Pc gehackt von Rechten

Apedape · 12.02.2013, 16:00

Hallo Trojaner Boarder,

mein Pc wurde durch meine freundlichen Nachharn des Heimatschutzes kompromittiert.

Martialische Klänge Drohungen und Häme kann ich über meine Lautsprecher vernehmen der übliche tumpe stumpfe Blödsinn eben...

Sie wohnen direkt neben an und müssen das Wlan gehackt haben...

Wie kann man sowas überhaupt erreichen ? Habe nämlich nichts installiert oder dergleichen also persönlich keine reg Ändrung hervorgerufen.

Weitere Symptome sind: Lautsprecher haben einen sehr geringen Ausgabepegel rechne fest damit das die den plötzlich mal hochschrauben

Sicherheitssoftware wird teilweise ausgeschaltet

2 Festplatten sind abgeraucht

Kommentare zu den Inhalten die ich mir grad anschaue

Ich hab den Pc noch nich platt gemacht gibt es Möglichkeiten der Rückverfolgung ? Naja die Jungs sind sicher pfiffig genug für ein proxy...

Frage zum Neuaufsetzen wie schütze ich mich in zukunft dagegen ?

Welche dateien sollte ich löschen hoffe mal nur .exe dateien dokumente pdf filme bilder und images wär heftig!

Wie kann ich windows so einrichten, dass bestimmmte Programme updates beziehen können / einstellungsänderungen von diesen gespeichert werden sowie downloads und erstellte text dokumente... aber ben reg Änderungen immer wieder zurückgenommen werden so dae ich bei jedem Start wieder safe wäre....

Am liebsten würde ich mir ein Antifa gegenhacker organisieren den Pc überhitzen oder sowas...

Ach so schön...

Bitte um Hilfe

markusg · 12.02.2013, 16:29

Hi
frage, wie ist dein wlan verschlüsselt? wpa wpa2, web, gar nicht?
2.
schaun wir uns den PC erst mal an.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Apedape · 12.02.2013, 22:13

Also Korrektur ich hänge per Ethernet Kabel an der Fritzbox WLAN-F7170 UPnP/1.0 AVM FRITZ!Box Fon WLAN 7170 (UI) 29.04.87....

Die Log Datei

OTL.txt

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 12.02.2013 21:34:26 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Workstation\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
11,98 Gb Total Physical Memory | 9,98 Gb Available Physical Memory | 83,29% Memory free
23,97 Gb Paging File | 21,98 Gb Available in Paging File | 91,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 907,29 Gb Total Space | 844,95 Gb Free Space | 93,13% Space Free | Partition Type: NTFS
Drive D: | 465,75 Gb Total Space | 1,09 Gb Free Space | 0,23% Space Free | Partition Type: NTFS
Drive E: | 24,22 Gb Total Space | 13,05 Gb Free Space | 53,88% Space Free | Partition Type: NTFS
Drive F: | 100,00 Mb Total Space | 69,87 Mb Free Space | 69,87% Space Free | Partition Type: NTFS
Drive G: | 24,41 Gb Total Space | 17,08 Gb Free Space | 69,98% Space Free | Partition Type: NTFS
Drive H: | 443,13 Gb Total Space | 368,19 Gb Free Space | 83,09% Space Free | Partition Type: NTFS
Drive I: | 463,87 Gb Total Space | 236,51 Gb Free Space | 50,99% Space Free | Partition Type: NTFS
Drive J: | 2,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: WORKSTATION-PC | User Name: Workstation | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Workstation\Desktop\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
PRC - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\chrome.exe (Google Inc.)
PRC - C:\Users\Workstation\Desktop\GoogleChromePortable\GoogleChromePortable.exe (PortableApps.com)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe (Gigabyte Technology CO., LTD.)
PRC - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe (Gigabyte Technology CO., LTD.)
PRC - C:\Program Files (x86)\gigabyte\EnergySaver2\des2svr.exe ()
PRC - C:\Program Files (x86)\gigabyte\ET6\GUI.exe ()
PRC - C:\Windows\LOGI_MWX.EXE (Logitech Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\pdf.dll ()
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\libglesv2.dll ()
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\libegl.dll ()
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\avutil-51.dll ()
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\avformat-54.dll ()
MOD - C:\Users\Workstation\Desktop\GoogleChromePortable\App\Chrome-bin\23.0.1271.97\avcodec-54.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\26e0457a9776a0e9f23e3986686d90a5\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\63bc6e391de5014965039e100ce1e9d5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\Normal.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\GVTunner.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\StabilityLib.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\SF.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\OCK.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\work.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\MFCCPU.DLL ()
MOD - C:\Program Files (x86)\gigabyte\ET6\HM.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\GPTT.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\IccLibDll.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\AMD8.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\Platform.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\Device.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\gigabyte\ET6\ycc.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\CIAMIB.dll ()
MOD - C:\Program Files (x86)\gigabyte\ET6\GUI.exe ()
MOD - C:\Program Files (x86)\gigabyte\ET6\Sound.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx)
SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (SbieSvc) -- C:\Programme\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe (Symantec Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (Smart TimeLock) -- C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe (Gigabyte Technology CO., LTD.)
SRV - (IGDCTRL) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (DES2 Service) -- C:\Program Files (x86)\gigabyte\EnergySaver2\des2svr.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (pxrts) -- C:\Windows\SysNative\drivers\pxrts.sys (Prevx)
DRV:64bit: - (pxscan) -- C:\Windows\SysNative\drivers\pxscan.sys (Prevx)
DRV:64bit: - (pxkbf) -- C:\Windows\SysNative\drivers\pxkbf.sys (Prevx)
DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymIM) -- C:\Windows\SysNative\drivers\SymIMV.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\ironx64.sys (Symantec Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\symds64.sys (Symantec Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)
DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (mv91xxr) -- C:\Windows\SysNative\drivers\mv91xxr.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\39D9.tmp (Sophos Plc)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ZCinema_TSHD_x64) -- C:\Windows\SysNative\drivers\ZCinema_SRS_amd64.sys (SRS Labs, Inc.)
DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130211.003\ex64.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130211.003\eng64.sys (Symantec Corporation)
DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20130116.013\BHDrvx64.sys (Symantec Corporation)
DRV - (SbieDrv) -- C:\Programme\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D)
DRV - (etdrv) -- C:\Windows\etdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20130209.002\IDSviA64.sys (Symantec Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (UnlockerDriver5) -- C:\Programme\Unlocker\UnlockerDriver5.sys ()
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (DgiVecp) -- C:\Windows\SysWOW64\drivers\Dgivecp.sys (DeviceGuys, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = GMX - E-Mail, FreeMail, De-Mail, Themen- & Shopping-Portal - kostenlos
IE - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A1 DD 3F 54 51 B5 CD 01  [binary data]
IE - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: add-to-searchbox%40maltekraus.de:2.0
FF - prefs.js..extensions.enabledAddons: google%40disconnect.me:2.4.2
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: restart%40restart.org:0.5
FF - prefs.js..extensions.enabledAddons: trackerblock%40privacychoice.org:2.2
FF - prefs.js..extensions.enabledAddons: trackmenot%40mrl.nyu.edu:0.6.728
FF - prefs.js..extensions.enabledAddons: %7B37E4D8EA-8BDA-4831-8EA1-89053939A250%7D:3.0.0.2
FF - prefs.js..extensions.enabledAddons: %7B455D905A-D37C-4643-A9E2-F6FEFAA0424A%7D:0.8.16
FF - prefs.js..extensions.enabledAddons: %7B987311C6-B504-4aa2-90BF-60CC49808D42%7D:2.2
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7Be968fc70-8f95-4ab9-9e79-304de2a66ee1%7D:2.6.8
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.8.4
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.5
FF - prefs.js..extensions.enabledAddons: client%40anonymox.net:1.0.1
FF - prefs.js..extensions.enabledAddons: stefanvandamme%40stefanvd.net:2.1.0.26
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.4.3
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130116
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Program Files\VideoLAN\VLC\npvlc.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPlgn\ [2012.10.29 00:53:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\coFFPlgn\ [2013.02.12 21:13:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2013.02.01 21:13:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.02 00:42:49 | 000,000,000 | ---D | M]
 
[2012.10.28 17:19:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\Extensions
[2013.02.01 21:09:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\Firefox\Profiles\3akmfbcr.default\extensions
[2013.01.18 02:10:57 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Workstation\AppData\Roaming\mozilla\Firefox\Profiles\3akmfbcr.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2013.02.01 21:09:09 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Workstation\AppData\Roaming\mozilla\Firefox\Profiles\3akmfbcr.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.01.18 02:10:58 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Workstation\AppData\Roaming\mozilla\Firefox\Profiles\3akmfbcr.default\extensions\firefox@ghostery.com
[2012.10.28 20:35:29 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Workstation\AppData\Roaming\mozilla\Firefox\Profiles\3akmfbcr.default\extensions\ich@maltegoetz.de
[2012.11.14 18:10:30 | 000,124,993 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\adblockpopups@jessehakanen.net.xpi
[2012.10.28 20:47:50 | 000,025,781 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\add-to-searchbox@maltekraus.de.xpi
[2013.02.01 21:09:09 | 000,363,736 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\client@anonymox.net.xpi
[2012.12.28 14:47:01 | 000,051,721 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\GlassMyFox@ArisT2_Noia4dev.xpi
[2012.10.28 20:35:29 | 000,039,030 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\google@disconnect.me.xpi
[2012.10.28 20:35:30 | 000,032,637 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\restart@restart.org.xpi
[2013.01.02 01:14:35 | 000,281,602 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\sharemenot@franziroesner.com.xpi
[2013.02.01 21:09:09 | 000,636,472 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\stefanvandamme@stefanvd.net.xpi
[2012.10.28 20:35:30 | 000,049,540 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\trackerblock@privacychoice.org.xpi
[2012.10.28 20:35:30 | 000,067,428 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\trackmenot@mrl.nyu.edu.xpi
[2012.10.28 20:47:50 | 000,164,858 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.xpi
[2012.10.28 20:35:30 | 000,075,799 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{455D905A-D37C-4643-A9E2-F6FEFAA0424A}.xpi
[2013.02.01 21:09:09 | 000,533,221 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.10.28 20:35:30 | 000,022,573 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42}.xpi
[2012.12.10 01:19:04 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.28 20:35:30 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2012.10.28 20:35:30 | 000,096,720 | ---- | M] () (No name found) -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a66ee1}.xpi
[2012.10.29 01:16:49 | 000,002,057 | ---- | M] () -- C:\Users\Workstation\AppData\Roaming\mozilla\firefox\profiles\3akmfbcr.default\searchplugins\youtube-videosuche.xml
[2013.01.02 00:42:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.11.29 09:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Logitech Utility] C:\Windows\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
O4 - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKU\S-1-5-21-1771643477-1146958064-2204180624-1000..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O4 - HKLM..\RunOnce: [DES2] C:\Program Files (x86)\gigabyte\EnergySaver2\des2.exe ()
O4 - HKLM..\RunOnce: [EasyTuneVI] C:\Program Files (x86)\gigabyte\ET6\ETCall.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Workstation\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z Cinema.lnk = C:\Users\Workstation\AppData\Roaming\Microsoft\Installer\{6E166235-49F3-4DFA-A102-1E86675ABD11}\StartupShortcut_6E16623549F34DFAA1021E86675ABD11.exe (Macrovision Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\FRITZ!DSL\\sarah.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files\FRITZ!DSL\\sarah.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files\FRITZ!DSL\\sarah.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files\FRITZ!DSL\\sarah.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000014 - C:\Program Files\FRITZ!DSL\\sarah.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A67BBA8A-FA27-4D23-AAC5-17F38ED5B187}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.08.03 14:55:52 | 000,000,000 | ---D | M] - D:\Autoupdates -- [ NTFS ]
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.07.14 12:08:11 | 000,000,043 | R--- | M] () - J:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{bd177729-2117-11e2-80e0-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{bd177729-2117-11e2-80e0-806e6f6e6963}\Shell\AutoRun\command - "" = J:\setup.exe -- [2009.07.14 12:08:11 | 000,111,880 | R--- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.12 21:18:03 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Workstation\Desktop\OTL (1).exe
[2013.02.12 04:38:27 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Workstation\Desktop\HijackThis.exe
[2013.02.12 04:26:23 | 000,062,976 | ---- | C] (Prevx) -- C:\Windows\SysWow64\PxSecure.dll
[2013.02.12 04:26:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prevx 3.0
[2013.02.12 04:26:22 | 000,065,736 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxrts.sys
[2013.02.12 04:26:22 | 000,036,384 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxscan.sys
[2013.02.12 04:26:21 | 000,024,024 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxkbf.sys
[2013.02.12 04:26:21 | 000,000,000 | ---D | C] -- C:\Program Files\Prevx
[2013.02.12 04:26:01 | 000,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI
[2013.02.12 04:24:50 | 000,945,272 | ---- | C] (Prevx) -- C:\Users\Workstation\Desktop\prevxcsifree.exe
[2013.02.11 23:11:21 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2013.02.03 23:19:13 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Local\Criterion Games
[2013.02.03 23:07:37 | 000,000,000 | ---D | C] -- C:\Users\Workstation\Documents\BFBC2
[2013.02.03 22:49:05 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Local\SKIDROW
[2013.02.03 22:49:05 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Roaming\DarknessII
[2013.02.03 22:48:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield
[2013.02.03 22:48:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.02.03 22:48:04 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2013.02.03 22:38:49 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2013.02.03 22:38:17 | 000,000,000 | ---D | C] -- C:\Users\Workstation\Documents\My Games
[2013.02.03 22:37:41 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Local\2K Games
[2013.02.03 22:35:53 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Roaming\NVIDIA
[2013.02.03 22:35:27 | 000,000,000 | -HSD | C] -- C:\ProgramData\SecuROM
[2013.02.03 22:35:22 | 000,000,000 | ---D | C] -- C:\Users\Workstation\AppData\Local\Ascaron Entertainment
[2013.02.03 22:25:29 | 000,000,000 | ---D | C] -- C:\ProgramData\TrackMania
[2013.02.03 22:25:24 | 000,000,000 | ---D | C] -- C:\Users\Workstation\Documents\TrackMania
[2013.02.01 21:13:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2013.02.01 21:13:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.01.29 22:41:43 | 000,000,000 | ---D | C] -- C:\Users\Workstation\Desktop\Kaufen für neue Wohnung
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.12 21:19:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Workstation\Desktop\OTL (1).exe
[2013.02.12 21:18:46 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.12 21:18:46 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.12 21:17:29 | 000,740,458 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.12 21:17:29 | 000,664,906 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.12 21:17:29 | 000,161,682 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.12 21:17:29 | 000,133,262 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.12 21:17:29 | 000,006,256 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.12 21:11:38 | 000,030,528 | ---- | M] () -- C:\Windows\GVTDrv64.sys
[2013.02.12 21:11:38 | 000,000,004 | ---- | M] () -- C:\Windows\SysWow64\GVTunner.ref
[2013.02.12 21:11:25 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys
[2013.02.12 21:11:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.12 21:11:08 | 1060,462,590 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.12 05:31:57 | 000,001,766 | ---- | M] () -- C:\Windows\Sandboxie.ini
[2013.02.12 04:52:31 | 000,365,568 | ---- | M] () -- C:\Users\Workstation\Desktop\gmer_2.0.18454.exe
[2013.02.12 04:38:28 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Workstation\Desktop\HijackThis.exe
[2013.02.12 04:34:22 | 002,768,572 | ---- | M] () -- C:\Users\Workstation\Desktop\Snort_2_9_4_Installer.exe
[2013.02.12 04:26:23 | 000,062,976 | ---- | M] (Prevx) -- C:\Windows\SysWow64\PxSecure.dll
[2013.02.12 04:26:22 | 000,065,736 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxrts.sys
[2013.02.12 04:26:22 | 000,036,384 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxscan.sys
[2013.02.12 04:26:21 | 000,024,024 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxkbf.sys
[2013.02.12 04:24:55 | 000,945,272 | ---- | M] (Prevx) -- C:\Users\Workstation\Desktop\prevxcsifree.exe
[2013.02.07 22:16:58 | 000,002,512 | ---- | M] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2013.02.07 22:16:43 | 001,426,343 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\Cat.DB
[2013.02.07 22:16:31 | 000,014,818 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\VT20130115.021
[2013.02.02 07:12:08 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\isolate.ini
[2013.02.01 21:13:55 | 000,001,413 | ---- | M] () -- C:\Users\Workstation\Desktop\Free YouTube to MP3 Converter.lnk
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.12 04:52:29 | 000,365,568 | ---- | C] () -- C:\Users\Workstation\Desktop\gmer_2.0.18454.exe
[2013.02.12 04:34:10 | 002,768,572 | ---- | C] () -- C:\Users\Workstation\Desktop\Snort_2_9_4_Installer.exe
[2013.02.07 22:16:58 | 000,002,512 | ---- | C] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2013.02.01 21:13:55 | 000,001,413 | ---- | C] () -- C:\Users\Workstation\Desktop\Free YouTube to MP3 Converter.lnk
[2012.10.28 20:10:49 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\SvcMan.exe
[2012.10.28 20:10:49 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\w2kusbif.dll
[2012.10.28 20:10:49 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\UninFolder.dll
[2012.10.28 20:10:49 | 000,011,692 | ---- | C] () -- C:\Windows\SysWow64\SSUSBOPN.DLL
[2012.10.28 20:09:16 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\getpntid.exe
[2012.10.28 20:09:16 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\wcp412p6.dll
[2012.10.28 20:09:16 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\watchPnp.exe
[2012.10.28 20:09:16 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\Permission.exe
[2012.10.28 20:08:43 | 000,270,336 | ---- | C] () -- C:\Windows\StoPC.dll
[2012.10.28 20:08:43 | 000,135,104 | ---- | C] () -- C:\Windows\Tab16d20.dll
[2012.10.28 20:08:43 | 000,102,400 | ---- | C] () -- C:\Windows\dll32.dll
[2012.10.28 20:08:43 | 000,102,400 | ---- | C] () -- C:\Windows\dll2kusb.dll
[2012.10.28 20:08:43 | 000,081,920 | ---- | C] () -- C:\Windows\Scan2pcUI.exe
[2012.10.28 20:08:43 | 000,057,344 | ---- | C] () -- C:\Windows\ScanToPc.exe
[2012.10.28 20:08:43 | 000,048,176 | ---- | C] () -- C:\Windows\Imp16d20.dll
[2012.10.28 20:08:43 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\usbprn.dll
[2012.10.28 20:08:43 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\scanx.dll
[2012.10.28 20:08:43 | 000,028,672 | ---- | C] () -- C:\Windows\UnInstScan.dll
[2012.10.28 20:08:43 | 000,028,672 | ---- | C] () -- C:\Windows\SSTHUNK.DLL
[2012.10.28 20:08:43 | 000,024,576 | ---- | C] () -- C:\Windows\NTFAX.EXE
[2012.10.28 20:08:43 | 000,012,800 | ---- | C] () -- C:\Windows\SS16FT.DLL
[2012.10.28 20:08:43 | 000,011,079 | ---- | C] () -- C:\Windows\LxUsbOpn.dll
[2012.10.28 20:08:43 | 000,002,554 | ---- | C] () -- C:\Windows\SSDS16.INI
[2012.10.28 20:08:43 | 000,002,552 | ---- | C] () -- C:\Windows\SSDS32.INI
[2012.10.28 20:08:43 | 000,002,269 | ---- | C] () -- C:\Windows\SSDEF32.INI
[2012.10.28 20:08:43 | 000,002,267 | ---- | C] () -- C:\Windows\SSDEF16.INI
[2012.10.28 20:08:43 | 000,000,029 | ---- | C] () -- C:\Windows\MyScan.ini
[2012.10.28 19:11:02 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2012.10.28 19:02:05 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2012.10.28 18:55:41 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2012.10.28 17:49:39 | 001,589,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.28 17:36:14 | 000,001,766 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2012.09.26 20:57:16 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.09.26 20:57:14 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.09.26 20:57:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.09.26 20:57:14 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.09 22:54:30 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\Babylon
[2013.02.03 23:07:02 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\DarknessII
[2013.02.01 21:13:50 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\DVDVideoSoft
[2013.02.01 21:13:59 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\DVDVideoSoftIEHelpers
[2013.02.12 05:36:45 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\FRITZ!
[2012.10.28 17:47:18 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\Leadertech
[2013.02.12 21:36:50 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\NetSpeedMonitor
[2012.12.26 23:03:48 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\Samsung
[2013.02.12 20:51:50 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\Stardock
[2012.10.28 22:42:53 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\Trillian
[2012.10.28 21:24:34 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\TuneUp Software
[2012.11.12 18:59:55 | 000,000,000 | ---D | M] -- C:\Users\Workstation\AppData\Roaming\XnView
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

Extras.txt

OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 12.02.2013 21:34:26 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Workstation\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
11,98 Gb Total Physical Memory | 9,98 Gb Available Physical Memory | 83,29% Memory free
23,97 Gb Paging File | 21,98 Gb Available in Paging File | 91,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 907,29 Gb Total Space | 844,95 Gb Free Space | 93,13% Space Free | Partition Type: NTFS
Drive D: | 465,75 Gb Total Space | 1,09 Gb Free Space | 0,23% Space Free | Partition Type: NTFS
Drive E: | 24,22 Gb Total Space | 13,05 Gb Free Space | 53,88% Space Free | Partition Type: NTFS
Drive F: | 100,00 Mb Total Space | 69,87 Mb Free Space | 69,87% Space Free | Partition Type: NTFS
Drive G: | 24,41 Gb Total Space | 17,08 Gb Free Space | 69,98% Space Free | Partition Type: NTFS
Drive H: | 443,13 Gb Total Space | 368,19 Gb Free Space | 83,09% Space Free | Partition Type: NTFS
Drive I: | 463,87 Gb Total Space | 236,51 Gb Free Space | 50,99% Space Free | Partition Type: NTFS
Drive J: | 2,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: WORKSTATION-PC | User Name: Workstation | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1771643477-1146958064-2204180624-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
"AntiVirusDisableNotify" = 1
"AntiSpyWareDisableNotify" = 1
"InternetSettingsDisableNotify" = 0
"UacDisableNotify" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00B4BDCB-8E1A-4B0E-AF37-2CB1A510D14C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{0594DEF1-1C44-4976-B707-6AA692E80570}" = lport=445 | protocol=6 | dir=in | app=system | 
"{0792579F-DE85-4591-BAAE-72C099EB01B6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{13638C9D-E819-4D24-82CC-CE678D4E29CB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{22503B29-A2EE-4400-8086-1CDE6DBED364}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{3E1ADCC2-2131-4A19-9F7C-F7309CBF4D89}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5AB7B93E-6BA6-4516-B183-CBA9E09AC546}" = rport=138 | protocol=17 | dir=out | app=system | 
"{948E6A2D-6F8F-447C-95EF-4F05030EB327}" = rport=137 | protocol=17 | dir=out | app=system | 
"{96F859A7-062E-4C89-A75C-6E1D5D33DD81}" = rport=445 | protocol=6 | dir=out | app=system | 
"{A6DBEE2F-2A89-46B6-9E34-CF18400572F2}" = rport=139 | protocol=6 | dir=out | app=system | 
"{A933F77C-0F69-4FD8-B0C8-8583DE27A63A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{C20907CF-C29E-420B-82B2-BD90DC499381}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
"{D59B47C7-8BA8-4D42-A183-C20736DF2AAC}" = lport=139 | protocol=6 | dir=in | app=system | 
"{EA6C9D22-4807-4AE6-A75F-CF5D9215E961}" = lport=138 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01D7F261-E9CF-417B-81F0-805132ADB301}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{034FFCB4-2F14-4F6B-9E74-96BAF4BA96ED}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{04233355-49A4-4B37-9482-70132D2F0DCF}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{348B3685-0520-4D1A-B657-2CDFD8CFD099}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{35AFB5CD-2F29-4E2D-8B3B-DB67D86F8F5F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{36EF8A11-5B97-4B62-98DF-3DA1EC9AA701}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{49D7DBC1-6B56-4D18-B67A-2D0D1F67CB55}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{5CBEB99D-52BD-4A96-9167-F83497BE8F69}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{5D885547-733C-4CC9-A863-48DA2511C487}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{7396FD7B-5BC8-4E24-9CDD-ADEAB2DED88F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{8383EA32-D542-4D40-839B-1DDEDF0EBB07}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"{8F9E07B2-8B25-4EA6-955F-7B2E713C1A27}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{A4C744FE-6A5B-4299-9BE0-069036527CD1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{A4E184A6-A6B4-4BE2-BB33-2CF70E3FC201}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{D322256D-F95D-4195-A972-735FA9270428}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{D7309C4C-E484-4D0B-8159-3DFB296365D2}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{D81894BA-D1BB-489A-9B6E-E4FE8D2F6754}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{D8E9AB89-924B-44BB-8F55-1887F0D73DB1}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{EB017F26-F63F-4D02-87FC-06E3F61E0F00}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{E84B94AD-5A8F-4AA2-A44C-D2208EA2BE3B}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{9163AE51-F765-4A0A-A794-539875D5417F}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC4
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{2D5D9603-22CF-4B99-83F6-0CD20330F62E}" = FRITZ!DSL64
"{6E166235-49F3-4DFA-A102-1E86675ABD11}" = Z Cinema
"{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}" = NetSpeedMonitor 2.5.4.0 x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{C7311329-C491-427B-8880-133E84869B3A}" = Vista Shortcut Manager x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D285FC5F-3021-32E9-9C59-24CA325BDC5C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"PCSI" = Prevx
"Sandboxie" = Sandboxie 3.76 (64-bit)
"Unlocker" = Unlocker 1.9.1-x64
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{3B35725F-C623-4A1E-B5CC-99C0868679E3}" = Smart 6 B11.0512.1
"{3DECD372-76A1-4483-BF10-B547790A3261}" = ON_OFF Charge B11.0110.1
"{457D7505-D665-4F95-91C3-ECB8C56E9ACA}" = Easy Tune 6 B11.0309.1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79 
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{675F86A8-E093-4002-87D5-915CC2C45571}" = DES 2.0
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{9AFB818D-8B5D-4F06-B46D-4577DD2F5BF5}" = Desk Drive
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_952" = Adobe Acrobat 9.5.2 - CPSID_83708
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C75FAD21-EC08-42F3-92D6-C9C0AB355345}" = AutoGreen B10.1021.1
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4811919-F252-4B25-9AB2-8859A85810B5}" = TuneUp Utilities Language Pack (de-DE)
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"EasyBCD" = EasyBCD 2.0
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.0.128
"InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}" = Easy Tune 6 B11.0309.1
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}" = AutoGreen B10.1021.1
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"NIS" = Norton Internet Security
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.0
"SpeedFan" = SpeedFan (remove only)
"SpywareBlaster_is1" = SpywareBlaster 4.6
"The KMPlayer" = The KMPlayer (remove only)
"Trillian" = Trillian
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"VirtualCloneDrive" = VirtualCloneDrive
"Xerox WorkCentre Pro 412 PCL 6" = Xerox WorkCentre Pro 412 PCL 6
"Xerox WorkCentre Pro 412 Scan" = Twain Driver Uninstaller
"XnView_is1" = XnView 1.99.5
"xp-AntiSpy" = xp-AntiSpy 3.98-2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1771643477-1146958064-2204180624-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 03.02.2013 00:02:51 | Computer Name = Workstation-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files
 (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 03.02.2013 09:14:21 | Computer Name = Workstation-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.02.2013 09:37:29 | Computer Name = Workstation-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.02.2013 17:16:54 | Computer Name = Workstation-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.02.2013 17:37:43 | Computer Name = Workstation-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: mafia2.exe, Version: 1.0.0.1, Zeitstempel:
 0x4c6d595d  Name des fehlerhaften Moduls: mafia2.exe, Version: 1.0.0.1, Zeitstempel:
 0x4c6d595d  Ausnahmecode: 0xc0000005  Fehleroffset: 0x007624bf  ID des fehlerhaften Prozesses:
 0xd4  Startzeit der fehlerhaften Anwendung: 0x01ce0256b2215926  Pfad der fehlerhaften
 Anwendung: I:\Mafia II\pc\mafia2.exe  Pfad des fehlerhaften Moduls: I:\Mafia II\pc\mafia2.exe
Berichtskennung:
 f0806b3a-6e49-11e2-8a98-50e549305c46
 
Error - 03.02.2013 17:37:59 | Computer Name = Workstation-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: mafia2.exe, Version: 1.0.0.1, Zeitstempel:
 0x4c6d595d  Name des fehlerhaften Moduls: mafia2.exe, Version: 1.0.0.1, Zeitstempel:
 0x4c6d595d  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0121f5e3  ID des fehlerhaften Prozesses:
 0xfd0  Startzeit der fehlerhaften Anwendung: 0x01ce0256bc7ac45e  Pfad der fehlerhaften
 Anwendung: I:\Mafia II\pc\mafia2.exe  Pfad des fehlerhaften Moduls: I:\Mafia II\pc\mafia2.exe
Berichtskennung:
 fa548963-6e49-11e2-8a98-50e549305c46
 
Error - 04.02.2013 17:16:05 | Computer Name = Workstation-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.02.2013 06:26:15 | Computer Name = Workstation-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.02.2013 06:43:21 | Computer Name = Workstation-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files
 (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 05.02.2013 15:38:24 | Computer Name = Workstation-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 18.11.2012 16:04:04 | Computer Name = Workstation-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
Error - 05.12.2012 15:33:58 | Computer Name = Workstation-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst Browser erreicht.
 
Error - 27.12.2012 21:22:56 | Computer Name = Workstation-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?27.?12.?2012 um 06:47:12 unerwartet heruntergefahren.
 
Error - 27.12.2012 22:33:16 | Computer Name = Workstation-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
Error - 28.12.2012 09:40:49 | Computer Name = Workstation-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?28.?12.?2012 um 05:03:51 unerwartet heruntergefahren.
 
Error - 29.12.2012 13:14:22 | Computer Name = Workstation-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?28.?12.?2012 um 15:28:49 unerwartet heruntergefahren.
 
Error - 01.01.2013 18:06:50 | Computer Name = Workstation-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?01.?01.?2013 um 07:03:25 unerwartet heruntergefahren.
 
Error - 06.01.2013 17:27:03 | Computer Name = Workstation-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?06.?01.?2013 um 21:03:24 unerwartet heruntergefahren.
 
Error - 13.01.2013 09:01:12 | Computer Name = Workstation-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
 
Error - 27.01.2013 09:47:52 | Computer Name = Workstation-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
 
< End of report >

--- --- ---

Ja evtl. kann jem. da was sehen....

markusg · 13.02.2013, 12:03

hi
C:\Users\Workstation\AppData\Local\SKIDROW
da du raubkopieen nutzt, können wir dir nur beim neu aufsetzen helfen.
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:

deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
Bilder, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
recovery cd oder recovery partition.
falls dies ein fertig pc ist, nenne hersteller + typ.
Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

Apedape · 13.02.2013, 14:24

Wird platt gemacht. Freue mich über alle Tuts die ihr zu bieten habt.die

markusg · 13.02.2013, 18:22

hi
meld dich wenn du mit der Datensicherung durch bist, und sag mir, ob du ne Windows cd hast, bzw Recovery cd oder Partition.

13.02.2013, 18:22	#6
markusg /// Malware-holic	Pc gehackt von Rechten hi meld dich wenn du mit der Datensicherung durch bist, und sag mir, ob du ne Windows cd hast, bzw Recovery cd oder Partition. __________________ --> Pc gehackt von Rechten

Pc gehackt von Rechten

Plagegeister aller Art und deren Bekämpfung: Pc gehackt von Rechten