34 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/02/02 14:14:31 | 000,000,000 | ---D | C] -- C:\windows\temp
[2013/02/02 14:14:31 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\temp
[2013/02/02 13:29:01 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2013/02/02 11:41:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\*****-BasisRenten-Rechner
[2013/02/02 11:39:38 | 000,000,000 | ---D | C] -- C:\Program Files\*****-BasisRenten-Rechner
[2013/02/02 11:05:49 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013/02/02 11:04:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2013/02/02 10:49:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013/02/02 10:49:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013/02/02 10:49:42 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\windows\System32\sdnclean.exe
[2013/02/02 10:49:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013/02/02 10:49:19 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Programs
[2013/01/23 08:45:08 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2013/01/19 15:02:42 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/02/22 15:03:28 | 000,720,315 | ---- | C] (Macromedia, Inc.) -- C:\Users\*****\Kopie von BuonNatale.exe
[2010/02/22 15:03:14 | 000,720,315 | ---- | C] (Macromedia, Inc.) -- C:\Users\*****\BuonNatale.exe
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/02/03 07:16:59 | 000,000,000 | ---- | M] () -- C:\Users\*****\defogger_reenable
[2013/02/03 07:12:05 | 000,365,568 | ---- | M] () -- C:\Users\*****\Desktop\gmer_2.0.18454.exe
[2013/02/03 07:11:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2013/02/03 07:11:31 | 000,050,477 | ---- | M] () -- C:\Users\*****\Desktop\Defogger.exe
[2013/02/03 07:01:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013/02/03 06:35:24 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/02/03 06:35:24 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/02/03 06:28:09 | 000,000,308 | ---- | M] () -- C:\windows\tasks\Wyrts.job
[2013/02/03 06:27:58 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013/02/03 06:27:56 | 2384,941,056 | -HS- | M] () -- C:\hiberfil.sys
[2013/02/02 15:28:34 | 000,001,031 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013/02/02 14:27:20 | 000,000,929 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/02/02 14:12:59 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2013/02/02 12:57:26 | 000,654,400 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2013/02/02 12:57:26 | 000,616,242 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2013/02/02 12:57:26 | 000,130,240 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2013/02/02 12:57:26 | 000,106,622 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2013/02/02 11:41:06 | 000,002,080 | ---- | M] () -- C:\Users\*****\Desktop\*****-BasisRenten-Rechner.lnk
[2013/02/01 20:15:06 | 000,000,248 | ---- | M] () -- C:\windows\tasks\NUSchedule.job
[2013/01/24 15:52:32 | 001,734,147 | ---- | M] () -- C:\windows\System32\drivers\NIS\1402010.016\Cat.DB
[2013/01/24 15:51:02 | 000,014,818 | ---- | M] () -- C:\windows\System32\drivers\NIS\1402010.016\VT20130115.021
[2013/01/21 08:31:52 | 000,001,944 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2013/01/19 10:16:06 | 000,350,312 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2013/01/10 08:44:09 | 000,000,172 | ---- | M] () -- C:\windows\System32\drivers\NIS\1402010.016\isolate.ini
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/02/03 07:16:59 | 000,000,000 | ---- | C] () -- C:\Users\*****\defogger_reenable
[2013/02/03 07:16:29 | 000,365,568 | ---- | C] () -- C:\Users\*****\Desktop\gmer_2.0.18454.exe
[2013/02/03 07:16:29 | 000,050,477 | ---- | C] () -- C:\Users\*****\Desktop\Defogger.exe
[2013/02/02 15:28:34 | 000,001,031 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013/02/02 14:27:19 | 000,000,929 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/02/02 11:41:06 | 000,002,080 | ---- | C] () -- C:\Users\*****\Desktop\*****-BasisRenten-Rechner.lnk
[2013/02/02 10:49:49 | 000,002,095 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2012/11/14 16:46:33 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012/10/20 18:24:44 | 000,094,208 | RHS- | C] () -- C:\windows\System32\KBDLTF.dll
[2012/09/06 09:34:39 | 000,000,288 | ---- | C] () -- C:\Users\*****\AppData\Roaming\.backup.dm
[2011/11/18 10:01:14 | 000,000,046 | ---- | C] () -- C:\windows\hmview.ini
[2011/10/19 19:39:29 | 000,036,712 | ---- | C] () -- C:\windows\System32\CleanMFT32.exe
[2011/03/21 16:10:29 | 000,000,530 | ---- | C] () -- C:\windows\System32\tx16_ic.ini
[2011/02/11 17:40:40 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll
[2011/01/19 09:22:52 | 000,001,940 | ---- | C] () -- C:\Users\*****\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/03/15 15:27:09 | 000,000,000 | ---- | C] () -- C:\Users\*****\AppData\Roaming\AVSMediaPlayer.m3u
[2010/03/15 14:57:41 | 000,000,218 | ---- | C] () -- C:\Users\*****\AppData\Roaming\wklnhst.dat
[2010/02/22 17:30:36 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/02/22 15:03:42 | 000,438,574 | ---- | C] () -- C:\Users\*****\Zelladhaesion.pdf
[2010/02/22 15:03:41 | 004,244,300 | ---- | C] () -- C:\Users\*****\wake-up.wmv
[2010/02/22 15:03:40 | 000,671,694 | ---- | C] () -- C:\Users\*****\Typhus_Ratzmotegma.bmp
[2010/02/22 15:03:40 | 000,035,345 | ---- | C] () -- C:\Users\*****\Volker Spieler KV.pdf
[2010/02/22 15:03:40 | 000,000,461 | ---- | C] () -- C:\Users\*****\Verknüpfung mit Lebenslauf.dot.lnk
[2010/02/22 15:03:35 | 065,806,408 | ---- | C] () -- C:\Users\*****\Track No06.nrg
[2010/02/22 15:03:35 | 002,288,402 | ---- | C] () -- C:\Users\*****\Track No05.mp4
[2010/02/22 15:03:34 | 003,093,332 | ---- | C] () -- C:\Users\*****\Track No02.mp4
[2010/02/22 15:03:34 | 002,730,729 | ---- | C] () -- C:\Users\*****\Track No04.mp4
[2010/02/22 15:03:34 | 002,504,789 | ---- | C] () -- C:\Users\*****\Track No03.mp4
[2010/02/22 15:03:34 | 002,335,344 | ---- | C] () -- C:\Users\*****\Track No01.mp4
[2010/02/22 15:03:33 | 000,580,534 | ---- | C] () -- C:\Users\*****\Reiseablauf-Version-2.pdf
[2010/02/22 15:03:33 | 000,174,414 | ---- | C] () -- C:\Users\*****\sepia.jpg
[2010/02/22 15:03:33 | 000,140,531 | ---- | C] () -- C:\Users\*****\Stephan Fiederer.pdf
[2010/02/22 15:03:33 | 000,078,408 | ---- | C] () -- C:\Users\*****\Susanne Hanke.pdf
[2010/02/22 15:03:33 | 000,073,317 | ---- | C] () -- C:\Users\*****\Tanja Kohler.pdf
[2010/02/22 15:03:33 | 000,018,602 | ---- | C] () -- C:\Users\*****\Steffen Bockhahn.pdf
[2010/02/22 15:03:32 | 001,669,545 | ---- | C] () -- C:\Users\*****\PICT0800.JPG
[2010/02/22 15:03:32 | 000,137,632 | ---- | C] () -- C:\Users\*****\Rainer Kling.pdf
[2010/02/22 15:03:32 | 000,132,964 | ---- | C] () -- C:\Users\*****\Rainer Klink.pdf
[2010/02/22 15:03:31 | 002,359,350 | ---- | C] () -- C:\Users\*****\PICT0242a.bmp
[2010/02/22 15:03:29 | 009,437,238 | ---- | C] () -- C:\Users\*****\PICT0242.bmp
[2010/02/22 15:03:29 | 000,148,866 | ---- | C] () -- C:\Users\*****\Matthias Schwarz.pdf
[2010/02/22 15:03:29 | 000,050,353 | ---- | C] () -- C:\Users\*****\N.Schönfeld.pdf
[2010/02/22 15:03:29 | 000,040,424 | ---- | C] () -- C:\Users\*****\Michael Staggat.pdf
[2010/02/22 15:03:29 | 000,022,611 | ---- | C] () -- C:\Users\*****\Marsa Alam.nri
[2010/02/22 15:03:28 | 000,060,677 | ---- | C] () -- C:\Users\*****\krigar.pdf
[2010/02/22 15:03:28 | 000,037,676 | ---- | C] () -- C:\Users\*****\KVTWIN.pdf
[2010/02/22 15:03:28 | 000,032,225 | ---- | C] () -- C:\Users\*****\Margit Häfele.pdf
[2010/02/22 15:03:28 | 000,031,065 | ---- | C] () -- C:\Users\*****\Lars Armbruster.pdf
[2010/02/22 15:03:27 | 000,154,345 | ---- | C] () -- C:\Users\*****\Kersten Rohmer.pdf
[2010/02/22 15:03:26 | 000,017,835 | ---- | C] () -- C:\Users\*****\Karl Rothmund.pdf
[2010/02/22 15:03:25 | 010,273,692 | ---- | C] () -- C:\Users\*****\Jessi RV Magazin.pdf
[2010/02/22 15:03:25 | 000,035,104 | ---- | C] () -- C:\Users\*****\Jess und Luke.jpg
[2010/02/22 15:03:17 | 000,016,880 | ---- | C] () -- C:\Users\*****\horgenzell2006.pdf
[2010/02/22 15:03:16 | 000,704,238 | ---- | C] () -- C:\Users\*****\Glck_mit_dem_Wetter_0_.pdf
[2010/02/22 15:03:16 | 000,144,550 | ---- | C] () -- C:\Users\*****\Harald Stockfleht.pdf
[2010/02/22 15:03:16 | 000,067,740 | ---- | C] () -- C:\Users\*****\hofherr, wolfgang.pdf
[2010/02/22 15:03:16 | 000,010,240 | ---- | C] () -- C:\Users\*****\Grupp-Bank2008optimal.wps
[2010/02/22 15:03:15 | 000,059,250 | ---- | C] () -- C:\Users\*****\Geiselmann.pdf
[2010/02/22 15:03:15 | 000,052,390 | ---- | C] () -- C:\Users\*****\Eugen Breith.pdf
[2010/02/22 15:03:15 | 000,019,866 | ---- | C] () -- C:\Users\*****\Fam. Rittler pflege.pdf
[2010/02/22 15:03:14 | 000,148,934 | ---- | C] () -- C:\Users\*****\bw.jpg
[2010/02/22 15:03:14 | 000,080,332 | ---- | C] () -- C:\Users\*****\Christiane Möller.pdf
[2010/02/22 15:03:14 | 000,064,618 | ---- | C] () -- C:\Users\*****\Caroline Berger.pdf
[2010/02/22 15:03:14 | 000,064,505 | ---- | C] () -- C:\Users\*****\Caroline Berger 2.pdf
[2010/02/22 15:03:14 | 000,051,722 | ---- | C] () -- C:\Users\*****\DIE KRISE.pdf
[2010/02/22 15:03:13 | 000,729,658 | ---- | C] () -- C:\Users\*****\Buchungsbestätigung.JPG
[2010/02/22 15:03:13 | 000,593,031 | ---- | C] () -- C:\Users\*****\bluefin[1].pdf
[2010/02/22 15:03:13 | 000,184,844 | ---- | C] () -- C:\Users\*****\blue.jpg
[2010/02/22 15:03:13 | 000,090,035 | ---- | C] () -- C:\Users\*****\Bernd Schatz.pdf
[2010/02/22 15:03:12 | 000,149,282 | ---- | C] () -- C:\Users\*****\bafög.zip
[2010/02/22 15:03:12 | 000,121,285 | ---- | C] () -- C:\Users\*****\Bankmitarbeiterinfo_VVG.pdf
[2010/02/22 15:03:12 | 000,079,528 | ---- | C] () -- C:\Users\*****\bafög2.zip
[2010/02/22 15:03:12 | 000,041,668 | ---- | C] () -- C:\Users\*****\Avartar James Cameron.htm
[2010/02/22 15:03:12 | 000,021,646 | ---- | C] () -- C:\Users\*****\70 jährigr ohne PE.pdf
[2010/02/22 15:03:11 | 000,022,281 | ---- | C] () -- C:\Users\*****\69 jährige ohne PE.pdf

========== ZeroAccess Check ==========

[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/10/04 09:28:22 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\gotomaxx
[2010/11/11 21:32:48 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TeamViewer
[2010/03/15 14:59:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Template
[2010/02/22 15:16:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Thunderbird
[2010/07/23 09:34:28 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Tific
[2012/02/03 15:13:58 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TomTom

========== Purity Check ==========



< End of report >


Extras.txt

OTL Extras logfile created on: 2/3/2013 7:17:46 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\*****\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.96 Gb Total Physical Memory | 1.18 Gb Available Physical Memory | 39.92% Memory free
5.92 Gb Paging File | 4.06 Gb Available in Paging File | 68.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.49 Gb Total Space | 73.12 Gb Free Space | 51.67% Space Free | Partition Type: NTFS
Drive D: | 141.50 Gb Total Space | 140.52 Gb Free Space | 99.31% Space Free | Partition Type: NTFS
Drive E: | 99.82 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: *****-7 | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0005C686-A33B-423A-B59C-97553627AAD4}" = rport=445 | protocol=6 | dir=out | app=system |
"{03E3F9E7-3E84-4079-A68A-316DB80A3C3F}" = lport=137 | protocol=17 | dir=in | app=system |
"{06785053-0E37-4BE8-81C1-108732FF0248}" = rport=137 | protocol=17 | dir=out | app=system |
"{1510DC41-0F3C-4D3B-9A13-B5FEC8D232A4}" = lport=138 | protocol=17 | dir=in | app=system |
"{17A74BC4-D65A-4C3A-9EDB-995D7DAF1F1B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2532B705-569D-43DD-97F0-7DC7866BADC6}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4124D0CA-ECE0-4C11-A1D1-CA9698EB1A05}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 |
"{5209287C-74A4-47EE-A20F-3FE01924E41F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5BD024AE-62D1-4377-9796-2EC8CCF1CF98}" = lport=139 | protocol=6 | dir=in | app=system |
"{6D97190F-5C08-41FD-888D-1582A8152BE8}" = rport=138 | protocol=17 | dir=out | app=system |
"{7326A686-E01D-4C00-AD3C-5CD3FE416877}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 |
"{7CD58C29-55E2-46F3-AFA5-F352D6C0BE35}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7D180019-2E32-4988-B052-433E0AE571D6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7D434896-AC9D-4BAA-B821-0773D2C11C8F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7F03F016-AC68-43C1-8D6B-9FC7016F2DE3}" = lport=445 | protocol=6 | dir=in | app=system |
"{84F0D991-501D-4378-80C6-584F771DC85A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8B62E4E0-E675-49BC-AC52-CEAD5C5E235C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{A2E87285-0AAB-492B-8B96-DA34C4F791B6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA302B38-4B2F-468E-B8CC-A97F0785BC20}" = rport=139 | protocol=6 | dir=out | app=system |
"{AD0A2A9B-3D2F-45BB-829D-6BDA080C1385}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BC4ABC9B-FCB6-4AFF-A7FE-A6CE006835F7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CEED2447-6492-4BF2-9799-ADE9ABEABFAF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D1219BE8-DAFE-4FF2-A0F4-0D6D7DB3270A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D8A7F2CB-E2CB-491D-B86A-5D9A7C6C2106}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D99A02ED-6896-4BD2-8F2A-2DBB379A2F6D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DCC2360F-FA46-4B4F-8FDB-D86D69259775}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FDB0B3DF-D5E7-4584-9C56-7E3493FC8C1B}" = lport=10243 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00754578-6EE4-4408-AC40-F67A125A7057}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{068F0458-C5EA-4AD7-AD30-01BF3A57813C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{17A31DA7-D629-42F9-87E1-29031569F477}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1BD21FD3-7B37-422D-98AB-EFA13BACDE1E}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe |
"{2159400A-5144-4D4F-9C21-9FBAD2D23115}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{241C464A-2FA7-4EBB-ADD2-7F318E500D26}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{305F9C3B-6616-42C0-A09C-602E3015B637}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe |
"{3DB9FF8B-4972-49F1-8B81-8F773684F3FA}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{3DE7E805-B589-49CC-B38E-471F2E5CA9E6}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\devicesetup.exe |
"{486D8870-2E95-4E07-8B5E-B7189C795450}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{4A087178-E575-4006-88AF-E041F0583B84}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4A425126-57AB-4B2B-8038-641B23EE920C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6AEF3D5C-5758-4DA5-A259-B74032C3739D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6D9D1A9C-8D4D-4FAB-9CCD-74395350E2A5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{72B9E09C-EEC0-4EE6-854D-D49D83D1129B}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe |
"{761B7127-3B7E-44E4-8629-A794DCF1C1F1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{808E1420-3E26-400A-A677-295705D86A4B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{822CBFDB-93D4-4E00-9558-F6CFAD28EA45}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{895FD37D-B4E0-46AB-88FB-684517B522C2}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{89AF244B-069E-4226-9122-4FE59142167E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8A3C80AC-10D6-4F30-87C2-B681C004E70E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8C5D737F-9916-4FE8-A040-7F56D40A9B22}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{978B94D9-19F6-4120-931B-42F25C2BDE36}" = dir=in | app=c:\program files\windows live\messenger\wlc*****.exe |
"{9A10ABEA-D2DC-4C40-ADAC-5DE0F8241CE7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{9E09BA18-56CF-4445-919D-AC7A4FA2983B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A205B521-83F6-4514-96C7-5E517A49F92F}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{B53D8DA0-5F76-4E44-ACCE-9C0B5932450D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C29BD9A8-D671-4B1B-AEF0-38C7B82A4031}" = dir=in | app=c:\program files\airport\apagent.exe |
"{C44EF3A6-073A-4905-8B46-5816816745C0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C82FC289-E4FB-40A9-A791-31367D558415}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\hpnetworkcommunicator.exe |
"{CA00BBD0-798F-4513-B758-E651C55A1A2F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E92E9420-C573-4E2D-A9DF-A593DC05ADF3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F0A411FB-4E60-4759-8051-A7A97E9F91E5}" = protocol=6 | dir=out | app=system |
"{F426A254-E1C6-4318-B434-9B526A2F3B68}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01310914-E3B8-40E8-BCF7-9C42E0639A43}" = gotomaxx PDFMAILER
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{10C0E43D-9D84-4DF7-9516-43B74FA5FDEA}" = *****-Komponenten 02/2009
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager
"{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4412F224-3849-4461-A3E9-DEEF8D252790}" = Visual Studio C++ 10.0 Runtime
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{619387A7-F174-457C-9A4F-AB68D928D1A2}" = funkwerk Eumex 401 WIN-Tools V2.00
"{63eafc52-b963-4297-a7eb-d412944e7065}_is1" = Game Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{82583139-4677-11D8-9B7A-D6C20956C046}" = ***** Angebotsprogramm
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}" = Go-Go Gourmet
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2
"{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{98D64F70-1BE2-4E06-A58E-50FF642B3F24}" = HP Officejet Pro 8600 - Grundlegende Software für das Gerät
"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety
"{99CBA603-937D-4058-806F-7A9AF711A1AA}" = Eumex RNDIS Driver V1.00
"{A5675A9E-F073-414A-9A04-F9BCD50459D7}" = Easy Network Manager
"{AA68AAAE-41F0-40B5-8896-5947F5FD6889}" = AirPort
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.3 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{B6F5C6D8-C443-4B55-932F-AE11B5743FC4}" = HP Officejet Pro 8600 Hilfe
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CCC2B140-B47A-45FA-AAE3-BD60DA41AE00}" = Samsung Support Center
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{DA7DF8E2-4B8F-4286-97FE-DE3FFFE9B728}" = iCloud
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E2F2D836-B7DC-401B-8D3B-EF6B0A6F5121}" = *****-BasisRenten-Rechner
"{E33EAB77-A36A-4FBF-BB15-2BBF74C7A796}" = iPhoneBrowser
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"CCleaner" = CCleaner
"ESET Online Scanner" = ESET Online Scanner v3
"FreePDF_XP" = FreePDF (Remove only)
"GOM Player" = GOM Player
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{619387A7-F174-457C-9A4F-AB68D928D1A2}" = funkwerk Eumex 401 WIN-Tools V2.00
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Marvell Miniport Driver" = Marvell Miniport Driver
"Media Player - Codec Pack" = Media Player Codec Pack 3.9.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MyTomTom" = MyTomTom 3.2.0.700
"NIS" = Norton Internet Security
"Norton Utilities 15_is1" = Norton Utilities 15
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 5" = TeamViewer 5
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinZip" = WinZip

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 1/29/2013 3:07:59 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3058
Description =

Error - 1/29/2013 3:07:59 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7010
Description =

Error - 1/29/2013 9:16:02 AM | Computer Name = *****-7 | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Samsung\Samsung
Support Center\Drv\drv2x64\KStartMem.exe.Manifest". Die abhängige Assemblierung
"Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".

Error - 1/29/2013 9:16:23 AM | Computer Name = *****-7 | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Samsung\BatteryLifeExtender\Drv\SABI2x64\KStartMem.exe.Manifest".
Die
abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".

Error - 1/31/2013 2:46:46 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3038
Description =

Error - 1/31/2013 2:46:46 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7040
Description =

Error - 1/31/2013 2:46:46 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7042
Description =

Error - 1/31/2013 2:46:53 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3028
Description =

Error - 1/31/2013 2:46:53 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 3058
Description =

Error - 1/31/2013 2:46:53 AM | Computer Name = *****-7 | Source = Windows Search Service | ID = 7010
Description =

[ Spybot - Search and Destroy Events ]
Error - 2/2/2013 6:29:02 AM | Computer Name = *****-7 | Source = SDCleaner | ID = 100
Description = LoadCleaningInstructions

[ System Events ]
Error - 2/2/2013 7:41:45 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058

Error - 2/2/2013 7:50:09 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058

Error - 2/2/2013 8:01:54 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058

Error - 2/2/2013 8:08:39 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058

Error - 2/2/2013 8:33:23 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error - 2/2/2013 8:39:32 AM | Computer Name = *****-7 | Source = BROWSER | ID = 8032
Description =

Error - 2/2/2013 9:04:43 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error - 2/2/2013 9:13:02 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error - 2/2/2013 10:21:27 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058

Error - 2/3/2013 1:28:11 AM | Computer Name = *****-7 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058


< End of report >



gmer.txt


GMER 2.0.18454 - hxxp://www.gmer.net
Rootkit scan 2013-02-03 07:45:44
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB
Running: gmer_2.0.18454.exe; Driver: C:\Users\*****\AppData\Local\Temp\ugldypow.sys


---- System - GMER 2.0 ----

SSDT 87277218 ZwAlertResumeThread
SSDT 872772F8 ZwAlertThread
SSDT 87274678 ZwAllocateVirtualMemory
SSDT 871E5408 ZwAlpcConnectPort
SSDT 87277970 ZwAssignProcessToJobObject
SSDT 87277F18 ZwCreateMutant
SSDT 87277690 ZwCreateSymbolicLinkObject
SSDT 87272468 ZwCreateThread
SSDT 87277780 ZwCreateThreadEx
SSDT 87277A50 ZwDebugActiveProcess
SSDT 870D1E28 ZwDuplicateObject
SSDT 87272960 ZwFreeVirtualMemory
SSDT 87277058 ZwImpersonateAnonymousToken
SSDT 87277138 ZwImpersonateThread
SSDT 871E4C70 ZwLoadDriver
SSDT 87272860 ZwMapViewOfSection
SSDT 87277E38 ZwOpenEvent
SSDT 87274880 ZwOpenProcess
SSDT 872716B0 ZwOpenProcessToken
SSDT 87277C78 ZwOpenSection
SSDT 872722A8 ZwOpenThread
SSDT 87277880 ZwProtectVirtualMemory
SSDT 87277400 ZwResumeThread
SSDT 872762C0 ZwSetContextThread
SSDT 872763A0 ZwSetInformationProcess
SSDT 87277B30 ZwSetSystemInformation
SSDT 87277D58 ZwSuspendProcess
SSDT 87276100 ZwSuspendThread
SSDT 87274720 ZwTerminateProcess
SSDT 872761E0 ZwTerminateThread
SSDT 87272780 ZwUnmapViewOfSection
SSDT 87272A50 ZwWriteVirtualMemory

---- Kernel code sections - GMER 2.0 ----

.text ntoskrnl.exe!ZwRollbackEnlistment + 1401 8304E9C9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 8306E4E2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 13A3 83075760 6 Bytes [18, 72, 27, 87, F8, 72]
.text ntoskrnl.exe!KeRemoveQueueEx + 13AA 83075767 1 Byte [87]
.text ntoskrnl.exe!KeRemoveQueueEx + 13BB 83075778 4 Bytes [78, 46, 27, 87]
.text ntoskrnl.exe!KeRemoveQueueEx + 13C7 83075784 4 Bytes [08, 54, 1E, 87] {OR [ESI+EBX-0x79], DL}
.text ntoskrnl.exe!KeRemoveQueueEx + 141B 830757D8 4 Bytes [70, 79, 27, 87]
.text ...

---- User code sections - GMER 2.0 ----

.text C:\Program Files\CyberLink\Shared files\RichVideo.exe[404] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\CyberLink\Shared files\RichVideo.exe[404] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003F0930
.text C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe[444] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe[444] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003A0AF4
.text C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe[716] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe[716] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 002F0AF4
.text C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe[1212] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Common Files\Apple\Internet Services\ubd.exe[1684] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Common Files\Apple\Internet Services\ubd.exe[1684] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 002F0930
.text C:\Program Files\Bonjour\mDNSResponder.exe[1764] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Bonjour\mDNSResponder.exe[1764] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 000F0930
.text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[1788] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[1788] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0AF4
.text C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe[1792] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0048004C
.text C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 005A0AF4
.text C:\Program Files\AirPort\APAgent.exe[2464] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 001F004C
.text C:\Program Files\AirPort\APAgent.exe[2464] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00210AF4
.text C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe[2796] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe[2796] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 000F0930
.text C:\Program Files\TrayBackup\traybackup.exe[2884] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\TrayBackup\traybackup.exe[2884] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003E0930
.text C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe[2904] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe[2904] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930
.text C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2912] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2912] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00300930
.text C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe[2980] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe[2980] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00080AF4
.text C:\Program Files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrvProxy.exe[3004] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrvProxy.exe[3192] kernel32.dll!SetUnhandledExceptionFilter 7592F4FB 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe[3264] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe[3264] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930
.text C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe[3324] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe[3324] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180930
.text C:\Program Files\TeamViewer\Version5\TeamViewer.exe[3336] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\TeamViewer\Version5\TeamViewer.exe[3336] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0AF4
.text C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe[3344] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 001E004C
.text C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe[3344] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00200930
.text C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe[3356] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe[3356] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00080048
.text C:\windows\system32\igfxext.exe[3564] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\windows\system32\igfxext.exe[3564] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930
.text C:\windows\system32\igfxsrvc.exe[3600] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\windows\system32\igfxsrvc.exe[3600] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180930
.text C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe[3924] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0014004C
.text C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe[3924] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180930
.text C:\Program Files\AnyPC Client\APLangApp.exe[3996] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\AnyPC Client\APLangApp.exe[3996] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00180048
.text C:\Windows\System32\igfxtray.exe[4012] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 001E004C
.text C:\Windows\System32\igfxtray.exe[4012] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00200930
.text C:\Windows\System32\hkcmd.exe[4028] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 002E004C
.text C:\Windows\System32\hkcmd.exe[4028] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00440930
.text C:\Windows\System32\igfxpers.exe[4040] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0017004C
.text C:\Windows\System32\igfxpers.exe[4040] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 00440930
.text C:\Users\*****\Desktop\gmer_2.0.18454.exe[4836] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Users\*****\Desktop\gmer_2.0.18454.exe[4836] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 001F0930
.text C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe[4932] ntdll.dll!NtTerminateThread 772068D8 5 Bytes JMP 0002004C
.text C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe[4932] USER32.dll!RecordShutdownReason + 372 771406C2 7 Bytes JMP 003B0AF4

---- User IAT/EAT - GMER 2.0 ----

IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\windows\system32\rundll32.exe[1656] @ C:\windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\advapi32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\crypt32.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe[2076] @ C:\windows\system32\wininet.dll [KERNEL32.dll!GetProcAddress] [7528FFF6] C:\windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73FA24CB] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73F8562E] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73F856EC] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipFree] [73FA2546] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73F985AA] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73F94D5E] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73F95105] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73F951DA] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73F96707] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73F98301] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73F98850] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73F990B1] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73F9E254] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\windows\Explorer.EXE[3144] @ C:\windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73F94C90] C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- EOF - GMER 2.0 ----


malwarebytes hat nichts gefunden

Bitte um Hilfe, da ich den Rechner ungern neu aufsetzen möchte

Vielen Dank im Voraus

abaldus