C:\Users\****\AppData\Local\Temp\jrscpls.exe

t'john · 04.05.2013, 08:48

Wenn du so einen Aufkleber nicht hast, dann hast du auch keine Lizenz.

Jimbohigh · 04.05.2013, 08:51

mhh gibts das? Dass man nen Notebook kaufst mit nen Windows system vorinstalliert ohne Lizenz?

t'john · 04.05.2013, 08:54

Eigentlich nicht.

Jimbohigh · 04.05.2013, 09:17

Hab bei notebooksbilliger.de mal geforscht und folgendes gefunden:

hxxp://www.notebooksbilliger.de/forum/Notebooks/IBMLENOVO/Windows+Lizenzschl%FCssel+nicht+auffindbar/Seite/1#294855

Bin mir nu nicht sicher ob ich nu ein neues System aufspielen kann oder nicht. Hab die 64bit version von win7 pro geladen. Also die Iso wo du den Link geschrieben hast. Den Key hab ich mitlerweile ausgelesen

t'john · 04.05.2013, 13:17

hm, das ist natuerlich ziemlich bloede mit dem neuen Verfahren.

Naja, aber irgendwann wirst du mal Neuaufsetzen muessen und es herausfinden muessen, wie es geht

Jimbohigh · 04.05.2013, 14:21

Das ist nicht das Problem mit ner Bootfähigen cd. Alles formatieren und neu installieren. Problem ist ober der Lizenz key den ich ausgelesen hab auf die version passt die man hier laden kann. Und wo ich noch garnicht dran gedacht hab wo ich die Treiber herbekomme die das Notebook verlangt und windows evtl. nicht mitliefert. Bin grad dabei alles auf usb festplatte zu sichern

t'john · 04.05.2013, 19:35

ja, schon klar.

Du kannst es ruhig machen, denn Win 7 hat ja zur Not eine lange Testzeit.
Bis dahin wirst du das auch mit dem Haendler geklaert haben.

Treiber gibt’s im Internet.

Jimbohigh · 11.05.2013, 08:39

So nu is auch mein PC betroffen obwohl ich alles was mit Cracks Zutun hat runtergeschmissen hab. Ich weiß nu nicht wie ich malere laufen lassen kann weil ich nicht den taskmanager gestartet bekomme

t'john · 11.05.2013, 11:10

Bitte erstelle dazu ein (neues)eigenes Thema mit diesen Logs:

Lade dir auf einem Zweitrechner bitte OTL (von Oldtimer) herunter und speichere es auf einen USB-Stick (nicht in einen Unterordner!).

Schliesse diesen USB-Stick nun an den infizierten Rechner an.
Starte den infizierten Computer in den abgesicherten Modus mit Eingabeaufforderung. (Anleitung)
In der Kommandozeile gib nun notepad ein und drücke Enter.
- Es öffnet sich ein Textdokument. Klicke auf Datei -> Speichern unter und wähle Arbeitsplatz.
- Lese hier nun den Laufwerksbuchstaben deines USB Sticks (z.B. e:\) ab.
- Schliesse Notepad wieder.
Gib nun bitte folgenden Befehl in die Kommandozeile ein und drücke Enter:
e:\OTL.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Wenn es bei dir ein anderer Buchstabe ist, dann passe den Befehl entsprechend an.
Es sollte sich nun das Fenster von OTL öffnen.
Unter Extra Registry, wähle bitte Use SafeList.
Setze den Haken bei Scan all Users.
Klicke nun auf Run Scan.
Wenn der Scan beendet ist, werden 2 Logfiles (OTL.txt und Extras.txt) angezeigt und auf den USB-Stick gespeichert.
Poste bitte auf dem Zweitrechner den Inhalt dieser Logfiles hier in den Thread.

Jimbohigh · 11.05.2013, 12:10

Nu is was komisches passiert ich wollte den PCs runterfahren mit Strg alt und entfernen und dann unten rechts auf runterfahren und Zack war mein Desktop wieder da. Hab nu paar ?Ueberm Kopf. Lass erstmal vollständig Malwarebytes laufen

t'john · 12.05.2013, 11:24

Bitte das Malwarebytes-Logfile posten, das du schon gemacht hast!
(Reiter Logdateien)

Jimbohigh · 05.06.2013, 18:37

So den hab ich grad gemacht. Hat was gedauert war im Krankenhaus. Scheint zu ner Gewohnheit zu werden

[Spoiler]Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.06.03.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Norman :: NORMAN-PC [Administrator]

05.06.2013 18:26:02
mbam-log-2013-06-05 (18-26-02).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 354259
Laufzeit: 1 Stunde(n), 1 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Daten: C:\PROGRA~2\rundll32.exe C:\PROGRA~2\bt1fo.dat,FG00 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
[/Spoiler]

t'john · 06.06.2013, 18:17

OTL Logs?

Jimbohigh · 08.06.2013, 09:06

[spoiler]
logs:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 07.06.2013 14:41:58 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = F:\Downloads
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 42,74% Memory free
4,00 Gb Paging File | 2,31 Gb Available in Paging File | 57,90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 0,02 Gb Free Space | 0,10% Space Free | Partition Type: NTFS
Drive D: | 244,14 Gb Total Space | 84,06 Gb Free Space | 34,43% Space Free | Partition Type: NTFS
Drive E: | 195,31 Gb Total Space | 65,57 Gb Free Space | 33,57% Space Free | Partition Type: NTFS
Drive F: | 472,52 Gb Total Space | 48,26 Gb Free Space | 10,21% Space Free | Partition Type: NTFS
Drive H: | 517,11 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: ***** | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - F:\Downloads\OTL.exe (OldTimer Tools)
PRC - D:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)
PRC - D:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
PRC - D:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
PRC - D:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)
PRC - C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)
PRC - D:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - D:\Program Files\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Programme\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com)
PRC - C:\ProgramData\TVersity\Media Server\MediaServer.exe ()
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\D-Link\DWA-131 revA\wirelesscm.exe (D-Link Corp.)
PRC - C:\Programme\D-Link\DWA-131 revA\WlanWpsSvc.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Programme\D-Link\DWA-131 revA\WlanDll.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AVKWCtl) -- D:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)
SRV - (MBAMService) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AVKProxy) -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)
SRV - (GDFwSvc) -- D:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (GDScan) -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)
SRV - (AVKService) -- D:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Microsoft SharePoint Workspace Audit Service) -- D:\Programme\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (TeamViewer7) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (TVersityMediaServer) -- C:\ProgramData\TVersity\Media Server\MediaServer.exe ()
SRV - (fsssvc) -- C:\Programme\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WlanWpsSvc) -- C:\Programme\D-Link\DWA-131 revA\WlanWpsSvc.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)
DRV - (GDPkIcpt) -- C:\Windows\System32\drivers\PktIcpt.sys (G Data Software AG)
DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G Data Software AG)
DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)
DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)
DRV - (GDBehave) -- C:\Windows\System32\drivers\GDBehave.sys (G Data Software AG)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (GdNetMon) -- C:\Windows\System32\drivers\GdNetMon32.sys (G Data Software AG)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (RTL8192su) -- C:\Windows\System32\drivers\RTL8192su.sys (Realtek Semiconductor Corporation                           )
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKLM\..\URLSearchHook: {66bd2442-241b-44cd-8c7a-b51037053cdb} - C:\Programme\TVersitybar\prxtbTVer.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = F:\Downloads
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 D0 D0 74 C5 AE CC 01  [binary data]
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\..\URLSearchHook: {66bd2442-241b-44cd-8c7a-b51037053cdb} - C:\Programme\TVersitybar\prxtbTVer.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\..\SearchScopes\{0344DE44-B169-42D7-8F38-AFA9053404E3}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2548838
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://192.168.0.102/#!/tv/bouquets/1%3A7%3A1%3A0%3A0%3A0%3A0%3A0%3A0%3A0%3AFROM%20BOUQUET%20%22userbouquet.favourites.tv%22%20ORDER%20BY%20bouquet"
FF - prefs.js..extensions.enabledAddons: %7BEEE6C361-6118-11DC-9C72-001320C79847%7D:1.9.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&crg=3.1010000.10025&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme\java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.12.06 14:53:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Norman\AppData\Roaming\mozilla\Extensions
[2013.02.11 20:30:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Norman\AppData\Roaming\mozilla\Firefox\Profiles\9myqteg4.default\extensions
[2013.02.11 20:30:07 | 000,190,000 | ---- | M] () (No name found) -- C:\Users\Norman\AppData\Roaming\mozilla\firefox\profiles\9myqteg4.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
[2012.12.09 08:36:42 | 000,003,915 | ---- | M] () -- C:\Users\Norman\AppData\Roaming\mozilla\firefox\profiles\9myqteg4.default\searchplugins\sweetim.xml
[2013.06.05 19:15:59 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.06.05 19:15:59 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011.11.29 21:50:18 | 000,002,048 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (TVersitybar Toolbar) - {66bd2442-241b-44cd-8c7a-b51037053cdb} - C:\Programme\TVersitybar\prxtbTVer.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - d:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (TVersitybar Toolbar) - {66bd2442-241b-44cd-8c7a-b51037053cdb} - C:\Programme\TVersitybar\prxtbTVer.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-1469351888-39491624-1925880183-1000\..\Toolbar\WebBrowser: (TVersitybar Toolbar) - {66BD2442-241B-44CD-8C7A-B51037053CDB} - C:\Programme\TVersitybar\prxtbTVer.dll (Conduit Ltd.)
O4 - HKLM..\Run: [BCSSync] D:\Programme\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [G Data AntiVirus Tray] D:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] D:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: An OneNote s&enden - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Easy-WebPrint - Drucken - d:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - d:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - d:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - d:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Norman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Norman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DEB0EAB9-B30F-48A7-9DEC-FF4198083F12}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [1998.08.19 14:07:30 | 000,000,057 | R--- | M] () - H:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{3687a14c-1ab3-11e1-9fb0-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{3687a14c-1ab3-11e1-9fb0-806e6f6e6963}\Shell\AutoRun\command - "" = H:\LAUNCHER\Launcher.exe -- [1999.01.05 18:57:48 | 001,810,944 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.06 03:02:50 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.06.05 20:20:52 | 000,016,048 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GdPhyMem.sys
[2013.06.05 19:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity 2014
[2013.06.05 19:15:44 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.06.04 03:02:47 | 000,218,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2013.06.03 17:59:08 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wwanprotdim.dll
[2013.06.03 17:59:02 | 002,347,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.06.03 17:57:59 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2013.06.03 17:57:59 | 000,101,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2013.05.11 13:06:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.11 13:06:18 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.04.04 16:37:55 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Norman\AppData\Roaming\pcouffin.sys
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.07 14:36:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.06 06:58:09 | 000,001,041 | ---- | M] () -- C:\Users\Norman\AppData\Roaming\vso_ts_preview.xml
[2013.06.06 06:47:32 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.06 06:47:32 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.06 06:44:33 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.06.06 06:44:33 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.06.06 06:44:33 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.06.06 06:44:33 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.06.06 06:40:15 | 000,000,202 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2013.06.06 06:39:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.06 06:39:49 | 1609,474,048 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.05 20:20:52 | 000,030,896 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2013.06.05 20:20:52 | 000,016,048 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GdPhyMem.sys
[2013.06.05 19:58:04 | 000,052,056 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\PktIcpt.sys
[2013.06.05 19:57:56 | 000,000,896 | ---- | M] () -- C:\Users\Public\Desktop\G Data InternetSecurity 2014.lnk
[2013.06.05 19:57:54 | 000,054,104 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\gdwfpcd32.sys
[2013.06.05 19:57:52 | 000,051,032 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys
[2013.06.05 19:57:23 | 000,096,344 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\MiniIcpt.sys
[2013.06.05 19:57:23 | 000,045,912 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\GDBehave.sys
[2013.06.05 16:15:53 | 001,096,930 | ---- | M] () -- C:\Windows\System32\sig.bin
[2013.06.05 16:15:53 | 000,055,649 | ---- | M] () -- C:\Windows\System32\nmp.map
[2013.06.04 03:18:45 | 000,342,152 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.06.03 17:17:26 | 095,023,320 | ---- | M] () -- C:\ProgramData\of1tb.pad
[2013.05.11 13:07:33 | 000,000,765 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.11 09:31:55 | 095,023,320 | ---- | M] () -- C:\ProgramData\olin4i.pad
[2013.05.11 09:31:25 | 000,001,023 | ---- | M] () -- C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
 
========== Files Created - No Company Name ==========
 
[2013.06.05 19:57:56 | 000,000,896 | ---- | C] () -- C:\Users\Public\Desktop\G Data InternetSecurity 2014.lnk
[2013.05.11 13:06:21 | 000,000,765 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.11 09:31:25 | 000,001,023 | ---- | C] () -- C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
[2013.05.11 09:31:17 | 095,023,320 | ---- | C] () -- C:\ProgramData\olin4i.pad
[2013.05.11 09:30:56 | 095,023,320 | ---- | C] () -- C:\ProgramData\of1tb.pad
[2013.04.04 16:39:17 | 000,001,041 | ---- | C] () -- C:\Users\Norman\AppData\Roaming\vso_ts_preview.xml
[2013.04.04 16:37:55 | 000,087,608 | ---- | C] () -- C:\Users\Norman\AppData\Roaming\inst.exe
[2013.04.04 16:37:55 | 000,007,887 | ---- | C] () -- C:\Users\Norman\AppData\Roaming\pcouffin.cat
[2013.04.04 16:37:55 | 000,001,144 | ---- | C] () -- C:\Users\Norman\AppData\Roaming\pcouffin.inf
[2013.03.23 16:27:54 | 000,000,600 | ---- | C] () -- C:\Users\Norman\AppData\Local\PUTTY.RND
[2012.07.30 22:13:51 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2012.07.30 22:13:50 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012.03.04 20:23:39 | 000,000,017 | ---- | C] () -- C:\Users\Norman\AppData\Local\resmon.resmoncfg
[2011.12.09 18:47:07 | 000,000,135 | ---- | C] () -- C:\Windows\AutoKMS.ini
[2011.12.04 19:45:14 | 000,000,000 | ---- | C] () -- C:\Windows\OpPrintServer.INI
[2011.12.04 19:44:15 | 000,008,704 | ---- | C] () -- C:\Windows\System32\CNMVS79.DLL
[2011.11.30 18:38:59 | 001,096,930 | ---- | C] () -- C:\Windows\System32\sig.bin
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.04.11 06:16:21 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Bukuy
[2013.04.26 11:50:52 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\calibre
[2013.03.05 17:52:15 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\DAEMON Tools Pro
[2013.04.11 06:16:18 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Doyxi
[2012.01.30 18:50:58 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\DVDVideoSoft
[2012.01.30 18:50:50 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.01.13 17:36:51 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Free iPad Video Converter
[2013.04.11 06:16:29 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Kaoxqo
[2013.04.24 18:33:04 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Kueq
[2013.04.24 18:33:12 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Leru
[2012.01.08 10:15:59 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\SpeedProject
[2012.09.03 06:53:08 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\streamripper
[2011.12.06 14:53:06 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Thunderbird
[2013.06.06 16:03:24 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\TrueCrypt
[2012.08.04 20:49:56 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Ubisoft
[2013.06.06 06:58:10 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Vso
[2011.12.06 14:10:57 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Windows Live Writer
[2013.04.24 18:33:05 | 000,000,000 | ---D | M] -- C:\Users\Norman\AppData\Roaming\Ziobi
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

exrasOTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 07.06.2013 14:41:59 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = F:\Downloads
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 42,74% Memory free
4,00 Gb Paging File | 2,31 Gb Available in Paging File | 57,90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 0,02 Gb Free Space | 0,10% Space Free | Partition Type: NTFS
Drive D: | 244,14 Gb Total Space | 84,06 Gb Free Space | 34,43% Space Free | Partition Type: NTFS
Drive E: | 195,31 Gb Total Space | 65,57 Gb Free Space | 33,57% Space Free | Partition Type: NTFS
Drive F: | 472,52 Gb Total Space | 48,26 Gb Free Space | 10,21% Space Free | Partition Type: NTFS
Drive H: | 517,11 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: *****| User Name: ******* | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "d:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "d:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [TVersity] -- "C:\ProgramData\TVersity\Media Server\GUILaunch.exe" -type "folder" -url "%1" -title "" -tags "" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{071D7E80-B182-43A5-BAD8-72F113BE5E85}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{1245B2CB-B639-461C-ABE8-F1D8923E6009}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{162B03D7-5ADE-48C4-AA24-7FBDBD73F2FE}" = lport=137 | protocol=17 | dir=in | app=system | 
"{1CF17D72-1B6F-47F3-99CC-F02BC9FBD55E}" = rport=445 | protocol=6 | dir=out | app=system | 
"{3114482A-EAB7-47CF-A81A-DC1D3D943A78}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3BA5CB08-66D3-4966-AE07-1F6F03492BA0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{76D48044-5E55-4195-B6D3-85CE62728E1B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{76F3619D-206B-4A5F-A6C1-6B5859DB1124}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{797FF947-448D-4BFF-BD44-A7762D296D26}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{91E84701-24C7-418A-8BB2-51832154B7F4}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{94F76A83-8EFE-4E87-9E66-E0AE0A8ABB80}" = rport=139 | protocol=6 | dir=out | app=system | 
"{957B42B8-9B4F-4854-BFBD-8598E26133E8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{A1EFCEA3-ACC0-4C88-8214-15A95D423DD1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{A891B9BA-E467-4593-8AA8-7310D0132273}" = rport=138 | protocol=17 | dir=out | app=system | 
"{AECC6FD1-2471-4088-98F2-E91ECE05A973}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{CA53A1C3-E39E-46DC-8D6E-838F95399224}" = lport=139 | protocol=6 | dir=in | app=system | 
"{CADC6ABC-03F7-4D0C-9473-F07824D2B00A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{D20878DE-ACBE-4E69-BCAD-EE07C26AC83B}" = lport=138 | protocol=17 | dir=in | app=system | 
"{D7979091-5805-416D-9B48-E9683F02B045}" = lport=445 | protocol=6 | dir=in | app=system | 
"{F4F62436-3E90-4F2E-A1F9-C93521192053}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{FC1CBB38-E2EF-47B6-A0BE-08F356F02A82}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{FF07394C-A7EC-4448-9FCF-8185B787B460}" = rport=137 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01317A07-E99B-4977-AEB4-71AD3DB83DB1}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe | 
"{10D6CDCA-D248-4963-90EA-CC16C6B9F2F8}" = protocol=17 | dir=in | app=d:\programme\microsoft office\office14\groove.exe | 
"{203943F2-8D06-4BA2-9E56-F2449691A27E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{234EDA21-FEBF-48FB-A774-0A97D86EA958}" = protocol=6 | dir=in | app=d:\programme\microsoft office\office14\onenote.exe | 
"{30909616-777E-48ED-A3EF-CCC33CFD91A2}" = protocol=6 | dir=in | app=d:\programme\microsoft office\office14\groove.exe | 
"{317C00D1-FC1E-43D4-B8FE-A9060B4E8B5C}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe | 
"{3370E9CE-C28A-492B-9C26-4526A9B9F02B}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe | 
"{34B1AC27-EDCF-4ED9-9BE1-062194B15DEF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{44CFCAC0-B197-4BD7-92FC-21F0C4CE14C5}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{45B50DBE-A96A-4C0A-8777-358DCF3C0C04}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{4CA96F88-2021-48F3-BB7C-869E05F1381F}" = dir=in | app=d:\programme\itunes\itunes.exe | 
"{5124008C-5CA2-49C6-B13F-11C1B8690F65}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | 
"{557B9AB3-6F1F-4625-A7F9-51B686E37E95}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{58C5D8B4-BB52-4C1A-96DB-E3E85532C325}" = dir=in | app=c:\program files\windows live\mesh\moe.exe | 
"{5A52F096-59A3-492D-8611-DDA391C1FD3A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{65CF01C7-4760-4EF1-9A9F-9EB2F9898309}" = protocol=6 | dir=in | app=e:\anno 1404\tools\anno4web.exe | 
"{68839446-1F0E-431B-98A0-B5CBB0397DCB}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{6AC87358-8AE4-476A-8583-DC58783A29FF}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe | 
"{6C0AD448-5EF5-4300-B035-EB7E1EE07EF3}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | 
"{7ECE359B-DBBC-4DAA-AE12-71362101A8DA}" = protocol=17 | dir=in | app=e:\anno 1404\addon.exe | 
"{80E993E6-1881-4F59-8160-5778F1BF8582}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe | 
"{8D1CB061-F9D9-42A7-8414-2D43949AE26C}" = protocol=6 | dir=in | app=e:\anno 1404\tools\addonweb.exe | 
"{8EE06075-47E3-4680-AAD7-4425645370CC}" = protocol=6 | dir=in | app=e:\anno 1404\addon.exe | 
"{9D4B2228-EFC7-4D98-A245-9A01FBBF8FBA}" = protocol=17 | dir=in | app=e:\anno 1404\anno4.exe | 
"{9F202663-CCBD-4882-B8BD-61FA47C1C1E4}" = protocol=17 | dir=in | app=e:\anno 1404\tools\addonweb.exe | 
"{A8C9A34E-A940-4531-BBDC-3D4BEB08F376}" = dir=in | app=c:\programdata\tversity\media server\mediaserver.exe | 
"{ACC39E61-6348-4E23-A3CE-57E70ABFA208}" = protocol=17 | dir=in | app=d:\programme\microsoft office\office14\onenote.exe | 
"{B4E6512A-780F-4BCC-BF89-76C3D0DED5E3}" = protocol=17 | dir=in | app=e:\anno 1404\tools\anno4web.exe | 
"{E3DC00C6-CD4F-431F-A0A0-287681728940}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe | 
"{F618F212-9620-4A90-9848-0026AED24E12}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{FD3A8381-3F7A-406C-BAF7-0B0A867250CF}" = protocol=6 | dir=in | app=e:\anno 1404\anno4.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C43FE6B-E881-4AFC-B384-4AEBC90047E8}" = SweetPacks bundle uninstaller
"{0D6E77E1-5898-4778-B2B8-378F4554D6C9}_is1" = StarcCaft Gold Edition
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5482DCBE-D2D1-47B0-A621-DF8E2B0D174C}" = Windows Live Family Safety
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7765322A-8601-47D3-AC60-B66677450D7B}" = G Data InternetSecurity 2014
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A0C9DF2B-89B5-4483-8983-18A68200F1B4}" = SweetIM for Messenger 3.7
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A837BCE6-BCB1-4A44-8807-A678EAF06933}" = ANNO 1404 Entwickler-Tools
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BCF16F16-AC0E-4ABE-A9EF-412CF484BA51}" = Windows Live Family Safety
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D060E2E3-5509-4420-AA04-FA197C6678C8}" = calibre
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D9198056-A296-4583-A790-C0E73694CFE8}" = D-Link DWA-131 Wireless N Nano USB Adapter
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.0.3.312
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}" = Update Manager for SweetPacks 1.1
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CANONBJ_Deinstall_CNMCP79.DLL" = Canon iP5200
"CANONIJINBOXADDON100" = Canon Inkjet Printer Driver Add-On Module
"DreamBoxEdit" = DreamBoxEdit -- The one and only settings editor for your Dreambox
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-WebPrint" = Easy-WebPrint
"facemoods" = Facemoods Toolbar
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free iPad Video Converter_is1" = Free iPad Video Converter 3.7.2.1
"Free YouTube Download_is1" = Free YouTube Download version 3.0.20.1228
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.13.1123
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"SimCity 3000" = SimCity 3000
"SpeedCommander 14" = SpeedCommander 14
"Streamripper" = Streamripper (Remove only)
"TeamViewer 7" = TeamViewer 7
"TrueCrypt" = TrueCrypt
"TVersity Codec Pack" = TVersity Codec Pack 1.7
"TVersity Media Server" = TVersity Media Server 1.9.7
"TVersitybar Toolbar" = TVersitybar Toolbar
"UltraStar Deluxe" = UltraStar Deluxe
"UltraStar Manager" = UltraStar Manager
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1469351888-39491624-1925880183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"JNLP" = JNLP
"KindlePreviewer" = Kindle Previewer
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 07.06.2013 08:36:57 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:57 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:57 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:57 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:57 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:57 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:58 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:58 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11711
Description = 
 
Error - 07.06.2013 08:36:58 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 11712
Description = 
 
Error - 07.06.2013 08:36:58 | Computer Name = Norman-PC | Source = MsiInstaller | ID = 1023
Description = 
 
[ System Events ]
Error - 14.03.2013 16:09:47 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:48 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:49 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:50 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:51 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:52 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:53 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:54 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:55 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 14.03.2013 16:09:56 | Computer Name = Norman-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
 
< End of report >

--- --- ---

[/spoiler]

t'john · 08.06.2013, 18:57

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Ersetze die *** Sternchen wieder in den Benutzernamen zurück!

Code:

ATTFilter

:OTL

O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com) 
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) 
[2013.06.03 17:17:26 | 095,023,320 | ---- | M] () -- C:\ProgramData\of1tb.pad 
[2013.05.11 09:31:55 | 095,023,320 | ---- | M] () -- C:\ProgramData\olin4i.pad 
[2013.05.11 09:31:25 | 000,001,023 | ---- | M] () -- C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk 
[2013.04.04 16:37:55 | 000,087,608 | ---- | C] () -- C:\Users\Norman\AppData\Roaming\inst.exe 
[2013.06.06 06:40:15 | 000,000,202 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job 

:Files 
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\*****\*.tmp
C:\Users\*****\AppData\*.dll
C:\Users\*****\AppData\*.exe
C:\Users\*****\AppData\Local\Temp\*.exe
C:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

dann:

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

dann:
Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

04.05.2013, 08:48	#16
t'john /// Helfer-Team	$C:\Users\**\AppData\Local\Temp\jrscpls.exe - Standard$ C:\Users\\AppData\Local\Temp\jrscpls.exe Wenn du so einen Aufkleber nicht hast, dann hast du auch keine Lizenz. __________________ Mfg, t'john** Das TB unterstützen

04.05.2013, 08:54	#18
t'john /// Helfer-Team	$C:\Users\**\AppData\Local\Temp\jrscpls.exe - Standard$ C:\Users\**\AppData\Local\Temp\jrscpls.exe Eigentlich nicht. __________________ __________________

04.05.2013, 13:17	#20
t'john /// Helfer-Team	$C:\Users\**\AppData\Local\Temp\jrscpls.exe - Standard$ C:\Users\\AppData\Local\Temp\jrscpls.exe hm, das ist natuerlich ziemlich bloede mit dem neuen Verfahren. Naja, aber irgendwann wirst du mal Neuaufsetzen muessen und es herausfinden muessen, wie es geht __________________ Mfg, t'john** Das TB unterstützen

04.05.2013, 19:35	#22
t'john /// Helfer-Team	$C:\Users\**\AppData\Local\Temp\jrscpls.exe - Standard$ C:\Users\\AppData\Local\Temp\jrscpls.exe ja, schon klar. Du kannst es ruhig machen, denn Win 7 hat ja zur Not eine lange Testzeit. Bis dahin wirst du das auch mit dem Haendler geklaert haben. Treiber gibt’s im Internet. __________________ Mfg, t'john** Das TB unterstützen

12.05.2013, 11:24	#26
t'john /// Helfer-Team	$C:\Users\**\AppData\Local\Temp\jrscpls.exe - Standard$ C:\Users\\AppData\Local\Temp\jrscpls.exe Bitte das Malwarebytes-Logfile posten, das du schon gemacht hast! (Reiter Logdateien) __________________ Mfg, t'john** Das TB unterstützen

C:\Users\****\AppData\Local\Temp\jrscpls.exe

Plagegeister aller Art und deren Bekämpfung: C:\Users\****\AppData\Local\Temp\jrscpls.exe