Guten Abend.

Seit ein paar Tagen und mittlerweile glaube ich auch Wochen habe ich ein Problem.
Auf den Internetseiten tauchen Werbungen auf etc. oder wenn ich in einem Online-
Shop auf ein Bild gehe, werden mir Alternativen gezeigt die nicht von der Webseite
aus kommen. Es handelt sich gerade um "Ads by brows to save" oder "Savenow" oder
"Save Fish" mittleweile weiss ich nicht mehr was tun.

Bis jetzt habe ich nur vollständige Untersuchung mit Kaspersky versucht und auch mit
dem ADWcleaner, leider ohne Erfolg.
Da ich in hier in dem Bereich keine Ahnung habe, poste ich nur hier und bitte euch
Experten um hilfe

Mfg

poste das letzte Log vom adwCleaner!


Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

• Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Wähle Scanne Alle Benuzer
• Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
• Unter Extra Registrierung, wähle bitte Benutze SafeList
• Klicke nun auf Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

Danke erstmal für die Antwort.
Habe die Logs von ADW leider nicht mehr :/

hier sind die von OTL:
OTL Logfile:

OTL logfile created on: 02.03.2013 12:03:19 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Damian\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 39,53% Memory free
6,20 Gb Paging File | 3,31 Gb Available in Paging File | 53,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 585,42 Gb Total Space | 285,31 Gb Free Space | 48,74% Space Free | Partition Type: NTFS
 
Computer Name: DAMIAN-PC | User Name: Damian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Damian\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_6_602_171.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
PRC - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
PRC - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\LOLReplay\LOLRecorder.exe (LOL Replay)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
PRC - C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe (WIBU-SYSTEMS AG)
PRC - C:\Program Files\Common Files\WireHelpSvc.exe ()
PRC - C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe ()
PRC - C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.126\deploy\LoLLauncher.exe ()
PRC - C:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.247\deploy\LolClient.exe (Adobe Systems Inc.)
PRC - C:\Program Files\NETGEAR\WNA3100\WNA3100.exe ()
PRC - C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe ()
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe (ROCCAT GmbH)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe (Hewlett-Packard Co.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Hama\Hama Webcam Suite\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\RocketDock\RocketDock.exe ()
PRC - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.247\deploy\Adobe AIR\Versions\1.0\Resources\WebKit.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\e64304962098e90f0d3f4c33c1b080a6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\004bc6615f9c06df5c98859d35149fe6\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b757806657fa5db2b1ed1a89b026b463\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\2cbdbc8bb7fcf0d7eb7a8d616e141d79\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\4d2c890606d2a3a43a90684115bfccfc\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\668c039655437b25586280e1fbff8ef0\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\a8080296b18898342ce986091c08b0a4\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\9126f2ff9fd9c05900f67e963ccc27ef\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll ()
MOD - C:\Program Files\LOLReplay\Air.dll ()
MOD - C:\Program Files\LOLReplay\LOLUtils.dll ()
MOD - C:\Program Files\LOLReplay\Launcher.dll ()
MOD - C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe ()
MOD - C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.126\deploy\LoLLauncher.exe ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\qtgui4.dll ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\qtscript4.dll ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\qtsql4.dll ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\qtcore4.dll ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\qtnetwork4.dll ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\qtdeclarative4.dll ()
MOD - C:\Program Files\NETGEAR\WNA3100\WNA3100.exe ()
MOD - C:\Program Files\NETGEAR\WNA3100\WifiSvcLib.dll ()
MOD - C:\Program Files\Kaspersky Security Suite CBE 12\imageformats\qgif4.dll ()
MOD - C:\Program Files\ROCCAT\Kone[+] Mouse\hiddriver.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\System32\CmdLineExt03.dll ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files\RocketDock\RocketDock.exe ()
MOD - C:\Program Files\RocketDock\RocketDock.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Ad-Aware Service) -- C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer8) -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (nvUpdatusService) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (SBAMSvc) -- C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe (McAfee, Inc.)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (CodeMeter.exe) -- C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe (WIBU-SYSTEMS AG)
SRV - (WireHelpSvc) -- C:\Program Files\Common Files\WireHelpSvc.exe ()
SRV - (AVP) -- C:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
SRV - (WSWNA3100) -- C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe ()
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (ACDaemon) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (uCamMonitor) -- C:\Program Files\Hama\Hama Webcam Suite\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (RalinkRegistryWriter) -- C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe (Ralink Technology, Corp.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (StarWindServiceAE) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (XDva392) -- C:\Windows\system32\XDva392.sys File not found
DRV - (XDva391) -- C:\Windows\system32\XDva391.sys File not found
DRV - (XDva390) -- C:\Windows\system32\XDva390.sys File not found
DRV - (XDva389) -- C:\Windows\system32\XDva389.sys File not found
DRV - (XDva388) -- C:\Windows\system32\XDva388.sys File not found
DRV - (XDva387) -- C:\Windows\system32\XDva387.sys File not found
DRV - (XDva386) -- C:\Windows\system32\XDva386.sys File not found
DRV - (XDva385) -- C:\Windows\system32\XDva385.sys File not found
DRV - (XDva384) -- C:\Windows\system32\XDva384.sys File not found
DRV - (XDva383) -- C:\Windows\system32\XDva383.sys File not found
DRV - (XDva382) -- C:\Windows\system32\XDva382.sys File not found
DRV - (XDva380) -- C:\Windows\system32\XDva380.sys File not found
DRV - (XDva379) -- C:\Windows\system32\XDva379.sys File not found
DRV - (XDva377) -- C:\Windows\system32\XDva377.sys File not found
DRV - (XDva375) -- C:\Windows\system32\XDva375.sys File not found
DRV - (XDva374) -- C:\Windows\system32\XDva374.sys File not found
DRV - (XDva372) -- C:\Windows\system32\XDva372.sys File not found
DRV - (XDva370) -- C:\Windows\system32\XDva370.sys File not found
DRV - (XDva368) -- C:\Windows\system32\XDva368.sys File not found
DRV - (XDva367) -- C:\Windows\system32\XDva367.sys File not found
DRV - (XDva366) -- C:\Windows\system32\XDva366.sys File not found
DRV - (XDva362) -- C:\Windows\system32\XDva362.sys File not found
DRV - (XDva361) -- C:\Windows\system32\XDva361.sys File not found
DRV - (XDva359) -- C:\Windows\system32\XDva359.sys File not found
DRV - (XDva358) -- C:\Windows\system32\XDva358.sys File not found
DRV - (XDva352) -- C:\Windows\system32\XDva352.sys File not found
DRV - (XDva349) -- C:\Windows\system32\XDva349.sys File not found
DRV - (XDva348) -- C:\Windows\system32\XDva348.sys File not found
DRV - (XDva347) -- C:\Windows\system32\XDva347.sys File not found
DRV - (XDva346) -- C:\Windows\system32\XDva346.sys File not found
DRV - (XDva345) -- C:\Windows\system32\XDva345.sys File not found
DRV - (XDva344) -- C:\Windows\system32\XDva344.sys File not found
DRV - (XDva343) -- C:\Windows\system32\XDva343.sys File not found
DRV - (XDva342) -- C:\Windows\system32\XDva342.sys File not found
DRV - (XDva341) -- C:\Windows\system32\XDva341.sys File not found
DRV - (XDva337) -- C:\Windows\system32\XDva337.sys File not found
DRV - (XDva336) -- C:\Windows\system32\XDva336.sys File not found
DRV - (XDva332) -- C:\Windows\system32\XDva332.sys File not found
DRV - (XDva327) -- C:\Windows\system32\XDva327.sys File not found
DRV - (XDva326) -- C:\Windows\system32\XDva326.sys File not found
DRV - (XDva323) -- C:\Windows\system32\XDva323.sys File not found
DRV - (XDva321) -- C:\Windows\system32\XDva321.sys File not found
DRV - (XDva317) -- C:\Windows\system32\XDva317.sys File not found
DRV - (WinRing0_1_2_0) -- C:\Program Files\IObit\Game Booster\Driver\WinRing0.sys File not found
DRV - (VMnetAdapter) -- system32\DRIVERS\vmnetadapter.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (EagleXNt) -- C:\Windows\system32\drivers\EagleXNt.sys File not found
DRV - (EagleNT) -- C:\Windows\system32\drivers\EagleNT.sys File not found
DRV - (a1xe76jm) --  File not found
DRV - (gfibto) -- C:\Windows\System32\drivers\gfibto.sys (GFI Software)
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ESLWireAC) -- C:\Windows\System32\drivers\ESLWireACD.sys (<Turtle Entertainment>)
DRV - (XDva394) -- C:\Windows\System32\XDva394.sys (www.wiselogic.co.kr)
DRV - (BCMH43XX) -- C:\Windows\System32\drivers\bcmwlhigh6.sys (Broadcom Corporation)
DRV - (dc3d) -- C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV - (kl2) -- C:\Windows\System32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (ESLvnic1) -- C:\Windows\System32\drivers\ESLvnic.sys (Turtle Entertainment GmbH)
DRV - (taphss) -- C:\Windows\System32\drivers\taphss.sys (AnchorFree Inc)
DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (RMCAST) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys ()
DRV - (NxpCap) -- C:\Windows\System32\drivers\NxpCap.sys (NXP Semiconductors Germany GmbH)
DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.)
DRV - (ArcSoftKsUFilter) -- C:\Windows\System32\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (UsbDiag) -- C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) -- C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (s125mgmt) -- C:\Windows\System32\drivers\s125mgmt.sys (MCCI Corporation)
DRV - (s125obex) -- C:\Windows\System32\drivers\s125obex.sys (MCCI Corporation)
DRV - (s125mdm) -- C:\Windows\System32\drivers\s125mdm.sys (MCCI Corporation)
DRV - (s125mdfl) -- C:\Windows\System32\drivers\s125mdfl.sys (MCCI Corporation)
DRV - (s125bus) -- C:\Windows\System32\drivers\s125bus.sys (MCCI Corporation)
DRV - (SCMNdisP) -- C:\Windows\System32\drivers\SCMNdisP.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=810D53980F5EC87860D93951310F2C52
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q={searchTerms}&src=IE-SearchBox
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\SearchScopes\{518C86D9-76A4-4D53-BD21-95FDE366776B}: "URL" = hxxp://search.softonic.com/INF1205T01/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=613
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = plimus.com;www.plimus.com;regnow.com;www.regnow.com;*.local;<local>
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 202.158.222.248:8080
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "SecureSearch"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: %7B87934c42-161d-45bc-8cef-ef18abe2a30c%7D:2.5
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Program Files\RelevantKnowledge
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.02.20 16:43:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru [2013.01.22 14:50:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files\Kaspersky Security Suite CBE 12\FFExt\linkfilter@kaspersky.ru [2013.01.22 14:50:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files\Kaspersky Security Suite CBE 12\FFExt\KavAntiBanner@Kaspersky.ru [2013.01.22 14:50:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.01 21:28:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.27 14:13:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.02.20 16:43:51 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}: C:\Users\Damian\AppData\Roaming\5008 [2010.11.12 15:55:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.01 21:28:11 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.27 14:13:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{380AE6CB-09B9-4373-B360-D01C2462A6E7}: C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{0E810812-F4BB-4309-942A-755587587A5E}: C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter
 
[2011.10.07 12:26:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\Extensions
[2011.01.15 14:04:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com
[2013.03.01 21:27:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\rk6fqmmz.default\extensions
[2013.03.01 21:27:39 | 000,000,000 | ---D | M] (Ad-Aware Security Add-on) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\rk6fqmmz.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
[2013.03.01 21:27:55 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\rk6fqmmz.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012.10.24 16:51:04 | 000,005,368 | ---- | M] () (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\extensions\50881052ef247@50881052ef27f.com.xpi
[2013.02.14 20:24:32 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.27 14:13:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013.02.27 14:13:07 | 000,000,000 | ---D | M] (Seekapp) -- C:\Program Files\Mozilla Firefox\extensions\{4548ECB8-DA60-439A-A00D-5C893F8E1F9A}
[2013.02.27 14:13:07 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.02.27 14:13:06 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
[2013.02.27 14:13:07 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
[2013.02.27 14:13:20 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.14 01:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 08:29:51 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.14 01:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 01:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.12.08 22:21:24 | 000,002,224 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\webblog.xml
[2012.07.14 01:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 01:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search the web (Softonic) (Enabled)
CHR - default_search_provider: search_url = hxxp://search.softonic.com/INF1205T01/tb_v1?q={searchTerms}&SearchSource=49&cc=
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=810D53980F5EC87860D93951310F2C52
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.97\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft® Windows Media Player Firefox Plugin (Enabled) = C:\Users\Damian\AppData\Roaming\Mozilla\plugins\np-mswmp.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U7 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonEU\NGM\npNxGameeu.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Error reading preferences file
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Damian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.486_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\Damian\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.486_0\
CHR - Extension: Skype Click to Call = C:\Users\Damian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
 
O1 HOSTS File: ([2010.05.13 16:53:40 | 000,001,204 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com 
O1 - Hosts: ::1             localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Webblog) - {C3947F4E-8894-4C04-98E0-DF182C706DDF} - C:\Program Files\wbtooltb\wbtoolDx.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a}  - No CLSID value found.
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Users\Damian\AppData\Roaming\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.)
O3 - HKLM\..\Toolbar: (no name) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Webblog) - {C3947F4E-8894-4C04-98E0-DF182C706DDF} - C:\Program Files\wbtooltb\wbtoolDx.dll ()
O3 - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [RoccatKone+] C:\Program Files\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE (ROCCAT GmbH)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SearchProtection] C:\ProgramData\Search Protection\_run.bat File not found
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2951023159-836439813-1825762036-1001..\Run: [AdobeBridge]  File not found
O4 - HKU\S-1-5-21-2951023159-836439813-1825762036-1001..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NHL® 09 Registration.lnk =  File not found
O4 - Startup: C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: svhost = C:\Windows\sys32\svhost.exe
O7 - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: svhost = C:\Windows\sys32\svhost.exe
O8 - Extra context menu item: Free YouTube Download - C:\Users\Damian\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Damian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files\Kaspersky Security Suite CBE 12\ie_banner_deny.htm ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.53.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} hxxp://www.o2c.de/download/o2cplayer.cab (o2c Player (ELECO Software GmbH))
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab (Java Plug-in 1.5.0_12)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{490F112D-237A-4E5F-A1E1-864FEC0A7C89}: DhcpNameServer = 192.168.15.155 192.168.5.57 192.168.5.56
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A0E2A8B7-AB09-460F-BB7B-3B42ED478633}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C80DF0EC-2433-4C91-BB09-5D25CEEDF50D}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (BdInstHk.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - No CLSID value found.
O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - No CLSID value found.
O22 - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - No CLSID value found.
O24 - Desktop WallPaper: C:\Users\Damian\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Damian\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.12.17 17:09:47 | 000,000,036 | ---- | M] () - C:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{a38de6cf-16ec-11de-9588-0023541dc279}\Shell - "" = AutoRun
O33 - MountPoints2\{a38de6cf-16ec-11de-9588-0023541dc279}\Shell\AutoRun\command - "" = I:\SETUP.EXE
O33 - MountPoints2\{abe1ca0d-25db-11de-b580-0023541dc279}\Shell - "" = AutoRun
O33 - MountPoints2\{abe1ca0d-25db-11de-b580-0023541dc279}\Shell\AutoRun\command - "" = I:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.02 12:01:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Damian\Desktop\OTL.exe
[2013.03.01 21:29:51 | 000,000,000 | ---D | C] -- C:\Users\Damian\AppData\Roaming\LavasoftStatistics
[2013.03.01 21:29:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Ad-Aware Antivirus
[2013.03.01 21:29:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
[2013.03.01 21:29:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2013.03.01 21:29:22 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Aware Antivirus
[2013.03.01 21:28:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations
[2013.03.01 21:28:05 | 000,000,000 | ---D | C] -- C:\Users\Damian\AppData\Local\adawarebp
[2013.03.01 21:28:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Ad-Aware Browsing Protection
[2013.03.01 21:27:57 | 000,000,000 | ---D | C] -- C:\Program Files\Toolbar Cleaner
[2013.03.01 21:25:42 | 000,044,424 | ---- | C] (GFI Software) -- C:\Windows\System32\sbbd.exe
[2013.03.01 21:25:42 | 000,013,560 | ---- | C] (GFI Software) -- C:\Windows\System32\drivers\gfibto.sys
[2013.03.01 21:25:41 | 000,000,000 | ---D | C] -- C:\Users\Damian\AppData\Roaming\Ad-Aware Antivirus
[2013.02.27 14:13:04 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.14 09:36:36 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.02.14 09:36:35 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.02.14 09:36:34 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.02.14 09:36:34 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.02.14 09:36:34 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.02.14 09:36:33 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.02.14 09:36:33 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.02.14 09:36:32 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.02.13 20:25:19 | 002,048,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.02.13 20:25:18 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.02.13 20:25:15 | 003,602,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.02.13 20:25:15 | 003,550,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Damian\AppData\Roaming\*.tmp files -> C:\Users\Damian\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.02 12:01:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Damian\Desktop\OTL.exe
[2013.03.02 11:56:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.02 11:19:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.02 10:48:08 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.02 10:48:08 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.02 08:48:19 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.02 08:48:15 | 000,000,000 | -H-- | M] () -- C:\ProgramData\cm-lock
[2013.03.02 08:48:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.02 08:48:05 | 3219,668,992 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.01 21:50:03 | 000,001,697 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013.03.01 21:43:56 | 000,594,019 | ---- | M] () -- C:\Users\Damian\Desktop\adwcleaner.exe
[2013.03.01 21:25:42 | 000,044,424 | ---- | M] (GFI Software) -- C:\Windows\System32\sbbd.exe
[2013.03.01 21:25:42 | 000,013,560 | ---- | M] (GFI Software) -- C:\Windows\System32\drivers\gfibto.sys
[2013.02.27 19:03:04 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.02.27 19:03:04 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.02.17 14:08:29 | 000,002,339 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.02.14 10:14:33 | 004,310,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.02.14 09:33:32 | 000,704,266 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.14 09:33:32 | 000,651,468 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.14 09:33:32 | 000,156,866 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.14 09:33:32 | 000,129,032 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.02 10:35:58 | 000,001,356 | ---- | M] () -- C:\Users\Damian\AppData\Local\d3d9caps.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Damian\AppData\Roaming\*.tmp files -> C:\Users\Damian\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.02 08:48:15 | 000,000,000 | -H-- | C] () -- C:\ProgramData\cm-lock
[2013.03.01 21:43:50 | 000,594,019 | ---- | C] () -- C:\Users\Damian\Desktop\adwcleaner.exe
[2013.03.01 21:29:27 | 000,001,697 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013.01.22 14:18:40 | 000,017,408 | ---- | C] () -- C:\Users\Damian\AppData\Local\WebpageIcons.db
[2013.01.22 14:15:57 | 000,116,189 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2013.01.22 14:15:57 | 000,098,168 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2013.01.13 16:57:10 | 000,017,946 | ---- | C] () -- C:\Users\Damian\.recently-used.xbel
[2012.10.27 15:54:53 | 000,000,280 | ---- | C] () -- C:\Windows\game.ini
[2012.09.28 21:08:37 | 000,121,035 | ---- | C] () -- C:\Users\Damian\133058_3293830565121_1987589343_o.jpg
[2012.09.28 21:08:35 | 000,124,299 | ---- | C] () -- C:\Users\Damian\417407_3118449380701_327535709_n.jpg
[2012.09.16 11:09:34 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2012.03.03 20:23:19 | 000,265,120 | ---- | C] () -- C:\Program Files\Common Files\WireHelpSvc.exe
[2012.02.29 21:58:53 | 000,001,962 | ---- | C] () -- C:\Users\Damian\.armitage.prop
[2012.02.25 10:09:21 | 000,035,874 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2012.02.03 10:29:56 | 000,042,392 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2011.11.13 00:21:09 | 000,000,046 | ---- | C] () -- C:\Windows\System32\DonationCoder_desktopcoral_InstallInfo.dat
[2011.09.21 19:00:53 | 000,000,276 | ---- | C] () -- C:\Users\Damian\SciTE.session
[2011.09.21 13:39:36 | 000,055,727 | ---- | C] () -- C:\Users\Damian\P210911_07.05.JPG
[2011.09.21 10:57:31 | 000,000,000 | ---- | C] () -- C:\Users\Damian\AppData\Local\{4DEF4E95-EB59-4FB0-B52C-7FD58C732AA2}
[2011.09.08 22:19:39 | 000,000,132 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.09.04 21:34:06 | 000,001,456 | ---- | C] () -- C:\Users\Damian\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2011.08.29 12:15:44 | 000,000,132 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011.08.23 10:00:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.08.23 09:58:09 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.07.06 18:43:25 | 008,995,244 | ---- | C] () -- C:\Users\Damian\ts3_recording_11_07_06_19_43_22.wav
[2011.03.11 12:43:54 | 000,029,763 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat
[2011.02.10 15:00:22 | 000,001,024 | ---- | C] () -- C:\Users\Damian\.rnd
[2010.12.12 21:06:37 | 000,002,801 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\ac.exe.config
[2010.12.12 21:06:36 | 000,509,952 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\ac.exe
[2010.12.04 17:43:58 | 000,000,023 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\urhtps.dat
[2009.12.12 15:45:13 | 000,000,046 | ---- | C] () -- C:\Users\Damian\AppData\Local\DonationCoder_desktopcoral_InstallInfo.dat
[2009.11.27 19:30:13 | 000,138,056 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\PnkBstrK.sys
[2009.09.07 12:14:57 | 000,001,356 | ---- | C] () -- C:\Users\Damian\AppData\Local\d3d9caps.dat
[2009.09.07 12:07:08 | 000,001,100 | ---- | C] () -- C:\Users\Damian\AppData\Local\d3d8caps.dat
[2009.07.11 12:46:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.02.23 15:56:32 | 000,060,416 | ---- | C] () -- C:\Users\Damian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 22:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 22:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Files - Unicode (All) ==========
[2012.12.21 12:08:28 | 000,000,000 | ---D | M](C:\Users\Damian\Desktop\Jojo?) -- C:\Users\Damian\Desktop\Jojo♥
[2012.01.07 21:16:39 | 000,000,000 | ---D | C](C:\Users\Damian\Desktop\Jojo?) -- C:\Users\Damian\Desktop\Jojo♥
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 500 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:E8BE05FA
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:DBC416F8

< End of report >
         

--- --- ---


Extras: OTL Logfile:

OTL Extras logfile created on: 02.03.2013 12:03:19 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Damian\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 39,53% Memory free
6,20 Gb Paging File | 3,31 Gb Available in Paging File | 53,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 585,42 Gb Total Space | 285,31 Gb Free Space | 48,74% Space Free | Partition Type: NTFS
 
Computer Name: DAMIAN-PC | User Name: Damian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2951023159-836439813-1825762036-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CCF9907-FEC5-4A42-846D-356AC51DD147}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{138CBCD1-4EB9-4455-B392-5CAFC7A79A42}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{1ED8401D-C707-4D3B-871B-EC03D7714EDB}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{22E54F7B-EC76-44F6-B981-5FF78851E71E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{272BB308-8136-4ACE-A25D-505C1736DAFF}" = rport=138 | protocol=17 | dir=out | app=system | 
"{303BFC98-4B6E-4E7F-9EC8-18B6733318BA}" = lport=137 | protocol=17 | dir=in | app=system | 
"{3472435E-862A-4AD5-9817-C7E76C79327C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{41EC8C7C-4EB6-4A36-BC3E-2AB7C49D6504}" = lport=139 | protocol=6 | dir=in | app=system | 
"{4539180C-8565-4728-B0B3-79E8865345C4}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{45D9225D-0869-4E61-A5AD-480FB8EBAD5D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{46D1A2A9-1B6C-4ACE-A2E5-30713297EF82}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{519048E3-E92D-4FE8-8E77-BC867E520AC7}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8B8E264C-1371-4259-B806-28E1FD29DE53}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{94A43EDE-265A-4CB3-B209-450A15461F62}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{9EC9ED5A-AD8C-4B96-B2C3-B9B89DCEEBEC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{AF146322-4DE8-4397-927D-1D765C14E1F2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{F3445899-E499-4E81-A533-5ECA71D71A97}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F3870119-316B-48F4-97EB-0E9BDF22AB6E}" = rport=445 | protocol=6 | dir=out | app=system | 
"{F3F9661D-35C8-4114-86A3-50D8D2034CA6}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F67FE29D-C69D-4970-ACD7-274894835283}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FDE941C5-E23B-4E13-AE04-883A00B2D551}" = rport=137 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06EB203A-DB21-49C8-A957-F9B55EEF9B88}" = protocol=17 | dir=in | app=c:\program files\permissionresearch\prmrsr.exe | 
"{0ABDEDA1-86D5-41D4-A3C7-D30AAF210D17}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{0CE85B40-803B-4934-8904-1AA3B46888BF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{0D5FC0F8-3A73-4925-9AED-E65A2A4323E4}" = protocol=6 | dir=in | app=c:\windows\temp\~os2981.tmp\rlvknlg.exe | 
"{1250E799-EB3B-4EE2-B0F4-DCFCE51003C2}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{1D3BA31F-8233-446D-A58B-B203121538FF}" = protocol=6 | dir=in | app=c:\program files\adawaretb\dtuser.exe | 
"{1E1DBBE3-865F-4785-ACB3-7B1DE0317036}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{1FC3D23F-4461-4B09-8EE5-1B057603BB71}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{2276202A-641E-40CA-97C8-A668AF79E3CE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike source\hl2.exe | 
"{25D975CA-CC61-428D-ACBC-404F144C4D35}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{2C0AE7EE-C528-4E85-BE1A-25D00C0FAD34}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{2ED1A031-545F-4E84-8404-C5FD7D8649FD}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{33B7B956-0B56-4018-B4A4-D4EE7EF0A9EF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{346933F8-DAA3-4EC4-BF7B-E9E52E24223E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{34BAEEFF-BAEF-4F24-932E-619D1AD808A2}" = protocol=17 | dir=in | app=c:\program files\adawaretb\dtuser.exe | 
"{3572D8E5-D27E-458F-B448-3D9AA0957185}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{3C8FC101-34E9-4D77-95E4-C39A95C0B661}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{439B7406-2F1B-4F1E-99E5-29FB953CFF3C}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{50E31ECE-E3B3-49E4-BC42-82BFCA1E12C0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5123184C-5E94-40CA-B110-3B8A14370755}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{58721EDE-D230-4E44-90B8-4ED4AB1E882B}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{5901EE1E-1509-4B36-B581-CEDFC2734830}" = protocol=17 | dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe | 
"{5B0B1D09-F9E7-4FA1-92FB-CDF202F81714}" = protocol=6 | dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe | 
"{5B58E92C-2C85-4F27-8EA0-7F9BA1C92EFE}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{5C804171-760E-4C20-8917-1248640488C5}" = dir=in | app=c:\program files\eslwire\wire.exe | 
"{5D4F3D60-E971-41B3-BD6E-C70FBF13DBB6}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{5D74DBC3-1366-4D8E-AA60-F841D49FFD41}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe | 
"{5D987A25-53E4-4FAE-B4C1-AEB369F5AF85}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{615251BD-685D-4A6F-B1E5-695EC667EBD0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{664568FC-AC50-432B-BD40-6FFA0E723C67}" = protocol=17 | dir=in | app=c:\program files\efusion\blackshot\system\blackshot.exe | 
"{66EF07A6-FEC9-4AF1-9EF0-B83FCA3CD451}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{66FE9070-56F7-4B41-82E4-9BA2AF08143D}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{6821B753-4FBD-4196-8009-CDEB4F1C6408}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{6A3245AC-3E1B-4592-B4C1-725A4194E063}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{6DCE9BD0-E24B-494A-B98D-9C9A022ACCF1}" = protocol=6 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | 
"{6E9A6B0B-908C-4294-8710-0F46E2F8DB26}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike source\hl2.exe | 
"{6EA60D32-5624-4B0A-A2EF-957681C8D201}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{72B217E3-AF9E-4455-BCAA-FA76FA0BE045}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{72CBFDEC-18DD-4074-AC0E-30BEDE84CF9C}" = protocol=6 | dir=in | app=d:\alicesetup.exe | 
"{770A3444-05FB-447F-82E5-BB516EF76F29}" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe | 
"{7868DDE4-DF99-4424-8A56-CC1B85BA40A9}" = protocol=17 | dir=in | app=d:\alicesetup.exe | 
"{7A087441-1D28-45EE-B24C-A5FB45DCDA95}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | 
"{7AB62B27-43DE-45A6-B36D-39026C3B1DE7}" = protocol=6 | dir=in | app=c:\program files\permissionresearch\prmrsr.exe | 
"{7C950C30-598A-43C7-8263-6718B1028682}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{7F23DA94-0CBF-4BE3-85C7-1925E7F36945}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{800FA9D2-AB18-442C-9841-AB37C6AB40E1}" = protocol=17 | dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe | 
"{80AC8F46-0A44-49DD-800E-2C5C90211F15}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{82341081-A685-400D-9541-9351A976FEF6}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{83137053-A028-4A7E-AC80-AB3333871D04}" = protocol=17 | dir=in | app=c:\program files\cyanide\gamecenter\gamecenter.exe | 
"{862A776C-6A0F-48C8-B23B-D8783CD89BEA}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{87301038-14AF-43E5-94E7-416F1933C256}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\damianek234\dedicated server\hlds.exe | 
"{8C5C3F1B-8F4F-485A-8619-D1E2C523FFFD}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{8EE856EC-AE3B-450F-B8D3-7458EDA18ED0}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | 
"{91A86960-89A1-4FAA-995A-5C69B5DE4AD9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{91EA6212-8393-42F6-B2F6-19852AD0DE48}" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe | 
"{9424D06A-85A4-4A63-B558-D75679193615}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{98E9AF0C-E4CB-439A-BA86-46F58EB08E07}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{98F05BDD-7A0C-4BC2-8888-2D4B562FF322}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{9C67D54E-3C76-4F14-80F7-6DE8BF295E8A}" = protocol=17 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | 
"{9FF151B2-853A-47A8-A74A-4F58318BC898}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{A652862C-1C9A-4C79-99DB-26A7CD044E12}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{AEADB9C1-FF67-452F-B208-89412915FFFF}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike source\hl2.exe | 
"{B06F5C6B-E7C0-4D01-9CF4-1ADCDC14835F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{B19786B6-9602-4188-86AD-8C6438329243}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike source\hl2.exe | 
"{B3909AA6-8C7D-4EE0-8122-D24E333DBA29}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe | 
"{B76027BA-7124-4C47-AA4D-30F1989C2D52}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{B78B2F85-8DB1-41E2-8053-FE2E201A693E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{B841E1DD-962C-42FF-B727-CDD2B5055E5D}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{B9BB7D5E-786E-40B0-9173-F18DA27A5429}" = protocol=6 | dir=in | app=c:\program files\cyanide\gamecenter\gamecenter.exe | 
"{BCCED6BB-BB54-4071-8FF3-7E7C15D6FF55}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{BDABEFCB-3F39-4797-8CDD-16EEC5F4D8D6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe | 
"{C069E783-C0DB-4CFB-93D8-3B123D2E1C44}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{C5825AFA-47A9-4DD6-ADD5-DB32DDAE5E41}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{D0C68C6E-B655-49EF-928A-703BDCB98B5A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\damianek234\dedicated server\hlds.exe | 
"{D6D43AB8-493F-48A6-84FD-0C3BAF6BA2E5}" = dir=out | app=c:\program files\eslwire\wire.exe | 
"{D7DC0DDF-7C51-4052-9BD1-28E770BAC3EC}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer_service.exe | 
"{D7DC50CC-290C-436F-A868-A92FF3BB2E17}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{D8219BAF-A5FC-4312-9312-55B1B89CF0B2}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{D840EAA0-F3A3-482E-B3FC-A0010FB612E6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D97B7EE9-5E2A-4136-879A-99A8DFFD7BA5}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{DB121D23-C770-4A9D-998C-C9A0352F90CD}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{DE1585AC-1AC4-4B3C-82B6-D92D4C9C64A5}" = protocol=6 | dir=in | app=c:\windows\temp\~os5541.tmp\rlvknlg.exe | 
"{DEF91572-18C0-4E2D-851F-ABDF6A326CC0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{E17D6971-E5B0-4267-A0B9-8A64425C3265}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{E1C3305F-6837-414A-B647-D27FF2F792E9}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{E282BFFA-2A35-4198-B742-94DB64D745B1}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{E5EC2D2B-5FB9-44CF-AD7C-9D0DE2BE9FC6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike\hl.exe | 
"{E8A1EA8B-3AC6-4614-A117-1AD2F0C0C675}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{EA919BDD-69C6-4EED-A221-81FC574AC22D}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{EA91F53D-A2CB-4E05-8CEA-1FEE12C6AF5A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike\hl.exe | 
"{EB12D342-1A6B-49A8-A48D-D2CEC5A30302}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe | 
"{EBA4ED06-D931-4EB9-8825-86D5BC4CBB13}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe | 
"{EF5AD638-82B1-4753-8E5C-92DF11D5A9EB}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{F2B424F0-1512-4082-B53A-F20DF239847E}" = protocol=6 | dir=in | app=c:\program files\efusion\blackshot\system\blackshot.exe | 
"{F2ED5393-D814-4563-8EF3-C749AA545C3D}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{F336FBE1-62C5-4472-B031-6B5450B6689B}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{F4B1F7A7-3A38-4BFE-8B91-7CA3360353F1}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version8\teamviewer.exe | 
"{F8C00690-2296-4890-B5A5-92E14C78FB85}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{FE34297B-9739-437E-AFC8-D4CE782FC2D0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{FEB22745-971F-4CC7-9B21-83C7DC57B9B0}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{FF7DB99C-A218-4866-90DB-D9FE36F811B1}" = protocol=6 | dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe | 
"TCP Query User{0A1760FA-E720-4D51-9A5E-C60A2EA12398}C:\program files\valve\hl.exe" = protocol=6 | dir=in | app=c:\program files\valve\hl.exe | 
"TCP Query User{0D24D74A-0D2C-4945-A905-CEB112C39463}C:\nexon\combat arms eu\engine.exe" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\engine.exe | 
"TCP Query User{0FB129E5-ED23-47BA-83D7-439EB6B65DBF}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{1A7F1D4E-F374-44E6-B0F8-FC32ECBAF3D3}C:\program files\relevantknowledge\rlvknlg.exe" = protocol=6 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | 
"TCP Query User{1CE1CF85-4A02-481B-A979-D8FB856BEF6E}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{29B941E4-A9CB-4DB7-AEF2-402A38E1E5AC}C:\program files\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files\ares\ares.exe | 
"TCP Query User{2FEC1FC8-CE26-408C-AAC2-2DA84263526B}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{369EAB71-89DF-46BB-AAD2-826C6CD95ACB}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{395FF961-4F38-4AEB-8C87-5C4189715506}C:\program files\valve\hlds.exe" = protocol=6 | dir=in | app=c:\program files\valve\hlds.exe | 
"TCP Query User{441085A5-4C84-40C6-9B26-0A1765868DDA}C:\users\damian\appdata\local\temp\rarsfx0\hl.exe" = protocol=6 | dir=in | app=c:\users\damian\appdata\local\temp\rarsfx0\hl.exe | 
"TCP Query User{48D5A98C-0FA6-45B3-ACC2-4679405889E4}C:\program files\ws_ftp\ws_ftp95.exe" = protocol=6 | dir=in | app=c:\program files\ws_ftp\ws_ftp95.exe | 
"TCP Query User{57A835E5-9F74-4BDF-8375-ECA3D88848EB}C:\program files\fifa 12\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\fifa 12\game\fifa.exe | 
"TCP Query User{5A0963EA-495C-4AFE-AC62-26F5CA0FB316}C:\program files\diablo iii\diablo iii.exe" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe | 
"TCP Query User{6CD22A9A-02FE-40AA-A957-D5DBB0C80413}C:\program files\valve\hl.exe" = protocol=6 | dir=in | app=c:\program files\valve\hl.exe | 
"TCP Query User{7246DF15-B59F-4713-9D0F-AB08E420A82B}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{7DF27538-23EC-4058-9049-639DA9BF9AC6}C:\programdata\battle.net\agent\agent.1363\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"TCP Query User{8C8AC57B-6C43-4F97-B620-E50252672F2D}C:\program files\valve\hltv.exe" = protocol=6 | dir=in | app=c:\program files\valve\hltv.exe | 
"TCP Query User{92C317E9-8F18-4CB0-A277-7DA139CE8336}C:\users\damian\desktop\blubvolley_1.0m\blubvolley\blubvolley.exe" = protocol=6 | dir=in | app=c:\users\damian\desktop\blubvolley_1.0m\blubvolley\blubvolley.exe | 
"TCP Query User{9617B51E-C330-4A21-AD8F-759608A1112C}C:\users\damian\temp\teamviewer\version5\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\damian\temp\teamviewer\version5\teamviewer.exe | 
"TCP Query User{9933DA57-A801-49C0-87B1-08641F4841B7}C:\program files\nowe gadu-gadu\gg.exe" = protocol=6 | dir=in | app=c:\program files\nowe gadu-gadu\gg.exe | 
"TCP Query User{A6156E63-6B0C-4890-8045-1FA3FC5DA6A9}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{AA169D4B-9ECB-4CA9-A386-9F0D76A3FF7A}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"TCP Query User{B0A1B18B-62D8-4486-A827-294994F45C3C}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"TCP Query User{D216A983-C836-4D22-B20F-5248693C7E70}C:\program files\migajek software\hateml\dbglistener\dbglistener.exe" = protocol=6 | dir=in | app=c:\program files\migajek software\hateml\dbglistener\dbglistener.exe | 
"TCP Query User{D2E6615D-DB4A-4EE6-9E6B-D9F946EC8186}C:\program files\ea games\need for speed undercover\nfs.exe" = protocol=6 | dir=in | app=c:\program files\ea games\need for speed undercover\nfs.exe | 
"TCP Query User{D598041D-2186-41A9-B439-C70EE7675CDA}C:\program files\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files\lolreplay\lolreplay.exe | 
"TCP Query User{DB5B796B-948E-47BA-90A3-7D8BC077EBA5}C:\program files\gadu-gadu\gg.exe" = protocol=6 | dir=in | app=c:\program files\gadu-gadu\gg.exe | 
"TCP Query User{DD1EBA7B-FC4E-4E4B-86EC-868BC7332E76}C:\program files\steam\steamapps\damianek234\counter-strike\hl.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike\hl.exe | 
"TCP Query User{EB477248-4B53-4C5B-B55F-7DA79E0CD3DB}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{EDB731D3-4C85-4065-B4AC-ADCD0A1512CB}C:\program files\awesom-o\awesom-o.exe" = protocol=6 | dir=in | app=c:\program files\awesom-o\awesom-o.exe | 
"TCP Query User{F06C076C-E02D-411C-BD2E-A7B08D1264F5}C:\program files\nowe gadu-gadu\gg.exe" = protocol=6 | dir=in | app=c:\program files\nowe gadu-gadu\gg.exe | 
"TCP Query User{F1315742-5E66-416F-A0D3-649DEED8B383}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{F7FA94B3-9609-4C78-ABDD-EA765874C9B9}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{0626AD8C-FC02-49B8-8EA8-6489492F0D5A}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{083CF147-426C-4F8C-985D-FD5CD359934E}C:\program files\gadu-gadu\gg.exe" = protocol=17 | dir=in | app=c:\program files\gadu-gadu\gg.exe | 
"UDP Query User{0F0DE07E-F6A6-4136-9B7C-6360A397664F}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{10427456-D68E-49E2-B70F-0DF291C63AA0}C:\program files\relevantknowledge\rlvknlg.exe" = protocol=17 | dir=in | app=c:\program files\relevantknowledge\rlvknlg.exe | 
"UDP Query User{1448B2B5-5725-4E8E-864F-57385FB8F797}C:\users\damian\desktop\blubvolley_1.0m\blubvolley\blubvolley.exe" = protocol=17 | dir=in | app=c:\users\damian\desktop\blubvolley_1.0m\blubvolley\blubvolley.exe | 
"UDP Query User{24C0181D-55A9-4A6D-A98A-52D697D09FCC}C:\program files\valve\hltv.exe" = protocol=17 | dir=in | app=c:\program files\valve\hltv.exe | 
"UDP Query User{26663AED-6695-4B40-B750-CBFF47081077}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{27AE9963-EDD8-491B-8B8A-EE40151B69B0}C:\users\damian\temp\teamviewer\version5\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\damian\temp\teamviewer\version5\teamviewer.exe | 
"UDP Query User{3FCA761B-5C4F-42C0-823F-89230CBD1F2A}C:\program files\diablo iii\diablo iii.exe" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe | 
"UDP Query User{3FE27050-DF68-46A0-A625-5F0BB7974D5A}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{41ED8595-B4C4-4ADC-8712-DB50EDFB8564}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{47DB58F9-7D6B-4F08-80A2-F51FECA38033}C:\program files\steam\steamapps\damianek234\counter-strike\hl.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\damianek234\counter-strike\hl.exe | 
"UDP Query User{5566B428-51CD-44A8-B626-B6B055D5093A}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{5616BE65-D528-4B33-B19D-E2F15FF93475}C:\program files\ws_ftp\ws_ftp95.exe" = protocol=17 | dir=in | app=c:\program files\ws_ftp\ws_ftp95.exe | 
"UDP Query User{5ACF07A5-CFA1-4D08-9B3C-BC4F2B5253C6}C:\programdata\battle.net\agent\agent.1363\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"UDP Query User{5F206A89-A1A0-4653-B095-C1C595832A24}C:\program files\valve\hl.exe" = protocol=17 | dir=in | app=c:\program files\valve\hl.exe | 
"UDP Query User{664D9232-B5DD-4FFA-AB43-490A95CD8C90}C:\nexon\combat arms eu\engine.exe" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\engine.exe | 
"UDP Query User{6DFCC898-E256-4D86-90AF-059229153CDD}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{7C6D98A4-B08B-4E89-ABD7-D20DCDFC4A9D}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{87A6FD4B-AD3A-4E7E-A213-CC201DC41989}C:\program files\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files\ares\ares.exe | 
"UDP Query User{89D0D399-04CD-47AA-9D9D-ECA2101FE2AE}C:\program files\migajek software\hateml\dbglistener\dbglistener.exe" = protocol=17 | dir=in | app=c:\program files\migajek software\hateml\dbglistener\dbglistener.exe | 
"UDP Query User{8BAEBE1E-74BF-4DC9-BA57-3E6CEE9CC525}C:\program files\valve\hl.exe" = protocol=17 | dir=in | app=c:\program files\valve\hl.exe | 
"UDP Query User{A03598C8-CC50-4D1C-8C13-72239ED6928B}C:\program files\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files\lolreplay\lolreplay.exe | 
"UDP Query User{A5841B39-6B1E-4FFE-8C5B-3F295C20633E}C:\program files\nowe gadu-gadu\gg.exe" = protocol=17 | dir=in | app=c:\program files\nowe gadu-gadu\gg.exe | 
"UDP Query User{B02E2177-6C8A-455F-8720-9F7526BD58EC}C:\program files\valve\hlds.exe" = protocol=17 | dir=in | app=c:\program files\valve\hlds.exe | 
"UDP Query User{BB364C03-1306-4FD5-85D6-6814A8F29AC1}C:\program files\ea games\need for speed undercover\nfs.exe" = protocol=17 | dir=in | app=c:\program files\ea games\need for speed undercover\nfs.exe | 
"UDP Query User{D009CEEE-9991-4820-A155-E8D43BC91E75}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{DC1E7770-7B28-4A9A-8990-0868CA93181D}C:\program files\awesom-o\awesom-o.exe" = protocol=17 | dir=in | app=c:\program files\awesom-o\awesom-o.exe | 
"UDP Query User{DD955C69-0859-4CB7-B4E5-D1E8D56FA3BE}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{E6B46798-ACF8-4ED8-AF68-30633375611E}C:\users\damian\appdata\local\temp\rarsfx0\hl.exe" = protocol=17 | dir=in | app=c:\users\damian\appdata\local\temp\rarsfx0\hl.exe | 
"UDP Query User{E79AF39A-371E-408E-9779-A3FAA8BA26E1}C:\program files\fifa 12\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\fifa 12\game\fifa.exe | 
"UDP Query User{E8633F0F-77A5-4281-8485-A588638C2321}C:\program files\nowe gadu-gadu\gg.exe" = protocol=17 | dir=in | app=c:\program files\nowe gadu-gadu\gg.exe | 
"UDP Query User{F3F4E990-9753-4412-BF02-3CA9FF9403A1}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{080FE95E-5A89-4A54-BAAA-D769971B7C2D}" = Corel Home Office
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B1BBEE3-C10D-44BE-A6BE-EEC867315F87}" = Shutdown Timer
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{0FB0C4D9-73BB-4D1A-8483-5D0BD53FACC0}" = Ad-Aware Antivirus
"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{25BEC3AB-5CD4-481D-9143-215C1BBB189E}" = Sony Ericsson PC Suite
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}" = Ralink RT2870 Wireless LAN Card
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{2F083216-8203-4E94-8C7C-EDF1C91D037D}" = RealWorld Cursor Editor
"{3248F0A8-6813-11D6-A77B-00B0D0150120}" = J2SE Runtime Environment 5.0 Update 12
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32A3A4F4-B792-11D6-A78A-00B0D0170070}" = Java SE Development Kit 7 Update 7
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{394C4F1B-8C88-404C-B644-58203570EEDB}" = MainConcept MPEG2 Software Encoder
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{411F3ABA-2AB5-4799-AA19-6ADF0A8F7424}" = Adobe Setup
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{42E2EEB2-D48E-4A47-B181-32ECA031D93B}" = DJ_AIO_06_F2400_SW_Min
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Security Suite CBE 12
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4AEFE4FD-8EF1-4D61-B3CF-52016EAE6692}" = Hama Webcam Suite
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{513148E7-B7A1-48B2-B518-668701E546F5}" = LightScribe System Software  1.14.19.1
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5DF7AA5E-A1CB-11E0-A7D6-0013D3D69929}" = MSVCRT Redists
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6059C682-4C5F-4106-8487-943E98225D3B}" = LG MC USB Modem driver
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 11.18, 2012.09.27
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6BAA71B6-8F43-4C72-931A-3354ABB0258A}" = F2400
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{744D08ED-C523-40AD-886A-0CAD5B770924}" = Crossfire Keyboard Layout by -Sp0ng3B0b- v2
"{770103E9-E1C3-48C9-812B-2982C7070575}_is1" = Pazera Free MOV to AVI Converter 1.4
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo
"{79872596-B887-E700-8D56-CADBC78BA5DE}" = Adobe Download Assistant
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7EC19307-7C22-47A8-922B-3FA965291260}" = OpenOffice.org 3.0
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.5.0
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AF3E926-ED59-11D4-A44B-0000E86D2305}" = Ulead GIF Animator 5 Test
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8D5B8F9D-00F6-4F71-87E0-C43C043A018E}" = Logitech Motion Detector Gadget
"{8EB8E60B-315D-44EB-A896-10D88602EE46}" = Adobe Setup
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99BEB67F-B288-44F5-8B2A-23F5A52FA1AE}_is1" = Universal AntiCheat 3 v1.043
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A15DD4E6-0E5F-4EE9-A26E-4A0234CF6038}" = MAGIX Speed burnR (MSI)
"{A334F1BA-0A1D-4ED6-B4F9-4066157CA15D}" = DE
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC4C38FD-A54C-4CA5-92EE-D983CD81293E}" = Microsoft Xbox 360 Accessories 1.2
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AC83BC6F-56B3-4C76-9024-A4178DCCAB55}" = MAGIX Video deluxe 17 Plus Download-Version
"{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B226B255-6C43-462D-B41F-12CDD5E1C4CD}" = MAGIX Screenshare
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B99CB207-4704-4C51-9309-0FA90AA26DD4}" = ROCCAT Kone[+] Mouse Driver
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}" = Pivot Stickfigure Animator
"{C2425F91-1F7B-4037-9A05-9F290184798D}" = NETGEAR WNA3100 wireless USB 2.0 adapter
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C60BA916-9E44-4DA4-B11A-9E27B7624EF5}" = Sony Ericsson Drivers
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C92E7DF1-624A-4D95-A4C4-18CB491B44A4}" = Sony Ericsson Device Data
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}" = HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D6BF6477-8369-489F-8DE6-3731F4B88560}" = Sony Ericsson PC Suite
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF5B1E83-1403-4F0E-A8E6-C169DF0CCE8C}" = LG PC Suite II
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FAF26102-09D7-4C58-AB01-0D59A2E517CA}" = Copy
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFC1ADE3-944B-4231-894E-3903C37271D2}" = Adobe Setup
"adawaretb" = Ad-Aware Security Add-on
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_3dcb365ab9e01871fb8c6f27b0ea079" = Adobe After Effects CS4
"Adobe_5aab5a491a3a52ae624fd639f6aaa95" = Adobe After Effects CS4 Third Party Content
"Adobe_c3c7fe8b09d497ab2b3fd91c9353390" = Adobe Flash CS3 Professional
"C2F5DF4DBA55AD4D004E4EDA0406903C1643F8E0" = Windows-Treiberpaket - PEGATRON GROUP (NxpCap) MEDIA  (09/22/2008 1.0.5.25)
"CCleaner" = CCleaner
"CD Art Display_is1" = CD Art Display 3.0.1504 Beta
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Cross Fire_is1" = Cross Fire En
"Crossfire Europe" = Crossfire Europe
"Diablo II" = Diablo II
"Diablo III" = Diablo III
"Easy GIF Animator_is1" = Easy GIF Animator 5.4
"Easy Graphic Converter 1.2_is1" = Easy Graphic Converter 1.2
"ESL Wire_is1" = ESL Wire 1.13
"FIFA 12 (c) EA_is1" = FIFA 12 (c) EA version 1
"FL Studio 10" = FL Studio 10
"Fraps" = Fraps (remove only)
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16
"Free YouTube Download_is1" = Free YouTube Download version 3.1.30.627
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.25.627
"GameCenter_is1" = GameCenter 1.3.0.6
"GIF Animator" = Microsoft GIF Animator
"Google Chrome" = Google Chrome
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"Icy Tower v1.5_is1" = Icy Tower v1.5
"Immersive Explorer" = Immersive Explorer 0.3
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Security Suite CBE 12
"LOLReplay" = LOLReplay
"MAGIX_MSI_Videodeluxe17_plus" = MAGIX Video deluxe 17 Plus Download-Version
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaPortal" = MediaPortal
"Metasploit 4.2.0" = Metasploit
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Need for Speed Underground 2" = Need for Speed Underground 2
"Nowe Gadu-Gadu" = Nowe Gadu-Gadu
"NSIS" = Nullsoft Install System
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PandoraRecovery" = PandoraRecovery (Remove Only)
"pcsx2-r4600" = PCSX2 - Playstation 2 Emulator
"PhotoScape" = PhotoScape
"PokerTH 0.8.3" = PokerTH
"Postal 2_is1" = Portal 2
"Rainmeter" = Rainmeter (remove only)
"Recover My Files_is1" = Recover My Files
"Recuva" = Recuva
"RocketDock_is1" = RocketDock 1.3.5
"Shockwave" = Shockwave
"Shop for HP Supplies" = Shop for HP Supplies
"Smart Data Recovery_is1" = Smart Data Recovery v4.4
"Sony Ericsson Themes Creator" = Sony Ericsson Themes Creator 3.27
"ST6UNST #2" = HLTooLz
"Steam App 10" = Counter-Strike
"Steam App 240" = Counter-Strike: Source
"Steam App 260" = Counter-Strike: Source Beta
"Steam App 5" = Dedicated Server
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"TeamViewer 8" = TeamViewer 8
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"Valve Hammer Editor" = Valve Hammer Editor
"Veetle TV" = Veetle TV 0.9.18
"ViGlance" = ViGlance
"VLC media player" = VLC media player 1.1.10
"WavePad" = WavePad Audiobearbeitungs-Software
"wbtooltb" = Webblog
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = Archiwizator WinRAR
"Worms Reloaded_is1" = Worms Reloaded
"Xfire" = Xfire (remove only)
"YTdetect" = Yahoo! Detect
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2951023159-836439813-1825762036-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"c8fbc20a88cf5892" = WindowsApplication1
"e3b16aab256db613" = Scrim Spot Anti-Cheat
"Headshot Player" = Headshot Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.03.2013 16:54:04 | Computer Name = Damian-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 02.03.2013 03:49:36 | Computer Name = Damian-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 24.04.2009 02:00:44 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description =     Serververbindung konnte nicht hergestellt werden.. (2848.1129)
 
Error - 26.04.2009 13:04:18 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description = Fehler beim Herstellen der Internetverbindung. (3288.1128)
 
Error - 26.04.2009 13:04:18 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description =     Serververbindung konnte nicht hergestellt werden.. (3288.1129)
 
Error - 28.04.2009 03:08:45 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description = Fehler beim Herstellen der Internetverbindung. (3552.1128)
 
Error - 28.04.2009 03:08:45 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description =     Serververbindung konnte nicht hergestellt werden.. (3552.1129)
 
Error - 29.04.2009 15:05:02 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description = Fehler beim Herstellen der Internetverbindung. (1608.1128)
 
Error - 29.04.2009 15:05:02 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description =     Serververbindung konnte nicht hergestellt werden.. (1608.1129)
 
Error - 01.05.2009 04:02:49 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description = Fehler beim Herstellen der Internetverbindung. (1584.1128)
 
Error - 01.05.2009 04:02:49 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description =     Serververbindung konnte nicht hergestellt werden.. (1584.1129)
 
Error - 02.05.2009 05:18:04 | Computer Name = Damian-PC | Source = MCUpdate | ID = 0
Description = Directory konnte nicht abgerufen werden (Fehler: Die Verbindung mit
 dem Remoteserver kann nicht hergestellt werden.) (4820.1114)
 
[ System Events ]
Error - 01.03.2013 16:52:05 | Computer Name = Damian-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 01.03.2013 16:52:06 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 01.03.2013 16:52:59 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7038
Description = 
 
Error - 01.03.2013 16:52:59 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 02.03.2013 03:49:37 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 02.03.2013 03:50:54 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 02.03.2013 03:51:24 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 02.03.2013 03:51:24 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 02.03.2013 03:51:55 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7038
Description = 
 
Error - 02.03.2013 03:51:55 | Computer Name = Damian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---


Das

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
• Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

:OTL

DRV - (WinRing0_1_2_0) -- C:\Program Files\IObit\Game Booster\Driver\WinRing0.sys File not found 
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = plimus.com;www.plimus.com;regnow.com;www.regnow.com;*.local; 
IE - HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 202.158.222.248:8080 
FF - prefs.js..browser.search.selectedEngine: "SecureSearch" 
FF - prefs.js..extensions.enabledAddons: {87934c42-161d-45bc-8cef-ef18abe2a30c}:2.5 
CHR - default_search_provider: Search the web (Softonic) (Enabled) 
O4 - HKLM..\Run: [SearchProtection] C:\ProgramData\Search Protection\_run.bat File not found 
O4 - HKU\S-1-5-21-2951023159-836439813-1825762036-1001..\Run: [AdobeBridge] File not found 
[2010.12.12 21:06:36 | 000,509,952 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\ac.exe 
[2010.12.12 21:06:37 | 000,002,801 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\ac.exe.config 
@Alternate Data Stream - 500 bytes -> C:\ProgramData\Temp:05EE1EEF 
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:E8BE05FA 
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:DBC416F8 

:Files 
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\Damian\*.tmp
C:\Users\Damian\AppData\*.dll
C:\Users\Damian\AppData\*.exe
C:\Users\Damian\AppData\Local\Temp\*.exe
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[emptytemp]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

danach:

3. Schritt

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

All processes killed
========== OTL ==========
Service WinRing0_1_2_0 stopped successfully!
Service WinRing0_1_2_0 deleted successfully!
File C:\Program Files\IObit\Game Booster\Driver\WinRing0.sys File not found not found.
HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: "SecureSearch" removed from browser.search.selectedEngine
Prefs.js: {87934c42-161d-45bc-8cef-ef18abe2a30c}:2.5 removed from extensions.enabledAddons
Use Chrome's Settings page to remove the default_search_provider items.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtection deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
C:\Users\Damian\AppData\Roaming\ac.exe moved successfully.
C:\Users\Damian\AppData\Roaming\ac.exe.config moved successfully.
ADS C:\ProgramData\Temp:05EE1EEF deleted successfully.
ADS C:\ProgramData\Temp:E8BE05FA deleted successfully.
ADS C:\ProgramData\TempBC416F8 deleted successfully.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
C:\ProgramData\TEMP folder moved successfully.
File\Folder C:\Users\Damian\*.tmp not found.
File\Folder C:\Users\Damian\AppData\*.dll not found.
File\Folder C:\Users\Damian\AppData\*.exe not found.
C:\Users\Damian\AppData\Local\Temp\333e1014-b2bc-4197-821f-b1d8029fced0.exe moved successfully.
C:\Users\Damian\AppData\Local\Temp\d2l_Install.exe moved successfully.
C:\Users\Damian\AppData\Local\Temp\IminentSetup_20121115.exe moved successfully.
C:\Users\Damian\AppData\Local\Temp\uttA886.tmp.exe moved successfully.
C:\Users\Damian\AppData\Local\Temp\uttCAA6.tmp.exe moved successfully.
C:\Users\Damian\AppData\Local\Temp\ydetect.exe moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\1a209876-276d10ea-n folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\5535ab32-7a6a48e4-n folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3d418fb2-n folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\6d0ad391-7cbed7c7-n folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Damian\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Damian\Desktop\cmd.bat deleted successfully.
C:\Users\Damian\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Damian
->Temp folder emptied: 262646808 bytes
->Temporary Internet Files folder emptied: 260116434 bytes
->FireFox cache emptied: 257377811 bytes
->Google Chrome cache emptied: 372039724 bytes
->Flash cache emptied: 7008414 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Gast
->Temp folder emptied: 2427576948 bytes
->Temporary Internet Files folder emptied: 102222283 bytes
->Java cache emptied: 4287278 bytes
->FireFox cache emptied: 142238539 bytes
->Google Chrome cache emptied: 856432 bytes
->Flash cache emptied: 72633 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56468 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 111942337 bytes
RecycleBin emptied: 1293381095 bytes

Total Files Cleaned = 4.999,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 03032013_121749

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.03.03.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Damian :: DAMIAN-PC [Administrator]

03.03.2013 12:36:59
mbam-log-2013-03-03 (12-36-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 672263
Laufzeit: 2 Stunde(n), 21 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F22C37FD-2BCB-40b6-A12E-77DDA1FBDD88} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|svhost (Backdoor.Bifrose) -> Daten: C:\Windows\sys32\svhost.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|svhost (Backdoor.Bifrose) -> Daten: C:\Windows\sys32\svhost.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 5
C:\ProgramData\MPK (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\CPDA (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\CPDM (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\PermissionResearch (Spyware.PermissionResearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 31
C:\$Recycle.Bin\S-1-5-21-2951023159-836439813-1825762036-1001\$R448MUT.exe (PUP.Offerware) -> Keine Aktion durchgeführt.
C:\Users\Damian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDRSTX46\agent_setup[1].exe (PUP.Offerware) -> Keine Aktion durchgeführt.
C:\metasploit\apps\pro\msf3\data\templates\template_x86_windows.exe (Trojan.Swrort) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Adobe\Adobe Bridge CS5.1\Msvcrt.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Adobe\Adobe Photoshop CS5.1\Msvcrt.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Adobe\Adobe Photoshop CS5.1\Plug-ins\Msvcrt.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Alcohol Soft\Alcohol 52\Langs\AX_RU.dll (Malware.Packer.GenX) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\DTX Tools\Photoshop Plugin\Msvcrt.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\DTX Tools\Photoshop Plugin\Plug-Ins\Msvcrt.dll (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Damian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDRSTX46\51333b9a96be9[1].exe (Adware.MultiPlug) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\M0000 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\S0000 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\D0000 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40415_8888984028 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40417_8173507407 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40417_8175895370 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40417_8176030903 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40417_8837715162 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40417_8895835417 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40418_9074282986 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40419_6585628472 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40420_8349843056 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40420_8360136690 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40420_9162345023 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\I40421_5908993866 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\1\S0000 (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MPK\CPDM\cpfm.bin (Refog.Keylogger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\PermissionResearch\prls.dll (Spyware.PermissionResearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\PermissionResearch\prls64.dll (Spyware.PermissionResearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\PermissionResearch\prmrsr.exe (Spyware.PermissionResearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\PermissionResearch\prmrsr64.exe (Spyware.PermissionResearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.6.6 (02.27.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Damian on 03.03.2013 at 15:14:35,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\windows nt\currentversion\windows\\AppInit_DLLs
Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{c3947f4e-8894-4c04-98e0-df182c706ddf}
Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-2951023159-836439813-1825762036-1001\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-2951023159-836439813-1825762036-1001\software\microsoft\internet explorer\searchscopes\\DefaultScope



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\sprotector
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{6a1806cd-94d4-4689-ba73-e35ea1ea9990}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{6a1806cd-94d4-4689-ba73-e35ea1ea9990}
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{c3947f4e-8894-4c04-98e0-df182c706ddf}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{c3947f4e-8894-4c04-98e0-df182c706ddf}



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\bettersoft"
Successfully deleted: [Folder] "C:\ProgramData\installmate"
Failed to delete: [Folder] "C:\ProgramData\application data\bettersoft"
Successfully deleted: [Folder] "C:\Users\Damian\appdata\local\adawarebp"
Successfully deleted: [Folder] "C:\Users\Damian\appdata\locallow\wbtooltb"
Successfully deleted: [Folder] "C:\Program Files\continuetosave"
Successfully deleted: [Folder] "C:\Program Files\styler\tb"
Successfully deleted: [Folder] "C:\Program Files\wbtooltb"



~~~ FireFox

Successfully deleted: [File] "C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\extensions\50881052ef247@50881052ef27f.com.xpi"
Successfully deleted: [File] C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\searchplugins\websearch.xml
Successfully deleted: [Folder] C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
Successfully deleted: [Folder] C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
Successfully deleted the following from C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\prefs.js

user_pref("aol_toolbar.default.homepage.check", false);
user_pref("aol_toolbar.default.search.check", false);
user_pref("browser.search.defaultenginename", "WebSearch");
user_pref("browser.search.defaultenginename,S", "WebSearch");
user_pref("browser.search.defaulturl", "hxxp://websearch.simplespeedy.info/?l=1&q=");
user_pref("browser.search.order.1", "WebSearch");
user_pref("browser.search.order.1,S", "WebSearch");
user_pref("browser.search.selectedEngine", "WebSearch");
user_pref("browser.search.selectedEngine,S", "WebSearch");
user_pref("browser.startup.homepage", "hxxp://websearch.simplespeedy.info/");
user_pref("extensions.50881052ef2f1.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.locatio
user_pref("extensions.BabylonToolbar.prtkDS", 0);
user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1356029474038");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1356029474020");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent112", "1356029474049");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent122", "1356029474061");
user_pref("keyword.URL", "hxxp://websearch.simplespeedy.info/?l=1&q=");
user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
user_pref("sweetim.toolbar.previous.keyword.URL", "");
user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
user_pref("sweetim.toolbar.searchguard.enable", "");
Emptied folder: C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\rk6fqmmz.default\minidumps [183 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.03.2013 at 15:30:10,67
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hast du dir den Keylogger selbst installiert?

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Ich habe keine Ahnung :O

Malwarebytes Anti-Rootkit BETA 1.01.0.1021
Malwarebytes : Free Anti-Malware download

Database version: v2013.03.04.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Damian :: DAMIAN-PC [administrator]

04.03.2013 14:51:15
mbar-log-2013-03-04 (14-51-15).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 30389
Time elapsed: 18 minute(s), 40 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKCU\SOFTWARE\CLASSES\linkrdr.AIEbho (Trojan.Banker) -> Delete on reboot.
HKCU\SOFTWARE\CLASSES\linkrdr.AIEbho.1 (Trojan.Banker) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
c:\$Recycle.Bin\S-1-5-21-2951023159-836439813-1825762036-1001\$R448MUT.exe (PUP.Offerware) -> Delete on reboot.
c:\Users\Damian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDRSTX46\agent_setup[1].exe (PUP.Offerware) -> Delete on reboot.

(end)

Ich habe keine Ahnung :O

Dann sollest du den Rechner Neuaufsetzen.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 13-03-05.01 - Damian 05.03.2013  18:44:23.1.4 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1721 [GMT 1:00]
ausgeführt von:: c:\users\Damian\Desktop\ComboFix.exe
AV: Kaspersky Security Suite CBE *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
FW: Kaspersky Security Suite CBE *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
SP: Kaspersky Security Suite CBE *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\autorun.inf
C:\CFLog
c:\cflog\CrashLog_20100730.txt
c:\cflog\CrashLog_20100903.txt
c:\cflog\CrashLog_20101120.txt
c:\cflog\CrashLog_20101226.txt
c:\cflog\CrashLog_20101227.txt
c:\cflog\CrashLog_20110105.txt
c:\cflog\CrashLog_20110115.txt
c:\cflog\CrashLog_20110316.txt
c:\cflog\CrashLog_20110527.txt
c:\cflog\CrashLog_20110530.txt
c:\cflog\CrashLog_20110702.txt
c:\cflog\CrashLog_20110713.txt
c:\cflog\CrashLog_20110724.txt
c:\cflog\CrashLog_20110823.txt
c:\cflog\CrashLog_20110915.txt
c:\cflog\CrashLog_20111021.txt
c:\users\Damian\AppData\Roaming\AcroIEHelpe.txt
c:\users\Damian\AppData\Roaming\Microsoft\Windows\Recent\desktop_9037018.ico
c:\users\Damian\AppData\Roaming\srvblck2.tmp
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\ST6UNST.000
c:\windows\SYS32
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-02-05 bis 2013-03-05  ))))))))))))))))))))))))))))))
.
.
2013-03-04 08:23 . 2013-03-04 08:23	--------	d-----w-	c:\users\Gast\AppData\Local\adawarebp
2013-03-03 19:06 . 2013-03-03 19:06	--------	d-----w-	c:\users\Damian\AppData\Local\adawarebp
2013-03-03 14:08 . 2013-03-03 14:08	--------	d-----w-	c:\windows\ERUNT
2013-03-03 14:07 . 2013-03-03 14:07	--------	d-----w-	C:\JRT
2013-03-03 11:33 . 2013-03-03 11:33	--------	d-----w-	c:\users\Damian\AppData\Roaming\Malwarebytes
2013-03-03 11:33 . 2013-03-03 11:33	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-03-03 11:33 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-03-03 11:31 . 2013-03-03 11:31	--------	d-----w-	c:\program files\SimpleSpeedy
2013-03-03 11:17 . 2013-03-03 11:17	--------	d-----w-	C:\_OTL
2013-03-01 20:29 . 2013-03-01 20:29	--------	d-----w-	c:\users\Damian\AppData\Roaming\LavasoftStatistics
2013-03-01 20:29 . 2013-03-01 20:36	--------	d-----w-	c:\program files\Ad-Aware Antivirus
2013-03-01 20:27 . 2013-03-01 20:27	--------	d-----w-	c:\program files\Toolbar Cleaner
2013-03-01 20:25 . 2013-03-01 20:25	44424	----a-w-	c:\windows\system32\sbbd.exe
2013-03-01 20:25 . 2013-03-01 20:25	13560	----a-w-	c:\windows\system32\drivers\gfibto.sys
2013-03-01 20:25 . 2013-03-03 11:15	--------	d-----w-	c:\users\Damian\AppData\Roaming\Ad-Aware Antivirus
2013-03-01 18:11 . 2013-02-08 00:45	6954968	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{E582FC4A-ABDF-48B5-B9F4-F3DA7E7E9C9B}\mpengine.dll	ERROR(0x00000005)
2013-02-13 19:25 . 2013-01-04 01:38	2048512	----a-w-	c:\windows\system32\win32k.sys
2013-02-13 19:25 . 2013-01-04 11:28	905576	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-02-13 19:25 . 2012-11-08 03:48	1314816	----a-w-	c:\windows\system32\quartz.dll
2013-02-13 19:25 . 2013-01-05 05:26	3602808	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-02-13 19:25 . 2013-01-05 05:26	3550072	----a-w-	c:\windows\system32\ntoskrnl.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-27 18:03 . 2012-04-15 07:43	691568	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-02-27 18:03 . 2011-07-07 18:30	71024	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-08 00:45 . 2008-10-01 13:31	6954968	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll	ERROR(0x00000005)
2013-01-17 00:28 . 2009-10-03 06:52	232336	------w-	c:\windows\system32\MpSigStub.exe
2012-12-16 13:12 . 2012-12-22 02:01	34304	----a-w-	c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-22 02:01	293376	----a-w-	c:\windows\system32\atmfd.dll
2012-07-03 14:40 . 2012-03-03 19:23	265120	----a-w-	c:\program files\Common Files\WireHelpSvc.exe
2013-02-27 13:13 . 2013-02-27 13:13	263064	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{F0E18261-91C3-9756-A4CB-CDADAB4E35F6}]
2013-03-03 12:01	118272	----a-w-	c:\programdata\contuinnUeToSaave\51333b9a7e7d4.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-07-03 135680]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-01-08 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-08-12 6265376]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Skytel"="Skytel.exe" [2008-08-12 1833504]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"AVP"="c:\program files\Kaspersky Security Suite CBE 12\avp.exe" [2012-04-10 202296]
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2013-01-31 542632]
.
c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]
.
c:\users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
NHL® 09 Registration.lnk - c:\program files\EA SPORTS\NHL 09\Support\EAregister.exe [N/A]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
LOLRecorder.lnk - c:\program files\LOLReplay\LOLRecorder.exe [2012-10-31 522752]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.285\SSScheduler.exe [2012-9-5 271808]
NETGEAR WNA3100 Genie.lnk - c:\program files\NETGEAR\WNA3100\WNA3100.exe [2012-12-28 8364288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Rainmeter.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
backup=c:\windows\pss\Rainmeter.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Aware Antivirus]
c:\program files\Ad-Aware Antivirus\AdAwareLauncher --windows-run [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-02 03:51	203416	----a-w-	c:\program files\Alcohol Soft\Alcohol 52\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CD Art Display]
2011-11-18 11:31	2691072	----a-w-	c:\program files\CD Art Display\CAD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EADM]
2012-08-16 08:34	3414680	----a-w-	c:\program files\Origin\Origin.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESL Wire]
2012-07-03 15:11	2667008	----a-w-	c:\program files\EslWire\wire.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-07-30 08:41	2363392	----a-w-	c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2012-09-30 13:59	3093624	----a-w-	c:\program files\Pando Networks\Media Booster\PMB.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2012-05-07 10:47	160840	----a-w-	c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2012-12-04 14:28	1354736	----a-w-	c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViGlance]
2009-08-10 10:20	438272	----a-w-	c:\program files\ViGlance\ViGlance.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
2009-09-30 15:57	718688	----a-w-	c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
S2 Ad-Aware Service;Ad-Aware Service;c:\program files\Ad-Aware Antivirus\AdAwareService.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-07-30 08:39	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-26 17:21	1629648	----a-w-	c:\program files\Google\Chrome\Application\25.0.1364.97\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 18:03]
.
2013-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-28 17:56]
.
2013-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-28 17:56]
.
2013-03-05 c:\windows\Tasks\schedule!1143840799.job
- c:\programdata\BetterSoft\ContinueToSave\ContinueToSave.exe [2013-03-03 19:58]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: Free YouTube Download - c:\users\Damian\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\Damian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} - hxxp://www.o2c.de/download/o2cplayer.cab
FF - ProfilePath - c:\users\Damian\AppData\Roaming\Mozilla\Firefox\Profiles\rk6fqmmz.default\
FF - ExtSQL: 2013-01-22 14:14; virtualKeyboard@kaspersky.ru; c:\program files\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru
FF - ExtSQL: 2013-01-22 14:50; KavAntiBanner@Kaspersky.ru; c:\program files\Kaspersky Security Suite CBE 12\FFExt\KavAntiBanner@Kaspersky.ru
FF - ExtSQL: 2013-01-22 14:50; linkfilter@kaspersky.ru; c:\program files\Kaspersky Security Suite CBE 12\FFExt\linkfilter@kaspersky.ru
FF - ExtSQL: 2013-03-03 13:01; aoes9ybv@k-iei.com; c:\users\Damian\AppData\Roaming\Mozilla\Firefox\Profiles\rk6fqmmz.default\extensions\aoes9ybv@k-iei.com
FF - ExtSQL: !HIDDEN! 2010-02-20 16:43; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
BHO-{ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a}  - (no file)
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
SharedTaskScheduler-{1984D045-52CF-49cd-DB77-08F378FEA4DB} - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
MSConfigStartUp-ICQ - c:\program files\ICQ6.5\ICQ.exe
MSConfigStartUp-Lexmark X74-X75 - c:\program files\Lexmark X74-X75\lxbbbmgr.exe
MSConfigStartUp-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-TrueTransparency - c:\users\Damian\Desktop\TrueTransparency13\TrueTransparency\TrueTransparency.exe
AddRemove-adawaretb - c:\program files\adawaretb\uninstall.exe
AddRemove-ContinueToSave - c:\progra~2\INSTAL~2\CONTIN~1\Setup.exe
AddRemove-SP_09b71135 - c:\program files\ContinueToSave\uninstall.exe
AddRemove-wbtooltb - c:\program files\wbtooltb\uninstall.exe
AddRemove-_{ADDBE07D-95B8-4789-9C76-187FFF9624B4} - c:\program files\Corel\CorelDRAW Essential Edition 3\Programs\MSILauncher {ADDBE07D-95B8-4789-9C76-187FFF9624B4}
AddRemove-{969D5EC1-A799-AF71-8E57-4D251CD96C12} - c:\progra~2\INSTAL~2\{2F965~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-03-05 19:00
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{117BE5F0-7AEC-3CA8-EC69-659CDB769AE5}*]
@Allowed: (Read) (RestrictedCode)
"eafbedkgof"=hex:66,61,64,62,66,61,64,6c,63,66,63,6e,00,fc
"daibbmlk"=hex:64,62,6a,68,68,66,66,67,66,62,66,69,70,6b,6f,6e,64,61,62,6c,65,
   6f,6c,69,67,6c,63,6e,67,6d,64,61,63,63,6d,6d,68,65,66,68,00,00
"ianhfheimfbbopegjb"=hex:6a,61,67,6c,70,69,6e,6b,67,68,64,61,66,6f,69,69,70,62,
   61,62,00,00
"halhlgcgdjcmkkpb"=hex:6a,61,67,6c,62,6a,70,6a,68,70,6a,62,61,6f,67,68,69,69,
   6e,6a,00,00
.
[HKEY_USERS\S-1-5-21-2951023159-836439813-1825762036-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E8E5C89-12C1-F64D-40DC-7467EC596B39}*]
"pafdgijmchnlkdgnckkjlblolknbdhla"=hex:6b,61,63,69,61,68,70,70,62,61,6f,68,64,
   6e,6e,65,69,67,68,6e,63,67,00,00
"ablejidngmhpaiojnonhlghcmnpckdbipl"=hex:6b,61,63,69,62,68,6d,70,6f,6c,6e,64,
   66,63,6f,69,61,6d,6b,62,6e,70,00,00
.
[HKEY_USERS\S-1-5-21-2951023159-836439813-1825762036-1001\Software\SecuROM\License information*]
"datasecu"=hex:52,1b,f8,25,71,8c,38,fc,ef,ef,84,88,bf,13,ac,e1,49,ed,f3,8f,9e,
   be,2b,c2,68,04,b4,a8,6b,07,0b,f6,08,9e,dc,39,da,33,42,5f,52,a2,06,cd,73,4a,\
"rkeysecu"=hex:4b,eb,45,3d,2f,f7,38,57,46,c5,d1,c4,92,64,b0,36
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet032\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-03-05  19:03:28
ComboFix-quarantined-files.txt  2013-03-05 18:03
.
Vor Suchlauf: 34 Verzeichnis(se), 312.892.448.768 Bytes frei
Nach Suchlauf: 38 Verzeichnis(se), 312.803.508.224 Bytes frei
.
- - End Of File - - F2869F5D21C4DBCC1C861E672B7228F9
         

Wie siehts aus?

Sehr gut!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe - (aswMBR.exe Anleitung)
  Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
  Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS-Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



danach:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

danach:

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

ASW:

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-03-06 14:07:46
-----------------------------
14:07:46.295    OS Version: Windows 6.0.6002 Service Pack 2
14:07:46.295    Number of processors: 4 586 0x1707
14:07:46.295    ComputerName: DAMIAN-PC  UserName: Damian
14:08:39.621    Initialize success
14:18:07.692    AVAST engine defs: 13030600
14:21:13.207    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3
14:21:13.207    Disk 0 Vendor: SAMSUNG_HD642JJ 1AA01113 Size: 610480MB BusType: 3
14:21:13.223    Disk 0 MBR read successfully
14:21:13.223    Disk 0 MBR scan
14:21:13.238    Disk 0 unknown MBR code
14:21:13.238    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       599472 MB offset 63
14:21:13.270    Disk 0 Partition 2 00     27 Hidden NTFS WinRE MSDOS5.0    11005 MB offset 1227719430
14:21:13.270    Disk 0 scanning sectors +1250258625
14:21:13.316    Disk 0 scanning C:\Windows\system32\drivers
14:21:23.709    Service scanning
14:21:32.965    Service KL1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5
14:21:32.996    Service kl2 C:\Windows\system32\DRIVERS\kl2.sys **LOCKED** 5
14:21:33.137    Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5
14:21:33.761    Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5
14:21:42.960    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
14:21:50.199    Modules scanning
14:22:00.055    Disk 0 trace - called modules:
14:22:00.071    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8b69c1f8]<<
14:22:00.086    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8cb73ac8]
14:22:00.086    3 CLASSPNP.SYS[916b48b3] -> nt!IofCallDriver -> [0x8c194898]
14:22:00.086    5 acpi.sys[80f7c6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0x8c1be030]
14:22:00.102    \Driver\atapi[0x8c1bc910] -> IRP_MJ_CREATE -> 0x8b69c1f8
14:22:03.628    AVAST engine scan C:\Windows
14:22:15.246    AVAST engine scan C:\Windows\system32
14:26:36.019    AVAST engine scan C:\Windows\system32\drivers
14:26:51.155    AVAST engine scan C:\Users\Damian
15:03:50.353    AVAST engine scan C:\ProgramData
15:31:57.867    Scan finished successfully
15:52:00.862    Disk 0 MBR has been saved successfully to "C:\Users\Damian\Desktop\MBR.dat"
15:52:00.867    The log file has been saved successfully to "C:\Users\Damian\Desktop\aswMBR.txt"
         

ESET:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ee487248206aff4ebc0f05040fbc1d8d
# engine=13313
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-03-06 05:33:38
# local_time=2013-03-06 06:33:38 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1285 16777214 100 99 3660687 59239130 0 0
# compatibility_mode=5892 16776574 100 100 429705 200123946 0 0
# scanned=448986
# found=19
# cleaned=0
# scan_time=9441
sh=D4EE0E4618F79735E3785C29FA03FEA545ED2971 ft=1 fh=63dfc0eb69987180 vn="Win32/Gimmiv.AA trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\vncdll.dll"
sh=9255C38BF09A94CA426178522A8C508B7452649B ft=0 fh=0000000000000000 vn="Win32/Exploit.CVE-2010-0822.A trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\CVE-2010-0822.xls"
sh=FCFE976B44E6FAA30EDA4127ECE73C5D51DDEEB5 ft=0 fh=0000000000000000 vn="SWF/Exploit.Agent.BX trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\CVE-2010-1297.swf"
sh=695F23BE17EE52B261918191C1ED9B69D017717F ft=0 fh=0000000000000000 vn="SWF/Exploit.CVE-2010-3654.B trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\CVE-2010-3654.swf"
sh=D2F5DAB385B6064277171AE9794FDDB9265EBDD4 ft=0 fh=0000000000000000 vn="MOV/Exploit.CVE-2011-0257.A trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\CVE-2011-0257.mov"
sh=EBA997BA42D77B2655BB42281063BCD2127974FE ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2010-0840.AA trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\cve-2010-0840\vuln\Exploit$1.class"
sh=B8331215FB6A0C696F7318B9CEE5CEC04CFDF7D1 ft=0 fh=0000000000000000 vn="Java/Agent.AA trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\cve-2010-0840\vuln\Link.class"
sh=474AF25F548ED4D5C55DA878DCAD35CCE683F988 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2010-0842.A trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\CVE-2010-0842\MyController.class"
sh=8132723668DBD38A1831761D4B408D7F21B6EA4F ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2010-3563.A trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\exploits\cve-2010-3563\Exploit.class"
sh=C3CBC0769F2C43291D57986FF211DB9D396D79FE ft=1 fh=c71c00116a1f8be8 vn="probably a variant of Win32/Agent.BVSWKTD trojan" ac=I fn="C:\metasploit\apps\pro\msf3\data\meterpreter\metsrv.dll"
sh=E654DFA6B7E8364047C8C3356B24ECAFCAD4D729 ft=0 fh=0000000000000000 vn="JS/TrojanDownloader.Agent.GJ trojan" ac=I fn="C:\metasploit\apps\pro\msf3\lib\rex\exploitation\heaplib.js.b64"
sh=56F2715E57E307B6DEAD33D09E979D8802EEF068 ft=0 fh=0000000000000000 vn="JS/TrojanDownloader.Psyme.NCX trojan" ac=I fn="C:\metasploit\apps\pro\msf3\modules\exploits\windows\browser\ie_createobject.rb"
sh=2715BD4943E243A12FFBEC90676158E4D647ABE8 ft=0 fh=0000000000000000 vn="JS/Exploit.CVE-2010-0806.NAH trojan" ac=I fn="C:\metasploit\apps\pro\msf3\modules\exploits\windows\browser\ms10_018_ie_behaviors.rb"
sh=56F2715E57E307B6DEAD33D09E979D8802EEF068 ft=0 fh=0000000000000000 vn="JS/TrojanDownloader.Psyme.NCX trojan" ac=I fn="C:\metasploit\msf3\modules\exploits\windows\browser\ie_createobject.rb"
sh=2715BD4943E243A12FFBEC90676158E4D647ABE8 ft=0 fh=0000000000000000 vn="JS/Exploit.CVE-2010-0806.NAH trojan" ac=I fn="C:\metasploit\msf3\modules\exploits\windows\browser\ms10_018_ie_behaviors.rb"
sh=127E9DDAA8ABFD82FED9485B0B4FC33C1748891A ft=0 fh=0000000000000000 vn="JS/TrojanDownloader.Psyme.NCX trojan" ac=I fn="C:\metasploit\msf3\modules\exploits\windows\browser\.svn\text-base\ie_createobject.rb.svn-base"
sh=8C571E06DB8D00935B65BAA34E8D007CA2911BAC ft=0 fh=0000000000000000 vn="JS/Exploit.CVE-2010-0806.NAH trojan" ac=I fn="C:\metasploit\msf3\modules\exploits\windows\browser\.svn\text-base\ms10_018_ie_behaviors.rb.svn-base"
sh=3E48C8D25B196D67722ED20CD36BF3448A4C9136 ft=1 fh=8ca2da5db5514665 vn="a variant of Win32/Adware.MultiPlug.I application" ac=I fn="C:\ProgramData\contuinnUeToSaave\51333b9a7e7d4.dll"
sh=3E48C8D25B196D67722ED20CD36BF3448A4C9136 ft=1 fh=8ca2da5db5514665 vn="a variant of Win32/Adware.MultiPlug.I application" ac=I fn="C:\Users\All Users\contuinnUeToSaave\51333b9a7e7d4.dll"
         

SECURITY:

 Results of screen317's Security Check version 0.99.59  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Security Suite CBE   
Lavasoft Ad-Aware              
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 Malwarebytes Anti-Malware Version 1.70.0.1100  
 CCleaner     
 Java(TM) 6 Update 26  
 Java 7 Update 7  
 Java(TM) 6 Update 7  
 Java SE Development Kit 7 Update 7 
 Java-Editor 11.18, 2012.09.27   
 Java version out of Date! 
 Adobe Flash Player 	11.6.602.171  
 Adobe Reader 10.1.4 Adobe Reader out of Date!  
 Mozilla Firefox (19.0) 
 Google Chrome 25.0.1364.152  
 Google Chrome 25.0.1364.97  
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe is disabled! 
 Ad-Aware AAWTray.exe is disabled! 
 Ad-Aware Antivirus AdAwareService.exe   
 Ad-Aware Antivirus SBAMSvc.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

• Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
• Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
• Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
• Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
  

  Folder::
  C:\metasploit\
  C:\ProgramData\contuinnUeToSaave
  C:\Users\All Users\
           

• Speichere dies als CFScript.txt auf deinem Desktop.
• Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
  Danach wieder anstellen nicht vergessen!
• Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
• Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  
  
• Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
• Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
  Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

danach:

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Logs von combofix im Anhnang, da zu groß:>

Und MB hat ncihts gefunden

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die .exe-Datei
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 17 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.