BKA-Trojaner auf Vista-32bit PC mit XP als 2. BS

MrMaho · 20.03.2013, 22:57

Hallo zusammen,

Habe seit kurzem einen BKA-Trojaner auf meinem PC. Es kam das bekannte Bild mit der Aufforderung,100€ zu zahlen.Kein Zugriff mehr auf den Rechner über Vista. Beim Neustart nur noch white screen. Glücklicherweise habe ich auch XP auf dem Rechner und kann evtl darüber zugreifen, nach einem Neustart kann ich zw. den BS auswählen. Vista läuft nicht. Leider lieferten auch alle Scans mit Antiviren-SW (AVIRA, usw.) und auch Kaspersky-rescue nichts. Auch in der registry konnte ich keine Einträge finden (unter HKEYLOCALMACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon steht “explorer.exe”). Auch Foren, wie gutefrage.net, chip.de, computerbase.de/forum, usw. konnten bisher nicht helfen. Leider habe ich zurzeit auch keinen Internetzugang mehr auf dem PC, wurde durch Trojaner lahmgelegt.

Wer kann mir hier helfen?

###############################################

Hier das txt-logfile von malware, ich habe nur Suchlauf gemacht und noch nichts gelöscht:

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2012.12.14.11

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
MrM :: MRM-PC [Administrator]

20.03.2013 18:46:08
mbam-log-2013-03-20 (18-46-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 690621
Laufzeit: 1 Stunde(n), 41 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell (Trojan.Agent.RNS) -> Daten: explorer.exe,C:\Users\MrM\AppData\Roaming\skype.dat -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Users\MrM\XP statt Vista\RemoveWGA.exe (PUP.RemoveWGA) -> Keine Aktion durchgeführt.
C:\Users\MrM\XP statt Vista\RemoveWGA12.exe (PUP.RemoveWGA) -> Keine Aktion durchgeführt.
D:\MrM\XP statt Vista\RemoveWGA.exe (PUP.RemoveWGA) -> Keine Aktion durchgeführt.
D:\MrM\XP statt Vista\RemoveWGA12.exe (PUP.RemoveWGA) -> Keine Aktion durchgeführt.
C:\Users\MrM\AppData\Roaming\skype.dat (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)

Hier die logfiles von Gmer, OTL und EXTRAS:

GMER 2.1.19155 - hxxp://www.gmer.net
Rootkit scan 2013-03-20 22:43:01
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5000AAKS-07A7B0 rev.01.03B01 465,76GB
Running: gmer_2.1.19155.exe; Driver: C:\Users\MrM\AppData\Local\Temp\pwldypog.sys

---- Devices - GMER 2.1 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000272a29f3c (not active ControlSet)
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272a29f3c
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\000272a29f3c (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Capabilities@ApplicationDescription C:\Windows\explorer.exe (Windows Explorer/Microsoft Corporation SIGNED)(2009-05-28 18:02:40)

---- EOF - GMER 2.1 ----

#################################################

OTL logfile created on: 20.03.2013 21:21:38 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MrM\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 75,19% Memory free
6,25 Gb Paging File | 5,82 Gb Available in Paging File | 93,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,63 Gb Total Space | 27,38 Gb Free Space | 17,82% Space Free | Partition Type: NTFS
Drive D: | 303,34 Gb Total Space | 132,59 Gb Free Space | 43,71% Space Free | Partition Type: NTFS
Drive F: | 1,91 Gb Total Space | 0,28 Gb Free Space | 14,48% Space Free | Partition Type: FAT32

Computer Name: MRM-PC | User Name: MrM | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.03.20 21:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MrM\Desktop\OTL.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.21 03:23:50 | 000,318,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cmd.exe

========== Modules (No Company Name) ==========

MOD - [2010.07.04 22:32:38 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

========== Services (SafeList) ==========

SRV - [2013.01.09 17:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) [Disabled | Stopped] -- C:\Program Files\PDF Architect\ConversionService.exe -- (PDF Architect Service)
SRV - [2013.01.09 17:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) [Disabled | Stopped] -- C:\Program Files\PDF Architect\HelperService.exe -- (PDF Architect Helper Service)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.29 11:26:54 | 001,260,472 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.12.29 02:53:20 | 000,383,416 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.05.08 19:34:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 19:34:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.27 14:01:16 | 000,314,368 | ---- | M] (Uwe Sieber - www.uwe-sieber.de) [Disabled | Stopped] -- C:\Users\MrM\Desktop\USBDLM\USBDLM.exe -- (USBDLM)
SRV - [2009.01.02 20:14:28 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.12.18 13:21:16 | 000,341,264 | ---- | M] (Fujitsu Siemens Computers) [Disabled | Stopped] -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.12.14 17:00:00 | 000,544,768 | ---- | M] (Magix AG) [Disabled | Stopped] -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [File_System | On_Demand | Stopped] -- -- (StarOpen)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsu.sys -- (nmwcdnsu)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\FsUsbExDisk.SYS -- (FsUsbExDisk)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwrchid.sys -- (btwrchid)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwl2cap.sys -- (btwl2cap)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwavdt.sys -- (btwavdt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2012.12.29 11:26:54 | 008,904,632 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.05.08 19:34:48 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 19:34:48 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.02.08 11:46:58 | 000,673,792 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw66xxx.sys -- (hcw66xxx)
DRV - [2010.11.25 06:59:16 | 000,541,800 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.10.22 02:00:00 | 000,586,752 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2010.10.22 02:00:00 | 000,004,352 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2010.07.04 20:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.01.09 00:42:40 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2008.11.11 15:05:18 | 000,003,768 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SndTVideo.sys -- (SndTVideo)
DRV - [2008.11.11 15:05:16 | 000,023,096 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SndTAudio.sys -- (SndTAudio)
DRV - [2008.07.22 09:21:08 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.07.08 02:32:52 | 001,050,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008.04.03 13:58:46 | 000,076,688 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2008.01.10 02:34:43 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2008.01.10 02:34:42 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2007.12.11 09:52:12 | 000,026,784 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2007.04.24 17:52:10 | 000,016,688 | ---- | M] (IBM) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\LUMDriver.sys -- (LUMDriver)
DRV - [2006.02.17 20:34:24 | 000,083,344 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510obex.sys -- (k510obex)
DRV - [2006.02.17 20:34:22 | 000,085,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mgmt.sys -- (k510mgmt)
DRV - [2006.02.17 20:34:17 | 000,094,064 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mdm.sys -- (k510mdm)
DRV - [2006.02.17 20:34:15 | 000,008,336 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mdfl.sys -- (k510mdfl)
DRV - [2006.02.17 20:34:10 | 000,058,288 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510bus.sys -- (k510bus)
DRV - [2005.10.28 04:38:18 | 000,402,432 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZD1211BU.sys -- (ZD1211BU(ZyDAS)
DRV - [2004.10.25 12:40:58 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2004.05.02 09:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GVCplDrv.sys -- (GVCplDrv)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FUJC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3201318

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {3bbd3c14-4c16-4989-8366-95bc9179779d} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1993C63F-2963-4CC7-9B04-BAE0986821CE}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FUJC
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: sammelfreund@webmiles.de:1.12
FF - prefs.js..extensions.enabledItems: firefox1@myibay.com:1.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {f4e6547e-325b-403c-a3bb-ad29ed37a92f}:3.2.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.08 15:04:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013.03.10 11:41:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 09:23:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.01.05 13:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2013.01.05 13:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins

[2012.10.22 18:56:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Extensions
[2012.03.05 23:13:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2013.03.08 17:07:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions
[2013.02.24 10:55:21 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.12.16 11:15:03 | 000,000,000 | ---D | M] (SaveByclick) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions\50cd9c8a1087a@50cd9c8a108b4.com
[2012.03.05 23:13:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Sunbird\Profiles\v4xtg7wk.default\extensions
[2013.03.08 17:07:58 | 000,538,938 | ---- | M] () (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\extensions\toolbar@web.de.xpi
[2012.11.30 22:21:31 | 000,077,690 | ---- | M] () (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}.xpi
[2012.08.30 19:48:29 | 000,000,853 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\11-suche.xml
[2010.11.23 12:14:58 | 000,000,929 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\conduit.xml
[2012.08.30 19:48:29 | 000,002,209 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\englische-ergebnisse.xml
[2012.08.30 19:48:29 | 000,010,506 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\gmx-suche.xml
[2013.03.10 11:16:49 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin-1.xml
[2009.09.19 07:05:43 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin-2.xml
[2009.09.19 21:36:06 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin-3.xml
[2009.10.29 01:00:16 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin-4.xml
[2009.09.16 21:08:42 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin.xml
[2012.08.30 19:48:29 | 000,002,368 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\lastminute.xml
[2012.09.24 22:32:12 | 000,002,515 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\Search_Results.xml
[2012.08.30 19:48:29 | 000,005,489 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\webde-suche.xml
[2012.10.22 18:56:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.12 17:08:47 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.11.23 20:36:46 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Program Files\Mozilla Firefox\extensions\quickstores@quickstores.de
[2013.03.09 09:23:22 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.06.09 17:21:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.06 17:37:06 | 000,002,351 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.10.01 06:14:06 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.09 17:21:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.09 17:21:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.24 22:32:12 | 000,002,515 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012.06.09 17:21:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.09 17:21:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: facemoods (Enabled)
CHR - default_search_provider: search_url = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files\DNA\plugins\npbtdna.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - Extension: Google Drive = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Google Drive = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (SaveByclick Class) - {A2391DA7-5B48-C16D-6D16-61AF7C6F0FDD} - C:\ProgramData\SaveByclick\50cd9c8a109ee.ocx File not found
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {3BBD3C14-4C16-4989-8366-95BC9179779D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93EE8C1B-E6AA-477C-BCF4-83EB576532FA}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6C9CDA8-C6B7-477D-9E42-8375C52BB421}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEC4CDDA-2E91-4054-B793-810AF647FA13}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F28C8241-B159-4809-A324-152F55DBB8AE}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Users\MrM\AppData\Roaming\skype.dat) - C:\Users\MrM\AppData\Roaming\skype.dat (NkWFoATmq8o)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3e0b6b03-e62c-11e0-82db-0021859cbb21}\Shell - "" = AutoRun
O33 - MountPoints2\{3e0b6b03-e62c-11e0-82db-0021859cbb21}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3e0b6b0d-e62c-11e0-82db-001e101fb4df}\Shell - "" = AutoRun
O33 - MountPoints2\{3e0b6b0d-e62c-11e0-82db-001e101fb4df}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.03.20 21:18:44 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\Neuer Ordner (2)
[2013.03.20 21:18:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\MrM\Desktop\OTL.exe
[2013.03.20 18:45:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.03.20 18:45:31 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.03.20 18:45:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.03.10 16:29:08 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\REACh
[2013.03.10 11:41:09 | 000,000,000 | ---D | C] -- C:\Users\MrM\Documents\PDF Architect Files
[2013.03.10 11:41:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect
[2013.03.10 11:40:44 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Architect
[2012.01.10 20:53:38 | 000,081,920 | ---- | C] (NkWFoATmq8o) -- C:\Users\MrM\AppData\Roaming\skype.dat

========== Files - Modified Within 30 Days ==========

[2013.03.20 21:20:49 | 000,130,048 | ---- | M] () -- C:\Users\MrM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.03.20 21:17:18 | 000,377,856 | ---- | M] () -- C:\Users\MrM\Desktop\gmer_2.1.19155.exe
[2013.03.20 21:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MrM\Desktop\OTL.exe
[2013.03.20 18:45:32 | 000,000,878 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.03.20 18:40:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.20 05:58:26 | 000,000,004 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\skype.ini
[2013.03.20 05:58:25 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.20 05:58:25 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.20 05:58:03 | 000,410,144 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.03.17 11:49:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.03.17 11:45:58 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.17 11:40:53 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.03.17 11:40:53 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.03.17 11:40:53 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.03.17 11:40:53 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.03.12 19:45:22 | 000,001,356 | ---- | M] () -- C:\Users\MrM\AppData\Local\d3d9caps.dat
[2013.03.10 19:28:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.10 11:36:08 | 000,009,239 | ---- | M] () -- C:\Users\MrM\Desktop\Zahlungsbeleg -GOLDEN THAI- PayPal.pdf
[2013.02.24 14:09:33 | 000,101,995 | ---- | M] () -- C:\Users\MrM\Desktop\Mode Online Shop - Kleidung - Schuhe - Möbel kaufen BAUR Versand.pdf
[2013.02.24 12:41:26 | 000,175,419 | ---- | M] () -- C:\Users\MrM\Desktop\BoardingPassHOECHERLMARIO.pdf
[2013.02.23 10:54:13 | 005,109,966 | ---- | M] () -- C:\Users\MrM\Desktop\Neuer Ordner.zip
[2013.02.23 10:53:36 | 000,404,996 | ---- | M] () -- C:\Users\MrM\Desktop\kaufvertrag_allgemein[1].pdf

========== Files Created - No Company Name ==========

[2013.03.20 21:18:15 | 000,377,856 | ---- | C] () -- C:\Users\MrM\Desktop\gmer_2.1.19155.exe
[2013.03.20 18:45:32 | 000,000,878 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.03.10 18:09:38 | 000,000,004 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\skype.ini
[2013.03.10 11:36:05 | 000,009,239 | ---- | C] () -- C:\Users\MrM\Desktop\Zahlungsbeleg -GOLDEN THAI- PayPal.pdf
[2013.03.03 21:38:38 | 000,869,238 | ---- | C] () -- C:\Users\MrM\Desktop\anwohnerparkausweis.jpg
[2013.03.03 21:37:52 | 000,340,736 | ---- | C] () -- C:\Users\MrM\Desktop\fax barclay.pdf
[2013.02.24 14:09:35 | 000,101,995 | ---- | C] () -- C:\Users\MrM\Desktop\Mode Online Shop - Kleidung - Schuhe - Möbel kaufen BAUR Versand.pdf
[2013.02.24 12:41:26 | 000,175,419 | ---- | C] () -- C:\Users\MrM\Desktop\BoardingPassHOECHERLMARIO.pdf
[2013.02.23 10:54:08 | 005,109,966 | ---- | C] () -- C:\Users\MrM\Desktop\Neuer Ordner.zip
[2013.02.23 10:53:35 | 000,404,996 | ---- | C] () -- C:\Users\MrM\Desktop\kaufvertrag_allgemein[1].pdf
[2013.01.13 11:19:04 | 000,106,574 | ---- | C] () -- C:\Users\MrM\attachment.pdf
[2012.12.21 16:37:31 | 000,426,370 | ---- | C] () -- C:\Users\MrM\perso_vo.jpg
[2012.12.21 16:37:31 | 000,400,394 | ---- | C] () -- C:\Users\MrM\perso_ru.jpg
[2012.12.15 10:19:19 | 000,000,138 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.02.28 21:18:56 | 000,001,057 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\vso_ts_preview.xml
[2011.10.03 10:23:34 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2011.10.02 18:02:07 | 000,015,565 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2011.10.01 21:49:40 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll
[2011.10.01 21:49:40 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe
[2011.10.01 21:49:40 | 000,015,872 | ---- | C] () -- C:\Windows\System32\InsDrvZD64.DLL
[2011.10.01 21:49:40 | 000,013,312 | ---- | C] () -- C:\Windows\System32\VistaRundll.exe
[2011.08.28 19:17:36 | 000,004,447 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.06.20 18:31:14 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.04.22 10:33:10 | 000,163,840 | ---- | C] () -- C:\Windows\System32\12kUBusd.dll
[2011.04.22 10:28:26 | 000,000,000 | ---- | C] () -- C:\Windows\UI.INI
[2011.02.26 09:39:45 | 001,456,640 | ---- | C] () -- C:\Program Files\Common Files\Falk Navi-Manager.msi
[2010.08.15 19:06:46 | 000,000,205 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\mdbu.bin
[2010.04.10 11:59:05 | 000,001,356 | ---- | C] () -- C:\Users\MrM\AppData\Local\d3d9caps.dat
[2010.03.13 10:58:00 | 001,029,272 | ---- | C] () -- C:\Users\MrM\Ein Geld Kleid.pdf
[2010.02.18 19:24:14 | 000,310,593 | ---- | C] () -- C:\Users\MrM\Toyota Avensis Forum Old...pdf
[2010.02.04 00:10:38 | 002,003,705 | ---- | C] () -- C:\Users\MrM\Migraenekalender.pdf
[2010.02.03 23:57:03 | 001,932,534 | ---- | C] () -- C:\Users\MrM\netdoktor-kopfschmerzkalender.pdf
[2009.12.19 22:16:11 | 000,000,148 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\AVSMediaPlayer.m3u
[2009.12.13 20:51:58 | 000,001,383 | ---- | C] () -- C:\Users\MrM\remove_WGA.rtf
[2009.10.22 06:25:12 | 000,127,663 | ---- | C] () -- C:\Users\MrM\img177.jpg
[2009.10.22 06:25:12 | 000,125,090 | ---- | C] () -- C:\Users\MrM\img178.jpg
[2009.10.20 22:09:32 | 003,680,024 | ---- | C] () -- C:\Users\MrM\blechumformung.pdf
[2009.10.20 22:08:01 | 000,278,293 | ---- | C] () -- C:\Users\MrM\umform-grundlagen.pdf
[2009.10.20 22:07:53 | 002,263,047 | ---- | C] () -- C:\Users\MrM\umformen_allg.pdf
[2009.10.20 11:16:16 | 000,085,672 | ---- | C] () -- C:\Users\MrM\bar hemingway_stralsund_cocktails.pdf
[2009.07.01 18:17:40 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.03.22 21:29:58 | 000,201,071 | ---- | C] () -- C:\Users\MrM\impfen_impfbuch.pdf
[2009.03.22 21:29:58 | 000,087,623 | R--- | C] () -- C:\Users\MrM\liniennetz_tschech.pdf
[2009.03.22 21:29:58 | 000,032,980 | ---- | C] () -- C:\Users\MrM\service.gmx.pdf
[2008.12.31 02:28:08 | 000,130,048 | ---- | C] () -- C:\Users\MrM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2011.05.03 21:25:41 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\AllDup
[2012.12.16 11:03:36 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\APP_NAME_NON_STRING
[2013.03.12 19:39:13 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\BitTorrent
[2010.05.27 18:34:00 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Canneverbe Limited
[2013.01.27 15:47:44 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\DassaultSystemes
[2010.07.27 16:50:51 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\DeepBurner
[2010.06.09 23:00:32 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.02.25 23:11:22 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\FreeBurner
[2012.09.24 22:32:22 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\FreeFLVConverter
[2011.05.30 21:43:21 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\GetRightToGo
[2010.02.20 13:34:38 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\gtk-2.0
[2011.08.11 21:09:49 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Gutscheinmieze
[2010.06.08 20:37:58 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\ICQ
[2011.04.24 10:09:39 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\ImTOO
[2012.09.04 20:54:50 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Irateh
[2011.05.03 20:11:10 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\IrfanView
[2009.08.16 22:24:59 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Keynote Systems
[2009.01.22 21:11:19 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\MAGIX
[2010.05.29 09:28:00 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Nokia
[2010.05.29 09:28:01 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Nokia Ovi Suite
[2010.10.07 06:09:59 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Nonoh
[2011.02.11 10:36:31 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Opera
[2010.05.21 20:07:38 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\PC Suite
[2013.01.01 21:27:09 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\PDF Architect
[2010.07.05 20:15:44 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Samsung
[2008.12.31 10:50:48 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Serif
[2011.11.09 21:02:57 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Tipp4u
[2009.01.20 19:23:27 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Tunebite
[2012.11.23 10:16:45 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Vso
[2012.09.26 22:46:40 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Zyog

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 48 bytes -> C:\Windows:685F80B305F49876
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp

1B5B4F1

< End of report >

###################################################

OTL Extras logfile created on: 20.03.2013 21:21:38 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MrM\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 75,19% Memory free
6,25 Gb Paging File | 5,82 Gb Available in Paging File | 93,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,63 Gb Total Space | 27,38 Gb Free Space | 17,82% Space Free | Partition Type: NTFS
Drive D: | 303,34 Gb Total Space | 132,59 Gb Free Space | 43,71% Space Free | Partition Type: NTFS
Drive F: | 1,91 Gb Total Space | 0,28 Gb Free Space | 14,48% Space Free | Partition Type: FAT32

Computer Name: MRM-PC | User Name: MrM | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00AA23CD-F051-4141-88EF-479754D8456A}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{08D2ACCF-41D7-4947-9F55-E3B55A293152}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0B4E6BE7-EE04-4BFD-BEE3-0BDF7BC945D0}" = lport=138 | protocol=17 | dir=in | app=system |
"{1D262AEC-EF9E-4A22-8971-A071FFE0FA67}" = lport=0 | protocol=6 | dir=in | name=magix upnp media server |
"{2A4CC17C-EF05-4947-A213-094120E1280C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2FCAA4A3-38E8-4824-B81F-B9F0148881DD}" = rport=137 | protocol=17 | dir=out | app=system |
"{3D1F71D7-197B-413E-833F-B31EAC296ED1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{40F15F7D-9D81-440E-8692-5FEF3F8B77D5}" = lport=1900 | protocol=17 | dir=in | name=microsoft upnp-port (udp) |
"{41236364-40C4-437D-8125-D98148115F13}" = rport=5357 | protocol=6 | dir=out | app=system |
"{48B002D4-8606-425E-BE69-93B6465F3E44}" = lport=2869 | protocol=6 | dir=in | name=microsoft upnp-port (tcp) |
"{4A162561-712B-4A6F-9C25-00C9799E43FE}" = rport=138 | protocol=17 | dir=out | app=system |
"{4BE5FA99-7CA3-499B-BEC9-DB9666CA3F80}" = lport=64468 | protocol=6 | dir=in | name=emule_tcp |
"{4DC8B698-CE92-4F3A-ABE3-085676CC765B}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{4EAB9E13-9B53-46FC-B798-9709BD08A653}" = lport=8436 | protocol=17 | dir=in | name=emule_udp |
"{53F5F801-F5DD-4D23-9CAC-CC4D0A962F3E}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{5674332D-86D0-475B-868A-2285E91FB0E9}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{633017F3-7599-4BF8-BA2F-D23D2D8E4514}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{68E2F4E7-55D8-498E-AE1A-CD3ABE5B71BE}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{6DD94B37-5ABE-4890-8C0C-648E172CBDA1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{723C9D88-6930-46E1-AE35-288342392FA7}" = rport=10243 | protocol=6 | dir=out | app=system |
"{84683537-81D3-4A5E-A46D-EDCFE22936DE}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{8A70F05C-E866-46C3-9F63-59B3D2090B83}" = rport=445 | protocol=6 | dir=out | app=system |
"{8A8655C2-66E4-4B3D-88CF-CB6807B9A304}" = lport=5358 | protocol=6 | dir=in | app=system |
"{8E3DF45F-389F-4283-95FC-AE8CF450DE8D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{97D3E7C2-0256-4CA2-B786-E239F1AD19F5}" = lport=5357 | protocol=6 | dir=in | app=system |
"{9DD26C3F-26ED-40A6-8FE9-44A6F54D676D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9F6783E8-7152-4E0C-9B20-8C89E1CCD33B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A75749FA-A6AD-45B6-B5A5-B4673BA80D82}" = lport=139 | protocol=6 | dir=in | app=system |
"{B67ED3D0-95AE-49CA-BBB6-4A76E07AE1DD}" = lport=445 | protocol=6 | dir=in | app=system |
"{BF512BFA-E92D-4D08-BA0A-C67A7DF395A3}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{C069EBA5-8DE3-4361-8BCE-6EE4FBC4F74E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C6B4C51F-3A86-4172-B2F1-61042C3AE06E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{C867B77C-F957-4DB2-912D-F2FDB88923A5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CA9202C6-DF85-4775-AAE5-90086386A4A1}" = lport=137 | protocol=17 | dir=in | app=system |
"{E4B6DC16-CA6B-4069-9858-F6A39BD8027E}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{EE34D9B8-EE65-4F12-B589-ABA8B572C4AA}" = rport=5358 | protocol=6 | dir=out | app=system |
"{F802798D-23E6-4EB0-9BEF-60AAE8333BF3}" = rport=139 | protocol=6 | dir=out | app=system |
"{FBA3DDD7-E44C-48D4-B044-D319C5BC0B73}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05D12D1D-5686-43A9-8DA1-0AC25AECBE61}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{09EF6EBB-68BC-491A-A80F-3DB4AE6F83CB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0A09366A-28B7-4F33-A2F1-84B547E9FF2F}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"{167D7752-2098-45B6-BED9-50246155C69F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1738AD28-9E0E-419A-8EE9-ED6A26D1DC25}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{1A343E59-A702-4D43-9F66-89A0E24377B2}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"{1F7EFB14-B48B-4293-A04B-FA51C58C9198}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{21B8CE1D-AABD-45C7-819B-B105042FCCB6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2B3FDB01-AD07-4881-B881-0422CFD09DC3}" = protocol=17 | dir=in | app=c:\program files\falk\falk navi-manager\navimgr.exe |
"{31DD545B-0BFA-48DF-9526-8C0C4F9BFDB9}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{3298C9A4-1EDB-4EC4-BEE9-FF0467A0FABB}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{32C6778F-3E47-4C6B-A2E0-D00EA5D952B3}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{371BDD3E-D92D-4ADB-B2F9-BFEBA9ED3202}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{45AB650D-AD64-435B-95E8-5D975FBB7770}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{47D6D24D-F08F-46E8-8601-75EE1C30CE17}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{4912621F-E566-44A4-B3D8-D6D6D5F09E3D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{55CBA871-6FE4-4571-A8F9-87AD88C9D582}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{56D5AD60-4053-49E5-AFCE-CC75707E82A1}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{65C864EE-27AF-4B7B-9DE0-DA3DAC36EC8E}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{6D76042F-3283-4A57-8F35-E655EB88096C}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{70B08238-350A-4F90-ABCA-7AA11A858CB5}" = protocol=17 | dir=in | app=c:\program files\common files\magix shared\upnpservice\upnpservice.exe |
"{723B661A-F39D-4C4F-B4DD-4BCFF18AE223}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{788E6106-3283-41DB-99F6-4E239D6F0915}" = protocol=6 | dir=in | app=c:\program files\falk\falk navi-manager\navimgr.exe |
"{81D15A7F-230D-4514-AEBC-B3A31894454F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8661B9AB-D669-42BA-8977-7924E5A92E6C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{880D1329-2521-4BD9-8369-FDC1F247A3A2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{89298AE2-68D9-48CC-915B-4DBD60357F01}" = protocol=6 | dir=in | app=c:\program files\common files\magix shared\upnpservice\upnpservice.exe |
"{894A3A47-DD88-45FA-AE85-6F8020F8A59F}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{9A9F527B-71E7-4313-950B-3123F17581FC}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{9B15385E-4F1E-4BE6-985D-ABECA9418D0C}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{A48A042F-E70A-4508-976F-62081B078B26}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A8516ECB-45EA-4389-B957-0117FE34F267}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{AB261A8B-70D7-429F-B1DE-F7504EEF23F3}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{ACF49F41-EC68-4CE3-94B9-DAFFF1D20A37}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{B10A1B1D-5FDC-42F3-8D53-5211476BF471}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BA0238D8-DFA5-4E8E-A4E8-2DEEC95F50FD}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{CD7CF05F-7585-4710-AEDA-220E1020CB83}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{CE6D418E-FC7C-4310-BBE2-8BF34A06E4E0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D196BDFE-1947-447D-B36B-71A066F959CC}" = protocol=6 | dir=out | app=system |
"{D2323E14-E98A-4B4F-833D-9CDF93B97012}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{D6D19616-705B-45FF-9100-F9F807F992DE}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{D8597F1A-6639-4D49-AFA8-F88E416E01F2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D974EB70-8175-4963-ABD6-A34AAB538E61}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DAB03A4E-537D-45E7-B0BC-CE1D7ED1B71D}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DB498550-DEF7-49F9-B0BE-A5C7FA06184F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DDC49EE1-455D-444A-8639-4038231EE0DF}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DE97A092-ED67-4E4E-8003-8219375DA83A}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E17D36D2-3F3A-4705-A2E8-931418C913F5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E5C15580-EF9A-4E63-852E-5B656E8A379B}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{ED8D25F8-11DC-48CB-B550-24BCBEE75D24}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F49F88A1-E03E-4B31-8A48-2289DFB3E21F}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"TCP Query User{0D20DABF-2BF1-4898-8109-3C6D570EED24}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{1F61DDB0-8D56-4158-8F3F-C14A96923662}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{3013051D-49AF-4E3D-BD96-DAA5C7834E19}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{33D2AE8D-7FC4-4DCF-AF2B-33B3D2076D12}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{356CDD0F-6351-4C4B-85EB-07CF4A9443A0}C:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=6 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe |
"TCP Query User{50FF6FE0-6C15-4B84-9280-57AF75233647}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe |
"TCP Query User{52EF4B54-08A9-4984-9C14-0B9420CFF4EB}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{864CE8B5-F7ED-43B7-B876-E5ED3FC915F0}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{87558C9A-8D37-4026-97A2-64C22358BE5C}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{8B0221BA-09D3-45BE-9B3E-1619F3360CDE}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{8FE8857D-3E96-4AEB-AE31-F878CA737904}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{9EA93366-50FC-45AE-B7CD-67A22DBFB13E}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe |
"TCP Query User{A93D2F7E-6475-4770-B7C8-180D678BDD4F}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{B76E54A6-7860-4E50-B692-96E7F6B66CDA}C:\program files\nonoh.net\nonoh\nonoh.exe" = protocol=6 | dir=in | app=c:\program files\nonoh.net\nonoh\nonoh.exe |
"TCP Query User{CDF390AA-74C6-4A4B-B06B-984002F97B5F}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{DB305EAD-3CD9-4C7A-A900-16944526E827}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{FB6515C6-E301-42EF-9C62-73CA5D92814F}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{01607A26-3EFF-438E-B383-C52D92FB7F8D}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{157DEC35-BDD3-4A03-A8E5-3300091E8DF9}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe |
"UDP Query User{236C268D-7AD5-4E4A-A62B-B667FE0EF7E7}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{295C6B3F-3CD7-473A-BA32-6B8F6DA92BC6}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{382980D6-8723-4312-918D-B2921A96B77F}C:\program files\nonoh.net\nonoh\nonoh.exe" = protocol=17 | dir=in | app=c:\program files\nonoh.net\nonoh\nonoh.exe |
"UDP Query User{39613404-50B6-439E-A24E-505FC9E68847}C:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=17 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe |
"UDP Query User{3ACD1A58-D9A0-4167-98B0-8A69CB189F7B}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{563CCBD7-E9F5-4FDA-9066-AF114D553EAA}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{7A72402B-D0DC-417F-BDE2-6D5CC581F8B7}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{8193D926-0CDB-4FC6-8427-FDBCB9573FB5}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{B0B7C431-9543-43BB-B0BA-6C3C1F3DF527}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{B3C94664-0F47-48DD-A82D-BF1CEDDAE3E5}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{BA69D5CD-1911-480A-8C00-8F1CD9338511}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe |
"UDP Query User{C6875411-C3FA-42FE-A617-0C169943A469}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{C7AD37A2-F837-49E4-8065-ACA8B806F4C1}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{CCFFCB95-186D-42FA-9D41-48977D963171}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{E33AD572-AB20-4481-A526-46C0E33A1970}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{080FE95E-5A89-4A54-BAAA-D769971B7C2D}" = Corel Home Office 5.0.36
"{0F89E06A-16E1-432E-8A3A-23CFFB4818D5}" = Russisch für Deutsche - Transliteration
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{2BC21CD2-8053-406A-80F6-9AB61717B49D}" = ODF Add-In für Microsoft Office
"{3222B0CE-59C5-4CA0-B545-2B88F200756B}" = Falk Navi-Manager
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D9DD45B-E79A-4F04-898E-B2C3769AB729}" = Serif DrawPlus X2
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{56364334-9530-11D2-BFFC-00C04FA329AA}" = Microsoft Works 2000
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DE6837F-F3A3-40FF-9F5C-A0B95948E32D}" = Dassault Systemes Software Prerequisites x86
"{7613592F-B20C-4E1B-B2DD-67F0784D4373}" = Energy Settings
"{80A07844-CA64-4DE4-AB61-D37DDBE8074F}" = PDF Architect
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.2.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A4D182C-35C7-4791-8484-4304EBC9101A}" = Windows 7 Upgrade Advisor
"{A157AC1C-DF44-481A-81E7-17AE00239818}" = Logitech Z-series Software 1.04
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM
"{D5A716E5-6E7E-40F8-BB46-6FAEF98FB6FC}" = SystemDiagnostics
"{DEA26700-69D8-4EE1-AD8A-609BD28965E6}" = Falk Navi-Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"DivX Setup" = DivX-Setup
"DVD Shrink_is1" = DVD Shrink 3.2
"EVEREST Corporate Edition NR_is1" = EVEREST Corporate Edition NR v4.60
"Google Chrome" = Google Chrome
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)
"MUSTEK 1200 UB v2.1" = MUSTEK 1200 UB v2.1
"Nonoh_is1" = Nonoh
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Opera 12.12.1707" = Opera 12.12
"Samsung ML-1640 Series" = Samsung ML-1640 Series
"Samsung ML-2010 Series" = Samsung ML-2010 Series
"Trillian" = Trillian
"Unlocker" = Unlocker 1.9.1
"VLC media player" = VLC media player 2.0.1
"Winamp" = Winamp
"WinRAR archiver" = WinRAR

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Anwendungserkennung

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12.03.2013 12:45:27 | Computer Name = MrM-PC | Source = Software Licensing Service | ID = 1001
Description = Fehler beim Starten des Softwarelizenzierungsdienstes. hr=0x80070002,
[2, 4]

Error - 12.03.2013 12:48:41 | Computer Name = MrM-PC | Source = WinMgmt | ID = 10
Description =

Error - 12.03.2013 14:22:36 | Computer Name = MrM-PC | Source = Wininit | ID = 1015
Description = Ein kritischer Systemprozess C:\Windows\system32\lsass.exe ist fehlgeschlagen
mit den Statuscode 1. Der Computer muss neu gestartet werden.

Error - 12.03.2013 14:25:41 | Computer Name = MrM-PC | Source = EventSystem | ID = 4609
Description =

Error - 12.03.2013 14:26:10 | Computer Name = MrM-PC | Source = WinMgmt | ID = 10
Description =

Error - 13.03.2013 13:16:17 | Computer Name = MrM-PC | Source = WinMgmt | ID = 10
Description =

Error - 17.03.2013 06:38:10 | Computer Name = MrM-PC | Source = WinMgmt | ID = 10
Description =

Error - 17.03.2013 06:46:27 | Computer Name = MrM-PC | Source = WinMgmt | ID = 10
Description =

Error - 17.03.2013 06:48:40 | Computer Name = MRM-PC | Source = Software Licensing Service | ID = 1001
Description = Fehler beim Starten des Softwarelizenzierungsdienstes. hr=0x80070002,
[2, 4]

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17.03.2013 06:51:50 | Computer Name = MrM-PC | Source = Service Control Manager | ID = 7026
Description =

< End of report >

###############################################

ENDE.

aharonov · 21.03.2013, 03:16

Hallo MrMaho und

Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten.

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schliessen von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich.
Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.
Arbeite daher in deinem eigenen Interesse solange mit, bis du das OK bekommst, dass alles erledigt ist.

Hinweise zum Ablauf

Du bekommst von mir jeweils eine individuell auf dich abgestimmte schrittweise Anleitung.
- Lese diese Anweisungen immer zuerst vollständig durch und frag bei Unklarheiten nach, bevor du beginnst.
- Arbeite die Anleitungen dann sorgfältig und in der angegebenen Reihenfolge ab und poste deine Rückmeldungen und Logfiles gesammelt in einer Antwort.
- Füge den Inhalt der Logfiles wenn immer möglich innerhalb von Code-Tags in deine Antwort ein.
- Sollten Probleme auftauchen, dann brich an dieser Stelle ab und schildere sie so gut wie möglich.

Es ist wichtig für mich, dass sich der Zustand deines Systems nicht plötzlich unvorhersehbar ändert. Deshalb: Bitte
- .. lasse keine Scanner oder Tools ohne Aufforderung laufen. Lösche nichts auf eigene Faust.
- .. installiere oder deinstalliere während der Bereinigung keine Software.
- .. frag nicht parallel in anderen Foren nach Hilfe (Crossposting).

Ich kann dir keine Garantien geben, dass die Bereinigung schlussendlich erfolgreich sein wird und wir alles finden werden.
- Ein Formatieren und Neuinstallieren ist meist der schnellere und immer der sicherere Weg.
- Sollte ich eine schwerwiegende Infektion bei dir finden, werde ich dich nochmals darauf hinweisen. Es bleibt aber deine Entscheidung.

Los geht's: Alle Tools immer auf den Desktop speichern und von dort starten.

Zitat:

Auch Foren, wie gutefrage.net, chip.de, computerbase.de/forum, usw. konnten bisher nicht helfen.

Kann ich fast nicht glauben, eine grosse Überraschung..

Zitat:

Hier das txt-logfile von malware, ich habe nur Suchlauf gemacht und noch nichts gelöscht:

Mach diesen Scan noch einmal, aber lösche zum Schluss alle Funde. Danach solltest du nämlich wieder in den normalen Modus starten können:

Schritt 1

Öffne das Programm Malwarebytes Anti-Malware.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke auf Aktualisierung --> Suche nach Aktualisierung.
Wenn das Update beendet wurde, aktiviere im Reiter Suchlauf die Option Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan fertig ist, klicke auf Ergebnisse anzeigen.
Versichere dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter dem Reiter Logdateien finden.

Ab hier wieder im normalen Modus:

Schritt 2

Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.

Schliesse alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Schritt 3

Warnung für Mitleser:
Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix.

WICHTIG: Speichere Combofix auf deinen Desktop.
Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
Während Combofix läuft, bitte gar nichts am Computer arbeiten, auch nicht die Maus bewegen!
Wenn Combofix fertig ist, wird es ein Logfile erstellen (C:\Combofix.txt).
Bitte poste den Inhalt dieses Logfiles in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 4

Starte bitte die OTL.exe.

Setze den Haken bei Scan all Users.
Drücke auf den Quick Scan Button.
Poste den Inhalt von OTL.txt hier in den Thread.

Bitte poste in deiner nächsten Antwort:

Log von MBAM
Log von AdwCleaner
Log von Combofix
Log von OTL

MrMaho · 23.03.2013, 15:43

Hier der txt-file vo Malwarebytes:

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2012.12.14.11

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
MrM :: MRM-PC [Administrator]

21.03.2013 17:33:38
mbam-log-2013-03-21 (17-33-38).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 233853
Laufzeit: 4 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell (Trojan.Agent.RNS) -> Daten: explorer.exe,C:\Users\MrM\AppData\Roaming\skype.dat -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\MrM\AppData\Roaming\skype.dat (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

##################################################

Juhuuu: PC startet wieder .....

.... (fast) "normal", nur sieht immer noch alles (Taskleiste, Arbeitsplatz usw.) irgendwie "komisch" aus. Also nicht meine Einstellungen - meine ich.

PS: Internet geht noch immer nicht .... und das Windows Sicherheits-Center funktioniert auch (noch) nicht :-(

###################################################

hier das logfile von adwcleaner:
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.115 - Datei am 23/03/2013 um 14:56:50 erstellt
# Aktualisiert am 17/03/2013 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 2 (32 bits)
# Benutzer : MrM - MRM-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\MrM\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml
Datei Gelöscht : C:\user.js
Datei Gelöscht : C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\searchplugins\Search_Results.xml
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files\Mozilla Firefox\Extensions\quickstores@quickstores.de
Ordner Gelöscht : C:\Program Files\SweetIM
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\SaveByclick
Ordner Gelöscht : C:\Users\Administrator\AppData\Roaming\QuickStoresToolbar
Ordner Gelöscht : C:\Users\MrM\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\MrM\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\MrM\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\MrM\AppData\LocalLow\SaveByclick
Ordner Gelöscht : C:\Users\MrM\AppData\LocalLow\searchquband
Ordner Gelöscht : C:\Users\MrM\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\Conduit
Ordner Gelöscht : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A2391DA7-5B48-C16D-6D16-61AF7C6F0FDD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A2391DA7-5B48-C16D-6D16-61AF7C6F0FDD}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A2391DA7-5B48-C16D-6D16-61AF7C6F0FDD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3201318
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2391DA7-5B48-C16D-6D16-61AF7C6F0FDD}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v19.0.2 (de)

Datei : C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\prefs.js

C:\Users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\user.js ... Gelöscht !

Gelöscht : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2269050.CTID", "CT2269050");
Gelöscht : user_pref("CT2269050.CurrentServerDate", "12-6-2010");
Gelöscht : user_pref("CT2269050.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2269050.EMailNotifierPollDate", "Sat Jun 12 2010 08:06:16 GMT+0200");
Gelöscht : user_pref("CT2269050.FirstServerDate", "10-6-2010");
Gelöscht : user_pref("CT2269050.FirstTime", true);
Gelöscht : user_pref("CT2269050.FirstTimeFF3", true);
Gelöscht : user_pref("CT2269050.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT2269050.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2269050.Initialize", true);
Gelöscht : user_pref("CT2269050.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2269050.InstalledDate", "Thu Jun 10 2010 07:24:56 GMT+0200");
Gelöscht : user_pref("CT2269050.InvalidateCache", false);
Gelöscht : user_pref("CT2269050.IsGrouping", false);
Gelöscht : user_pref("CT2269050.IsMulticommunity", false);
Gelöscht : user_pref("CT2269050.IsOpenThankYouPage", false);
Gelöscht : user_pref("CT2269050.IsOpenUninstallPage", false);
Gelöscht : user_pref("CT2269050.LanguagePackLastCheckTime", "Sat Jun 12 2010 08:07:17 GMT+0200");
Gelöscht : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2269050.LastLogin_2.5.8.6", "Sat Jun 12 2010 19:33:39 GMT+0200");
Gelöscht : user_pref("CT2269050.LatestVersion", "2.1.0.18");
Gelöscht : user_pref("CT2269050.Locale", "en");
Gelöscht : user_pref("CT2269050.LoginCache", 4);
Gelöscht : user_pref("CT2269050.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2269050.MCDetectTooltipShow", false);
Gelöscht : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2269050.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2269050.RadioIsPodcast", false);
Gelöscht : user_pref("CT2269050.RadioLastCheckTime", "Sat Jun 12 2010 08:06:16 GMT+0200");
Gelöscht : user_pref("CT2269050.RadioLastUpdateIPServer", "3");
Gelöscht : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");
Gelöscht : user_pref("CT2269050.RadioMediaID", "12473383");
Gelöscht : user_pref("CT2269050.RadioMediaType", "Media Player");
Gelöscht : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");
Gelöscht : user_pref("CT2269050.RadioStationName", "Hotmix%20108");
Gelöscht : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");
Gelöscht : user_pref("CT2269050.SHRINK_TOOLBAR", 1);
Gelöscht : user_pref("CT2269050.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2269050.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Sat Jun 12 2010 08:06:25 GMT+0200");
Gelöscht : user_pref("CT2269050.SettingsCheckIntervalMin", 120);
Gelöscht : user_pref("CT2269050.SettingsLastCheckTime", "Sat Jun 12 2010 19:33:35 GMT+0200");
Gelöscht : user_pref("CT2269050.SettingsLastUpdate", "1276099824");
Gelöscht : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Thu Jun 10 2010 07:24:53 GMT+0200");
Gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1276099824");
Gelöscht : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gelöscht : user_pref("CT2269050.UserID", "UN93097887433583023");
Gelöscht : user_pref("CT2269050.ValidationData_Toolbar", 2);
Gelöscht : user_pref("CT2269050.WeatherNetwork", "");
Gelöscht : user_pref("CT2269050.WeatherPollDate", "Sat Jun 12 2010 19:33:41 GMT+0200");
Gelöscht : user_pref("CT2269050.WeatherUnit", "C");
Gelöscht : user_pref("CT2269050.alertChannelId", "666138");
Gelöscht : user_pref("CT2269050.clientLogIsEnabled", true);
Gelöscht : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gelöscht : user_pref("CT2269050.components.1000034", false);
Gelöscht : user_pref("CT2269050.myStuffEnabled", true);
Gelöscht : user_pref("CT2269050.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gelöscht : user_pref("CT2769726..clientLogIsEnabled", true);
Gelöscht : user_pref("CT2769726..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gelöscht : user_pref("CT2769726..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gelöscht : user_pref("CT2769726.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2769726.CTID", "CT2769726");
Gelöscht : user_pref("CT2769726.CurrentServerDate", "25-3-2011");
Gelöscht : user_pref("CT2769726.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2769726.DialogsGetterLastCheckTime", "Thu Mar 24 2011 22:13:18 GMT+0100");
Gelöscht : user_pref("CT2769726.DownloadReferralCookieData", "");
Gelöscht : user_pref("CT2769726.ExternalComponentPollDate129372280275656718", "Thu Mar 24 2011 22:13:17 GMT+010[...]
Gelöscht : user_pref("CT2769726.FirstServerDate", "24-12-2010");
Gelöscht : user_pref("CT2769726.FirstTime", true);
Gelöscht : user_pref("CT2769726.FirstTimeFF3", true);
Gelöscht : user_pref("CT2769726.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT2769726.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2769726.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2769726.HasUserGlobalKeys", true);
Gelöscht : user_pref("CT2769726.Initialize", true);
Gelöscht : user_pref("CT2769726.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2769726.InstallationAndCookieDataSentCount", 3);
Gelöscht : user_pref("CT2769726.InstalledDate", "Fri Dec 24 2010 09:23:28 GMT+0100");
Gelöscht : user_pref("CT2769726.InvalidateCache", false);
Gelöscht : user_pref("CT2769726.IsGrouping", false);
Gelöscht : user_pref("CT2769726.IsMulticommunity", false);
Gelöscht : user_pref("CT2769726.IsOpenThankYouPage", true);
Gelöscht : user_pref("CT2769726.IsOpenUninstallPage", true);
Gelöscht : user_pref("CT2769726.LanguagePackLastCheckTime", "Thu Mar 24 2011 22:13:19 GMT+0100");
Gelöscht : user_pref("CT2769726.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2769726.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2769726.LastLogin_3.2.5.2", "Fri Dec 24 2010 09:23:26 GMT+0100");
Gelöscht : user_pref("CT2769726.LastLogin_3.3.3.2", "Thu Mar 24 2011 22:13:18 GMT+0100");
Gelöscht : user_pref("CT2769726.LatestVersion", "3.3.3.2");
Gelöscht : user_pref("CT2769726.Locale", "en");
Gelöscht : user_pref("CT2769726.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2769726.MCDetectTooltipShow", false);
Gelöscht : user_pref("CT2769726.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2769726.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2769726.RadioIsPodcast", false);
Gelöscht : user_pref("CT2769726.RadioLastCheckTime", "Fri Dec 24 2010 09:23:32 GMT+0100");
Gelöscht : user_pref("CT2769726.RadioLastUpdateIPServer", "3");
Gelöscht : user_pref("CT2769726.RadioLastUpdateServer", "129362291739470000");
Gelöscht : user_pref("CT2769726.RadioMediaID", "21624141");
Gelöscht : user_pref("CT2769726.RadioMediaType", "Media Player");
Gelöscht : user_pref("CT2769726.RadioMenuSelectedID", "EBRadioMenu_CT276972621624141");
Gelöscht : user_pref("CT2769726.RadioStationName", "BBC%20World%20Today");
Gelöscht : user_pref("CT2769726.RadioStationURL", "hxxp://hxxp-ws.bbc.co.uk.edgesuite.net/asx.esi?worldservice/[...]
Gelöscht : user_pref("CT2769726.SHRINK_TOOLBAR", 1);
Gelöscht : user_pref("CT2769726.SavedHomepage", "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.[...]
Gelöscht : user_pref("CT2769726.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2769726.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2769726.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2769726.SearchInNewTabLastCheckTime", "Thu Mar 24 2011 22:13:18 GMT+0100");
Gelöscht : user_pref("CT2769726.ServiceMapLastCheckTime", "Thu Mar 24 2011 22:13:18 GMT+0100");
Gelöscht : user_pref("CT2769726.SettingsLastCheckTime", "Thu Mar 24 2011 22:13:17 GMT+0100");
Gelöscht : user_pref("CT2769726.SettingsLastUpdate", "1298387099");
Gelöscht : user_pref("CT2769726.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2769726.ThirdPartyComponentsLastCheck", "Thu Mar 24 2011 22:13:17 GMT+0100");
Gelöscht : user_pref("CT2769726.ThirdPartyComponentsLastUpdate", "1246790578");
Gelöscht : user_pref("CT2769726.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2769726");
Gelöscht : user_pref("CT2769726.Uninstall", true);
Gelöscht : user_pref("CT2769726.UserID", "UN56250396230041623");
Gelöscht : user_pref("CT2769726.ValidationData_Toolbar", 0);
Gelöscht : user_pref("CT2769726.WeatherNetwork", "");
Gelöscht : user_pref("CT2769726.WeatherPollDate", "Fri Dec 24 2010 09:23:29 GMT+0100");
Gelöscht : user_pref("CT2769726.WeatherUnit", "C");
Gelöscht : user_pref("CT2769726.alertChannelId", "1161838");
Gelöscht : user_pref("CT2769726.backendstorage.amazonnew_all", "3134323630312C3134323731312C3134323639312C31303[...]
Gelöscht : user_pref("CT2769726.components.1000082", false);
Gelöscht : user_pref("CT2769726.components.1000234", false);
Gelöscht : user_pref("CT2769726.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.[...]
Gelöscht : user_pref("CT2769726.globalFirstTimeInfoLastCheckTime", "Thu Mar 24 2011 22:13:19 GMT+0100");
Gelöscht : user_pref("CT2769726.isAppTrackingManagerOn", true);
Gelöscht : user_pref("CT2769726.myStuffEnabled", true);
Gelöscht : user_pref("CT2769726.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2769726.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2769726.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2769726.oldAppsList", "129282571754500061,129282571754968814,129372280275656718,1000082[...]
Gelöscht : user_pref("CT2769726.testingCtid", "");
Gelöscht : user_pref("CT2769726.toolbarAppMetaDataLastCheckTime", "Thu Mar 24 2011 22:13:18 GMT+0100");
Gelöscht : user_pref("CT2769726.toolbarContextMenuLastCheckTime", "Fri Dec 24 2010 09:23:28 GMT+0100");
Gelöscht : user_pref("CT2769726.usagesFlag", 1);
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1161838/1157525/DE", "\"0\"[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/666138/661999/DE", "\"0\"")[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2769726", [...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2769726",[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63428543113243[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/21/2[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634[...]
Gelöscht : user_pref("CommunityToolbar.EngineHiddenByUser", true);
Gelöscht : user_pref("CommunityToolbar.EngineOwner", "");
Gelöscht : user_pref("CommunityToolbar.EngineOwnerGuid", "");
Gelöscht : user_pref("CommunityToolbar.EngineOwnerToolbarId", "");
Gelöscht : user_pref("CommunityToolbar.IsEngineShown", false);
Gelöscht : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Gelöscht : user_pref("CommunityToolbar.OriginalEngineOwner", "");
Gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "");
Gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,CT2769726");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050,CT2769726");
Gelöscht : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Thu Mar 24 2011 22:08:18 GMT+01[...]
Gelöscht : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Gelöscht : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Fri Mar 25 2011 11:04:17 GMT+0100");
Gelöscht : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gelöscht : user_pref("CommunityToolbar.alert.locale", "en");
Gelöscht : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Gelöscht : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu Mar 24 2011 22:08:14 GMT+0100");
Gelöscht : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1291048634");
Gelöscht : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Gelöscht : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gelöscht : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Gelöscht : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Gelöscht : user_pref("CommunityToolbar.alert.userId", "{81ae2ba2-6bf7-4f1b-8142-161603897eeb}");
Gelöscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Jun 12 2010 09:15:54 GMT+0200");
Gelöscht : user_pref("CommunityToolbar.globalUserId", "4cb75aed-7092-407c-8a28-89ec5dc58f20");
Gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2769726");
Gelöscht : user_pref("browser.search.order.1", "Search Results");
Gelöscht : user_pref("extensions.50cd9c8a10927.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[...]
Gelöscht : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111434&tt=010712_5");
Gelöscht : user_pref("extensions.BabylonToolbar_i.hardId", "884be055000000000000000cf6a7ca85");
Gelöscht : user_pref("extensions.BabylonToolbar_i.id", "884be055000000000000000cf6a7ca85");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlDay", "15527");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.tlbrId", "tb9");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1718:37:52");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Gelöscht : user_pref("extensions.facemoods.aflt", "_#ddrnw");
Gelöscht : user_pref("extensions.facemoods.firstRun", false);
Gelöscht : user_pref("extensions.facemoods.lastActv", "19");
Gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Gelöscht : user_pref("icqtoolbar.displayHistory", false);
Gelöscht : user_pref("icqtoolbar.engineVerified", false);
Gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Gelöscht : user_pref("icqtoolbar.history", "M%C3%9CNCHENER%20VEREIN||M%C3%9CNCHENER%20VEREIN%20neuburg||12%20me[...]
Gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.0.15");
Gelöscht : user_pref("icqtoolbar.searchOnDrop", false);
Gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Gelöscht : user_pref("icqtoolbar.suggestions", false);
Gelöscht : user_pref("icqtoolbar.uniqueID", "124993432312499349231250093330843");
Gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1258351761);
Gelöscht : user_pref("icqtoolbar.version", "1.1.4");
Gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
Gelöscht : user_pref("quickstores.toolbar.affid", "2017");
Gelöscht : user_pref("quickstores.toolbar.guid", "{463E3ABC-F37D-CC95-3E18-91EDE7DE3D8B}");

-\\ Google Chrome v25.0.1364.152

Datei : C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.22] : icon_url = "hxxp://facemoods.com/favicon.ico",
Gelöscht [l.25] : keyword = "facemoods.com",
Gelöscht [l.28] : search_url = "hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4",

-\\ Opera v12.12.1707.0

Datei : C:\Users\MrM\AppData\Roaming\Opera\Opera\operaprefs.ini

Gelöscht : Home URL=hxxp://www.searchnu.com/413

Datei : C:\Users\Administrator\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [24005 octets] - [23/03/2013 14:56:50]

########## EOF - C:\AdwCleaner[S1].txt - [24066 octets] ##########

--- --- ---

########################################################

hier logfile von Combofix :

Combofix Logfile:

Code:

ATTFilter

ComboFix 13-03-21.02 - MrM 23.03.2013  15:04:09.1.4 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3071.2442 [GMT 1:00]
ausgeführt von:: c:\users\MrM\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
 ADS - Windows: deleted 48 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\.tunebite
c:\users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\.tunebite
c:\users\MrM\AppData\Roaming\skype.ini
c:\users\MrM\AppData\Roaming\vso_ts_preview.xml
c:\users\UpdatusUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\.tunebite
c:\windows\system32\Temp
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-02-23 bis 2013-03-23  ))))))))))))))))))))))))))))))
.
.
2013-03-23 14:13 . 2013-03-23 14:16	--------	d-----w-	c:\users\MrM\AppData\Local\temp
2013-03-23 14:13 . 2013-03-23 14:13	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-03-23 14:13 . 2013-03-23 14:13	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-03-20 17:45 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-03-20 17:45 . 2013-03-20 17:45	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-03-12 17:09 . 2013-03-12 17:09	60872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{10B3DA94-0AD6-4067-AD38-D76DE7046189}\offreg.dll
2013-03-10 10:40 . 2013-03-10 10:41	--------	d-----w-	c:\program files\PDF Architect
2013-03-08 15:40 . 2013-02-08 00:45	6954968	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{10B3DA94-0AD6-4067-AD38-D76DE7046189}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-02 09:00 . 2012-04-01 18:25	691568	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-03-02 09:00 . 2011-05-17 08:31	71024	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 00:28 . 2009-10-04 20:55	232336	------w-	c:\windows\system32\MpSigStub.exe
2013-01-09 13:52 . 1998-07-28 17:01	1070152	----a-w-	c:\windows\system32\MSCOMCTL.OCX
2013-01-08 22:11 . 2013-02-13 18:55	1800704	----a-w-	c:\windows\system32\jscript9.dll
2013-01-08 22:03 . 2013-02-13 18:55	1129472	----a-w-	c:\windows\system32\wininet.dll
2013-01-08 22:03 . 2013-02-13 18:55	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2013-01-08 21:59 . 2013-02-13 18:55	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2013-01-08 21:58 . 2013-02-13 18:55	420864	----a-w-	c:\windows\system32\vbscript.dll
2013-01-08 21:56 . 2013-02-13 18:55	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2013-01-05 05:26 . 2013-02-13 18:49	3550072	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-01-05 05:26 . 2013-02-13 18:49	3602808	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-01-04 11:28 . 2013-02-13 18:49	905576	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-01-04 01:38 . 2013-02-13 18:50	2048512	----a-w-	c:\windows\system32\win32k.sys
2012-12-29 10:26 . 2013-01-06 10:22	12641120	----a-w-	c:\windows\system32\nvwgf2um.dll
2012-12-29 10:26 . 2013-01-06 10:22	8904632	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2012-12-29 10:26 . 2013-01-06 10:22	7931896	----a-w-	c:\windows\system32\nvcuda.dll
2012-12-29 10:26 . 2013-01-06 10:22	6263784	----a-w-	c:\windows\system32\nvopencl.dll
2012-12-29 10:26 . 2013-01-06 10:22	2720696	----a-w-	c:\windows\system32\nvcuvid.dll
2012-12-29 10:26 . 2013-01-06 10:22	20450232	----a-w-	c:\windows\system32\nvoglv32.dll
2012-12-29 10:26 . 2013-01-06 10:22	1985976	----a-w-	c:\windows\system32\nvcuvenc.dll
2012-12-29 10:26 . 2013-01-06 10:22	17560504	----a-w-	c:\windows\system32\nvcompiler.dll
2012-12-29 10:26 . 2012-10-10 20:14	889784	----a-w-	c:\windows\system32\nvdispgenco32.dll
2012-12-29 10:26 . 2012-10-10 20:14	1017272	----a-w-	c:\windows\system32\nvdispco32.dll
2012-12-29 10:26 . 2008-10-28 10:09	2504248	----a-w-	c:\windows\system32\nvapi.dll
2012-12-29 10:26 . 2008-10-28 10:09	15129064	----a-w-	c:\windows\system32\nvd3dum.dll
2012-12-29 08:26 . 2010-07-09 15:37	4129720	----a-w-	c:\windows\system32\nvcpl.dll
2012-12-29 08:26 . 2010-07-09 15:37	3001272	----a-w-	c:\windows\system32\nvsvc.dll
2012-12-29 08:25 . 2010-07-09 15:37	639928	----a-w-	c:\windows\system32\nvvsvc.exe
2012-12-29 08:25 . 2010-07-09 15:37	108984	----a-w-	c:\windows\system32\nvmctray.dll
2012-12-29 08:25 . 2010-01-11 21:18	62904	----a-w-	c:\windows\system32\nvshext.dll
2012-12-29 08:25 . 2009-03-27 22:03	2557880	----a-w-	c:\windows\system32\nvsvcr.dll
2012-12-29 01:54 . 2012-12-29 01:54	550328	----a-w-	c:\windows\system32\nvStreaming.exe
2011-12-09 08:51 . 2011-02-26 08:39	1456640	----a-w-	c:\program files\Common Files\Falk Navi-Manager.msi
2013-03-09 08:23 . 2011-03-24 21:07	263064	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux8"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51	919008	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-10-11 20:56	59280	----a-w-	c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2012-08-09 14:53	348664	----a-w-	c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08	1259376	----a-w-	c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25	125952	----a-w-	c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EnergySettings]
2008-09-19 09:44	113664	----a-w-	c:\program files\Fujitsu Siemens Computers\Energy Settings\EnergySettings.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]
2008-05-28 11:40	20480	----a-w-	c:\program files\Google\Google EULA\GoogleEULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LCDMon]
2007-04-26 15:54	774168	----a-w-	c:\program files\Common Files\Logitech\LCD Manager\LCDMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2012-12-12 09:28	163000	----a-w-	c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-10-25 02:12	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 19:24	32768	----a-w-	c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-08-27 15:55	6281760	----a-w-	c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2008-04-14 05:19	536576	----a-w-	c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 07:04	252848	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51	17408	----a-w-	c:\program files\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23	1008184	----a-w-	c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
2007-05-31 08:21	648072	----a-w-	c:\windows\WindowsMobile\wmdcBase.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25	202240	----a-w-	c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-03-06 21:28	1630672	----a-w-	c:\program files\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-23 09:11]
.
2013-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-23 09:11]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\MrM\AppData\Roaming\Mozilla\Firefox\Profiles\6sbpq4ea.default\
FF - prefs.js: browser.search.selectedEngine - 
FF - ExtSQL: 2013-03-10 11:41; FFPDFArchitectConverter@pdfarchitect.com; c:\program files\PDF Architect\FFPDFArchitectExt
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)
WebBrowser-{3BBD3C14-4C16-4989-8366-95BC9179779D} - (no file)
HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
HKU-Default-Run-fsc-reg - c:\fsc-reg\fscreg.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-03-23 15:16
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\BFE]
"ImagePath"="."
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MpsSvc]
"ImagePath"="."
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\conime.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-03-23  15:21:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-03-23 14:21
.
Vor Suchlauf: 17 Verzeichnis(se), 29.196.087.296 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 29.595.885.568 Bytes frei
.
- - End Of File - - 5BF3106B1FDB91C0083EA7079C68AC81

--- --- ---

########################################################

und zum schluss noch OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.03.2013 15:27:16 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\MrM\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,31 Gb Available Physical Memory | 77,15% Memory free
6,19 Gb Paging File | 5,76 Gb Available in Paging File | 93,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,63 Gb Total Space | 27,64 Gb Free Space | 17,99% Space Free | Partition Type: NTFS
Drive D: | 303,34 Gb Total Space | 132,59 Gb Free Space | 43,71% Space Free | Partition Type: NTFS
 
Computer Name: MRM-PC | User Name: MrM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.20 21:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MrM\Desktop\OTL.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.07.04 22:32:38 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (MpsSvc)
SRV - File not found [On_Demand | Stopped] --  -- (BFE)
SRV - [2013.01.09 17:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) [Disabled | Stopped] -- C:\Program Files\PDF Architect\ConversionService.exe -- (PDF Architect Service)
SRV - [2013.01.09 17:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) [Disabled | Stopped] -- C:\Program Files\PDF Architect\HelperService.exe -- (PDF Architect Helper Service)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.29 11:26:54 | 001,260,472 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.12.29 02:53:20 | 000,383,416 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.05.08 19:34:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 19:34:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.27 14:01:16 | 000,314,368 | ---- | M] (Uwe Sieber - www.uwe-sieber.de) [Disabled | Stopped] -- C:\Users\MrM\Desktop\USBDLM\USBDLM.exe -- (USBDLM)
SRV - [2009.01.02 20:14:28 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.12.18 13:21:16 | 000,341,264 | ---- | M] (Fujitsu Siemens Computers) [Disabled | Stopped] -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.12.14 17:00:00 | 000,544,768 | ---- | M] (Magix AG) [Disabled | Stopped] -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [File_System | On_Demand | Stopped] --  -- (StarOpen)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsu.sys -- (nmwcdnsu)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\MrM\AppData\Local\Temp\mbr.sys -- (mbr)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\FsUsbExDisk.SYS -- (FsUsbExDisk)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwrchid.sys -- (btwrchid)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwl2cap.sys -- (btwl2cap)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwavdt.sys -- (btwavdt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2012.12.29 11:26:54 | 008,904,632 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.05.08 19:34:48 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 19:34:48 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.02.08 11:46:58 | 000,673,792 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw66xxx.sys -- (hcw66xxx)
DRV - [2010.11.25 06:59:16 | 000,541,800 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.10.22 02:00:00 | 000,586,752 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2010.10.22 02:00:00 | 000,004,352 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.01.09 00:42:40 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2008.11.11 15:05:18 | 000,003,768 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SndTVideo.sys -- (SndTVideo)
DRV - [2008.11.11 15:05:16 | 000,023,096 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SndTAudio.sys -- (SndTAudio)
DRV - [2008.07.22 09:21:08 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.07.08 02:32:52 | 001,050,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008.04.03 13:58:46 | 000,076,688 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2008.01.10 02:34:43 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2008.01.10 02:34:42 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2007.12.11 09:52:12 | 000,026,784 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2007.04.24 17:52:10 | 000,016,688 | ---- | M] (IBM) [Kernel | System | Running] -- C:\Windows\System32\drivers\LUMDriver.sys -- (LUMDriver)
DRV - [2006.02.17 20:34:24 | 000,083,344 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510obex.sys -- (k510obex)
DRV - [2006.02.17 20:34:22 | 000,085,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mgmt.sys -- (k510mgmt)
DRV - [2006.02.17 20:34:17 | 000,094,064 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mdm.sys -- (k510mdm)
DRV - [2006.02.17 20:34:15 | 000,008,336 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mdfl.sys -- (k510mdfl)
DRV - [2006.02.17 20:34:10 | 000,058,288 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510bus.sys -- (k510bus)
DRV - [2005.10.28 04:38:18 | 000,402,432 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZD1211BU.sys -- (ZD1211BU(ZyDAS)
DRV - [2004.10.25 12:40:58 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2004.05.02 09:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GVCplDrv.sys -- (GVCplDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FUJC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{1993C63F-2963-4CC7-9B04-BAE0986821CE}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FUJC
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: sammelfreund@webmiles.de:1.12
FF - prefs.js..extensions.enabledItems: firefox1@myibay.com:1.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {f4e6547e-325b-403c-a3bb-ad29ed37a92f}:3.2.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.08 15:04:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013.03.10 11:41:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 09:23:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.01.05 13:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2013.01.05 13:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins
 
[2012.10.22 18:56:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Extensions
[2012.03.05 23:13:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2013.03.08 17:07:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions
[2013.02.24 10:55:21 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.12.16 11:15:03 | 000,000,000 | ---D | M] (SaveByclick) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions\50cd9c8a1087a@50cd9c8a108b4.com
[2012.03.05 23:13:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Sunbird\Profiles\v4xtg7wk.default\extensions
[2013.03.08 17:07:58 | 000,538,938 | ---- | M] () (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\extensions\toolbar@web.de.xpi
[2012.11.30 22:21:31 | 000,077,690 | ---- | M] () (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}.xpi
[2012.08.30 19:48:29 | 000,002,209 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\englische-ergebnisse.xml
[2012.08.30 19:48:29 | 000,010,506 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\gmx-suche.xml
[2009.10.29 01:00:16 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin-4.xml
[2012.08.30 19:48:29 | 000,002,368 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\lastminute.xml
[2012.08.30 19:48:29 | 000,005,489 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\webde-suche.xml
[2013.03.23 14:56:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.12 17:08:47 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2013.03.09 09:23:22 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.06.09 17:21:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.01 06:14:06 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.09 17:21:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.09 17:21:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.09 17:21:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.09 17:21:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: facemoods (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files\DNA\plugins\npbtdna.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - Extension: Google Drive = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Google Drive = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2013.03.23 15:16:02 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93EE8C1B-E6AA-477C-BCF4-83EB576532FA}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6C9CDA8-C6B7-477D-9E42-8375C52BB421}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEC4CDDA-2E91-4054-B793-810AF647FA13}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F28C8241-B159-4809-A324-152F55DBB8AE}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.23 15:21:59 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.03.23 15:21:59 | 000,000,000 | ---D | C] -- C:\Users\MrM\AppData\Local\temp
[2013.03.23 15:16:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.03.23 15:02:09 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.03.23 15:02:09 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.03.23 15:02:09 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.03.23 15:01:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.23 15:01:33 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.03.23 14:56:15 | 005,042,224 | R--- | C] (Swearware) -- C:\Users\MrM\Desktop\ComboFix.exe
[2013.03.20 21:23:52 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\log files
[2013.03.20 21:18:44 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\Neuer Ordner (2)
[2013.03.20 21:18:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\MrM\Desktop\OTL.exe
[2013.03.20 18:45:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.03.20 18:45:31 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.03.20 18:45:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.03.10 16:29:08 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\REACh
[2013.03.10 11:41:09 | 000,000,000 | ---D | C] -- C:\Users\MrM\Documents\PDF Architect Files
[2013.03.10 11:41:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect
[2013.03.10 11:40:44 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Architect
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.23 15:28:16 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.23 15:22:02 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.03.23 15:22:02 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.03.23 15:22:02 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.03.23 15:22:02 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.03.23 15:16:20 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.23 15:16:19 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.23 15:16:02 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.03.23 15:15:54 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.23 15:14:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.23 14:50:44 | 005,042,224 | R--- | M] (Swearware) -- C:\Users\MrM\Desktop\ComboFix.exe
[2013.03.23 14:50:28 | 000,609,993 | ---- | M] () -- C:\Users\MrM\Desktop\adwcleaner.exe
[2013.03.20 21:22:36 | 000,050,477 | ---- | M] () -- C:\Users\MrM\Desktop\Defogger.exe
[2013.03.20 21:20:49 | 000,130,048 | ---- | M] () -- C:\Users\MrM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.03.20 21:17:18 | 000,377,856 | ---- | M] () -- C:\Users\MrM\Desktop\gmer_2.1.19155.exe
[2013.03.20 21:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MrM\Desktop\OTL.exe
[2013.03.20 18:45:32 | 000,000,878 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.03.20 05:58:03 | 000,410,144 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.03.17 11:49:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.03.12 19:45:22 | 000,001,356 | ---- | M] () -- C:\Users\MrM\AppData\Local\d3d9caps.dat
[2013.03.10 11:36:08 | 000,009,239 | ---- | M] () -- C:\Users\MrM\Desktop\Zahlungsbeleg -GOLDEN THAI- PayPal.pdf
[2013.03.02 10:00:46 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.03.02 10:00:46 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.02.24 14:09:33 | 000,101,995 | ---- | M] () -- C:\Users\MrM\Desktop\Mode Online Shop - Kleidung - Schuhe - Möbel kaufen BAUR Versand.pdf
[2013.02.24 12:41:26 | 000,175,419 | ---- | M] () -- C:\Users\MrM\Desktop\BoardingPassHOECHERLMARIO.pdf
[2013.02.23 10:54:13 | 005,109,966 | ---- | M] () -- C:\Users\MrM\Desktop\Neuer Ordner.zip
[2013.02.23 10:53:36 | 000,404,996 | ---- | M] () -- C:\Users\MrM\Desktop\kaufvertrag_allgemein[1].pdf
 
========== Files Created - No Company Name ==========
 
[2013.03.23 15:02:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.03.23 15:02:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.03.23 15:02:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.03.23 15:02:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.03.23 15:02:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.03.23 14:56:15 | 000,609,993 | ---- | C] () -- C:\Users\MrM\Desktop\adwcleaner.exe
[2013.03.20 21:23:41 | 000,050,477 | ---- | C] () -- C:\Users\MrM\Desktop\Defogger.exe
[2013.03.20 21:18:15 | 000,377,856 | ---- | C] () -- C:\Users\MrM\Desktop\gmer_2.1.19155.exe
[2013.03.20 18:45:32 | 000,000,878 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.03.10 11:36:05 | 000,009,239 | ---- | C] () -- C:\Users\MrM\Desktop\Zahlungsbeleg -GOLDEN THAI- PayPal.pdf
[2013.03.03 21:38:38 | 000,869,238 | ---- | C] () -- C:\Users\MrM\Desktop\anwohnerparkausweis.jpg
[2013.03.03 21:37:52 | 000,340,736 | ---- | C] () -- C:\Users\MrM\Desktop\fax barclay.pdf
[2013.02.24 14:09:35 | 000,101,995 | ---- | C] () -- C:\Users\MrM\Desktop\Mode Online Shop - Kleidung - Schuhe - Möbel kaufen BAUR Versand.pdf
[2013.02.24 12:41:26 | 000,175,419 | ---- | C] () -- C:\Users\MrM\Desktop\BoardingPassHOECHERLMARIO.pdf
[2013.02.23 10:54:08 | 005,109,966 | ---- | C] () -- C:\Users\MrM\Desktop\Neuer Ordner.zip
[2013.02.23 10:53:35 | 000,404,996 | ---- | C] () -- C:\Users\MrM\Desktop\kaufvertrag_allgemein[1].pdf
[2013.01.13 11:19:04 | 000,106,574 | ---- | C] () -- C:\Users\MrM\attachment.pdf
[2012.12.21 16:37:31 | 000,426,370 | ---- | C] () -- C:\Users\MrM\perso_vo.jpg
[2012.12.21 16:37:31 | 000,400,394 | ---- | C] () -- C:\Users\MrM\perso_ru.jpg
[2012.12.15 10:19:19 | 000,000,138 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.10.03 10:23:34 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2011.10.02 18:02:07 | 000,015,565 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2011.10.01 21:49:40 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll
[2011.10.01 21:49:40 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe
[2011.10.01 21:49:40 | 000,015,872 | ---- | C] () -- C:\Windows\System32\InsDrvZD64.DLL
[2011.10.01 21:49:40 | 000,013,312 | ---- | C] () -- C:\Windows\System32\VistaRundll.exe
[2011.08.28 19:17:36 | 000,004,447 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.06.20 18:31:14 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.04.22 10:33:10 | 000,163,840 | ---- | C] () -- C:\Windows\System32\12kUBusd.dll
[2011.04.22 10:28:26 | 000,000,000 | ---- | C] () -- C:\Windows\UI.INI
[2011.02.26 09:39:45 | 001,456,640 | ---- | C] () -- C:\Program Files\Common Files\Falk Navi-Manager.msi
[2010.08.15 19:06:46 | 000,000,205 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\mdbu.bin
[2010.04.10 11:59:05 | 000,001,356 | ---- | C] () -- C:\Users\MrM\AppData\Local\d3d9caps.dat
[2010.03.13 10:58:00 | 001,029,272 | ---- | C] () -- C:\Users\MrM\Ein Geld Kleid.pdf
[2010.02.18 19:24:14 | 000,310,593 | ---- | C] () -- C:\Users\MrM\Toyota Avensis Forum    Old...pdf
[2010.02.04 00:10:38 | 002,003,705 | ---- | C] () -- C:\Users\MrM\Migraenekalender.pdf
[2010.02.03 23:57:03 | 001,932,534 | ---- | C] () -- C:\Users\MrM\netdoktor-kopfschmerzkalender.pdf
[2009.12.19 22:16:11 | 000,000,148 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\AVSMediaPlayer.m3u
[2009.12.13 20:51:58 | 000,001,383 | ---- | C] () -- C:\Users\MrM\remove_WGA.rtf
[2009.10.22 06:25:12 | 000,127,663 | ---- | C] () -- C:\Users\MrM\img177.jpg
[2009.10.22 06:25:12 | 000,125,090 | ---- | C] () -- C:\Users\MrM\img178.jpg
[2009.10.20 22:09:32 | 003,680,024 | ---- | C] () -- C:\Users\MrM\blechumformung.pdf
[2009.10.20 22:08:01 | 000,278,293 | ---- | C] () -- C:\Users\MrM\umform-grundlagen.pdf
[2009.10.20 22:07:53 | 002,263,047 | ---- | C] () -- C:\Users\MrM\umformen_allg.pdf
[2009.10.20 11:16:16 | 000,085,672 | ---- | C] () -- C:\Users\MrM\bar hemingway_stralsund_cocktails.pdf
[2009.07.01 18:17:40 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.03.22 21:29:58 | 000,201,071 | ---- | C] () -- C:\Users\MrM\impfen_impfbuch.pdf
[2009.03.22 21:29:58 | 000,087,623 | R--- | C] () -- C:\Users\MrM\liniennetz_tschech.pdf
[2009.03.22 21:29:58 | 000,032,980 | ---- | C] () -- C:\Users\MrM\service.gmx.pdf
[2008.12.31 02:28:08 | 000,130,048 | ---- | C] () -- C:\Users\MrM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >

--- --- ---

######################################################

Ende.

aharonov · 23.03.2013, 15:51

Hi,

dann das:

Schritt 1

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinen Desktop.

Entpacke das Archiv auf deinem Desktop.
Im neu erstellten Ordner starte bitte die mbar.exe.
Wenn eine Warnung "Registry value AppInit_Dlls has been found, .." erscheint, drücke Nein.
Folge dann den Anweisungen, führe das Update aus und drücke dann Scan.

Falls Funde angezeigt werden:

Klicke auf den CleanUp Button und erlaube den Neustart.
Während des Neustarts wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut und wiederhole den Scan.
Sollte nochmals was gefunden werden, führe erneut den CleanUp-Prozess durch.

Das Tool wird im erstellten Ordner Logfiles (mbar-log-<Jahr-Monat-Tag>.txt) erzeugen. Bitte poste deren Inhalt hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers.

Schritt 2

Downloade dir bitte Farbars Service Scanner und speichere es auf den Desktop.

Starte das Tool mit Doppelklick auf FSS.exe.
Gehe sicher, dass folgende Optionen angehakt sind:
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt auf dem Desktop erstellen.

Poste bitte dessen Inhalt hier.

Bitte poste in deiner nächsten Antwort:

Log von MBAR
Log von FSS

MrMaho · 23.03.2013, 20:05

Hallo,

leider habe ich große Probleme mit dem Rechner. Ich komme nicht ins Internet !
Deswegen kann ich auch keine Updates machen

Auch Malwarebytes Anti-Rootkit funktionierte nicht !
Ich konnte es nicht updaten (siehe Bild internet_fehler) und beim Scan kam eine Fehlermeldung (siehe Bilder fehler_Malware-1 und fehler_Malware-2)

########################################################

Hier das txt von Farbars Service Scanner:

Farbar Service Scanner Version: 03-03-2013
Ran by MrM (administrator) on 23-03-2013 at 19:45:40
Running from "C:\Users\MrM\Desktop"
Microsoft Windows XP Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is set to Disabled. The default start type is Auto.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.
Checking LEGACY_Dnscache: ATTENTION!=====> Unable to open LEGACY_Dnscache\0000 registry key. The key does not exist.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is set to Disabled. The default start type is Auto.
The ImagePath of Dhcp: "%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted".
The ServiceDll of Dhcp service is OK.
Checking LEGACY_Dhcp: ATTENTION!=====> Unable to open LEGACY_Dhcp\0000 registry key. The key does not exist.

IpSec Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open IpSec registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open IpSec registry key. The service key does not exist.
Checking LEGACY_IpSec: ATTENTION!=====> Unable to open LEGACY_IpSec\0000 registry key. The key does not exist.

Connection Status:
==============
Attempt to access Local Host IP returned error: Localhost is blocked: Other errors
LAN connected.
Attempt to access Google IP returned error. Other errors
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo IP returned error. Other errors
Attempt to access Yahoo.com returned error: Other errors

Windows Firewall:
=============
sharedaccess Service is not running. Checking service configuration:
The start type of sharedaccess service is OK.
The ImagePath of sharedaccess service is OK.
The ServiceDll of sharedaccess service is OK.
Checking LEGACY_sharedaccess: ATTENTION!=====> Unable to open LEGACY_sharedaccess\0000 registry key. The key does not exist.

netman Service is not running. Checking service configuration:
The start type of netman service is set to Disabled. The default start type is 3.
The ImagePath of netman: "%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted".
The ServiceDll of netman service is OK.
Checking LEGACY_netman: ATTENTION!=====> Unable to open LEGACY_netman\0000 registry key. The key does not exist.

Firewall Disabled Policy:
==================

System Restore:
============
Srservice Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open Srservice registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open Srservice registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open Srservice registry key. The service key does not exist.
Checking LEGACY_Srservice: ATTENTION!=====> Unable to open LEGACY_Srservice\0000 registry key. The key does not exist.

sr Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open sr registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open sr registry key. The service key does not exist.
Checking LEGACY_sr: ATTENTION!=====> Unable to open LEGACY_sr\0000 registry key. The key does not exist.

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.
Checking LEGACY_BITS: ATTENTION!=====> Unable to open LEGACY_BITS\0000 registry key. The key does not exist.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is set to Disabled. The default start type is 3.
The ImagePath of EventSystem: "%SystemRoot%\system32\svchost.exe -k LocalService".
The ServiceDll of EventSystem service is OK.
Checking LEGACY_EventSystem: ATTENTION!=====> Unable to open LEGACY_EventSystem\0000 registry key. The key does not exist.

Windows Autoupdate Disabled Policy:
============================

File Check:
========
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\netbt.sys
[2009-05-28 19:02] - [2009-04-11 05:45] - 0185856 ____A (Microsoft Corporation) ECD64230A59CBD93C85F1CD1CAB9F3F6

C:\Windows\system32\Drivers\tcpip.sys
[2013-02-13 19:49] - [2013-01-04 12:28] - 0905576 ____A (Microsoft Corporation) 74E2D020C47BB2B2FCCBA29A518A7EB4

ATTENTION!=====> C:\Windows\system32\Drivers\ipsec.sys FILE IS MISSING AND SHOULD BE RESTORED.

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll
[2008-01-21 03:24] - [2008-01-21 03:24] - 0288256 ____A (Microsoft Corporation) E1499BD0FF76B1B2FBBF1AF339D91165

C:\Windows\system32\netman.dll
[2008-01-21 03:24] - [2008-01-21 03:24] - 0274432 ____A (Microsoft Corporation) C8052711DAECC48B982434C5116CA401

C:\Windows\system32\wbem\WMIsvc.dll
[2009-05-28 19:02] - [2009-04-11 07:28] - 0162304 ____A (Microsoft Corporation) 6B2A1D0E80110E3D04E6863C6E62FD8A

ATTENTION!=====> C:\Windows\system32\srsvc.dll FILE IS MISSING AND SHOULD BE RESTORED.

ATTENTION!=====> C:\Windows\system32\Drivers\sr.sys FILE IS MISSING AND SHOULD BE RESTORED.

C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit

ATTENTION!=====> C:\Windows\system32\wuauserv.dll FILE IS MISSING AND SHOULD BE RESTORED.

C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\services.exe
[2009-05-28 19:02] - [2009-04-11 07:27] - 0279552 ____A (Microsoft Corporation) D4E6D91C1349B7BFB3599A6ADA56851B

Extra List:
=======
RFCOMM(10) Smb(9) Tcpip(3) Tcpip6(8) tdx(4)
0x0B0000000500000001000000020000000300000004000000060000000700000008000000090000000A0000000B000000
ATTENTION!=====> IpSec Tag value should be 5. ATTENTION!=====> IpSec Tag value is missing and it should be 5.

**** End of log ****

aharonov · 23.03.2013, 20:16

Ohoh, das FSS-Log sieht aber gar nicht schön aus..
Versuchen wir mal was.

Schritt 1

Downloade dir bitte Windows Repair (all in one) und entpacke das Archiv auf den Desktop.

Starte nun die darin enthaltene Repair_Windows.exe.
Wähle den Reiter Step 2 (optional) und drücke auf Do It. Der Rechner wird neu gestartet.
Öffne das Programm erneut und klicke im Reiter Step 3 (optional) ebenfalls auf Do It. Starte danach den Rechner neu.
Im Reiter Step 4 (optional) drücke dann unter System Restore auf Create.
Danach drücke im Reiter Start Repairs auf Start.
Klicke auf Select All, setze den Haken bei Restart/Shutdown System When Finished und wähle die Option Restart System.
Deaktiviere temporär dein Antivirenprogramm und drücke auf Start.

Schritt 2

Starte Farbars Service Scanner mit Doppelklick auf FSS.exe.
Gehe sicher, dass folgende Optionen angehakt sind:
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt auf dem Desktop erstellen.

Poste bitte dessen Inhalt hier.

Bitte poste in deiner nächsten Antwort:

Log von FSS

MrMaho · 24.03.2013, 00:10

Cool ! Internet geht wieder.

Hier die txt von Farbar:

Farbar Service Scanner Version: 03-03-2013
Ran by MrM (administrator) on 24-03-2013 at 00:07:18
Running from "C:\Users\MrM\Desktop"
Microsoft Windows XP Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
IpSec Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open IpSec registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open IpSec registry key. The service key does not exist.
Checking LEGACY_IpSec: ATTENTION!=====> Unable to open LEGACY_IpSec\0000 registry key. The key does not exist.

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
sharedaccess Service is not running. Checking service configuration:
The start type of sharedaccess service is set to Demand. The default start type is Auto.
The ImagePath of sharedaccess service is OK.
The ServiceDll of sharedaccess service is OK.
Checking LEGACY_sharedaccess: ATTENTION!=====> Unable to open LEGACY_sharedaccess\0000 registry key. The key does not exist.

Firewall Disabled Policy:
==================

System Restore:
============
Srservice Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open Srservice registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open Srservice registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open Srservice registry key. The service key does not exist.
Checking LEGACY_Srservice: ATTENTION!=====> Unable to open LEGACY_Srservice\0000 registry key. The key does not exist.

sr Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open sr registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open sr registry key. The service key does not exist.
Checking LEGACY_sr: ATTENTION!=====> Unable to open LEGACY_sr\0000 registry key. The key does not exist.

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

File Check:
========
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\netbt.sys
[2009-05-28 19:02] - [2009-04-11 05:45] - 0185856 ____A (Microsoft Corporation) ECD64230A59CBD93C85F1CD1CAB9F3F6

C:\Windows\system32\Drivers\tcpip.sys
[2013-02-13 19:49] - [2013-01-04 12:28] - 0905576 ____A (Microsoft Corporation) 74E2D020C47BB2B2FCCBA29A518A7EB4

ATTENTION!=====> C:\Windows\system32\Drivers\ipsec.sys FILE IS MISSING AND SHOULD BE RESTORED.

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll
[2008-01-21 03:24] - [2008-01-21 03:24] - 0288256 ____A (Microsoft Corporation) E1499BD0FF76B1B2FBBF1AF339D91165

C:\Windows\system32\netman.dll
[2008-01-21 03:24] - [2008-01-21 03:24] - 0274432 ____A (Microsoft Corporation) C8052711DAECC48B982434C5116CA401

C:\Windows\system32\wbem\WMIsvc.dll
[2009-05-28 19:02] - [2009-04-11 07:28] - 0162304 ____A (Microsoft Corporation) 6B2A1D0E80110E3D04E6863C6E62FD8A

ATTENTION!=====> C:\Windows\system32\srsvc.dll FILE IS MISSING AND SHOULD BE RESTORED.

ATTENTION!=====> C:\Windows\system32\Drivers\sr.sys FILE IS MISSING AND SHOULD BE RESTORED.

C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit

ATTENTION!=====> C:\Windows\system32\wuauserv.dll FILE IS MISSING AND SHOULD BE RESTORED.

C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\services.exe
[2009-05-28 19:02] - [2009-04-11 07:27] - 0279552 ____A (Microsoft Corporation) D4E6D91C1349B7BFB3599A6ADA56851B

Extra List:
=======
RFCOMM(10) Smb(9) Tcpip(3) Tcpip6(8) tdx(4)
0x0B0000000500000001000000020000000300000004000000060000000700000008000000090000000A0000000B000000
ATTENTION!=====> IpSec Tag value should be 5. ATTENTION!=====> IpSec Tag value is missing and it should be 5.

**** End of log ****

aharonov · 26.03.2013, 16:01

Sorry, das Thema hier ist mir irgendwie untergegangen.

Aber das Log von FSS sieht weiterhin sehr merkwürdig aus. Da fehlen unter anderem Systemfiles..
Ist das eine ganz normale legale Windows-Version..?

MrMaho · 26.03.2013, 21:19

Hi.

Ja, das ist die legale offizielle Original-Win-Vista-Version, die auf dem Rechner schon vorinstalliert war. Ich hab dazu eine Recovery-CD.
Das XP ist schon etwas älter und von "woanders" her, aber das sollte ja keinen Einfluss auf Vista haben. Muss ja auch vor dem Start auswählen, mit welchem BS ich arbeiten will.

:-(

aharonov · 26.03.2013, 21:47

Zitat:

Das XP ist schon etwas älter und von "woanders" her

Wie läuft das Vista jetzt? Noch Probleme?

aharonov · 02.04.2013, 02:06

Fehlende Rückmeldung
Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung mehr über neue Antworten.
Schreib mir eine PM, falls du das Thema doch wieder fortsetzen möchtest. Dann machen wir hier weiter.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass dein Rechner schon sauber ist.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.

MrMaho · 03.04.2013, 11:45

Hi Leo.

Jep, der PC läuft mit VISTA wieder einigermaßen. *THX*

Allerdings gibt es noch einiges zu tun, denke ich, da z.B. die Ordnersymbole auf dem Desktop "merkwürdig" aussehen - die haben so "zwei Männchen" im Symbol mit drin, was vorher nie war. Ich vermute auch, dass was mit den "Freigaben" noch nicht so richtig stimmt, was daran liegen kann, dass ich den Rechner/ einige Ordner davon im "Heimnetzwerk" freigeben wollte. Hat aber nie geklappt. Kommuniziert Vista nicht mit WIN7?

Das Internet geht wieder und bisher habe ich auch noch keine schweren Fehler gefunden. Hab nun "Zone Alarm" drauf statt "Avira".

Was soll ich als nächstes tun?

Grüße, Mario.

aharonov · 07.04.2013, 17:10

Hi,

Starte bitte die OTL.exe.

Setze den Haken bei Scan all Users.
Drücke auf den Quick Scan Button.
Poste den Inhalt von OTL.txt hier in den Thread.

MrMaho · 07.04.2013, 18:17

Danke.

Hier die OTL.txt:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 07.04.2013 18:39:10 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\MrM\Desktop\PC_repair
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 57,71% Memory free
6,20 Gb Paging File | 5,00 Gb Available in Paging File | 80,71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,63 Gb Total Space | 25,70 Gb Free Space | 16,73% Space Free | Partition Type: NTFS
Drive D: | 303,34 Gb Total Space | 132,59 Gb Free Space | 43,71% Space Free | Partition Type: NTFS
 
Computer Name: MRM-PC | User Name: MrM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.20 22:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MrM\Desktop\PC_repair\OTL.exe
PRC - [2013.01.29 22:08:04 | 002,447,888 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
PRC - [2013.01.29 21:35:36 | 000,073,832 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
PRC - [2013.01.18 16:21:02 | 000,873,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2013.01.18 16:21:00 | 001,821,984 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.12.18 16:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.11.22 16:33:18 | 000,497,320 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2012.11.22 16:32:54 | 000,738,984 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
PRC - [2009.12.09 23:12:50 | 001,118,208 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\SITECOM\150N USB Wireless LAN Utility\RtWLan.exe
PRC - [2009.12.07 14:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files\SITECOM\150N USB Wireless LAN Utility\RtlService.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.07.04 23:32:38 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2008.09.16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Windows\system32\wbengine.exe -- (wbengine)
SRV - [2013.01.29 22:08:04 | 002,447,888 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2013.01.09 18:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) [Disabled | Stopped] -- C:\Program Files\PDF Architect\ConversionService.exe -- (PDF Architect Service)
SRV - [2013.01.09 18:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) [Disabled | Stopped] -- C:\Program Files\PDF Architect\HelperService.exe -- (PDF Architect Helper Service)
SRV - [2013.01.08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.29 12:26:54 | 001,260,472 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.12.18 16:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.11.22 16:33:18 | 000,497,320 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe -- (IswSvc)
SRV - [2011.04.27 15:01:16 | 000,314,368 | ---- | M] (Uwe Sieber - www.uwe-sieber.de) [Disabled | Stopped] -- C:\Users\MrM\Desktop\USBDLM\USBDLM.exe -- (USBDLM)
SRV - [2009.12.07 14:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files\SITECOM\150N USB Wireless LAN Utility\RtlService.exe -- (Realtek11nSU)
SRV - [2009.01.02 21:14:28 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.12.18 14:21:16 | 000,341,264 | ---- | M] (Fujitsu Siemens Computers) [Disabled | Stopped] -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 10:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 10:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.12.14 18:00:00 | 000,544,768 | ---- | M] (Magix AG) [Disabled | Stopped] -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [File_System | On_Demand | Stopped] --  -- (StarOpen)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nmwcdnsu.sys -- (nmwcdnsu)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\FsUsbExDisk.SYS -- (FsUsbExDisk)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwrchid.sys -- (btwrchid)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwl2cap.sys -- (btwl2cap)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwavdt.sys -- (btwavdt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2013.02.26 00:22:06 | 008,939,296 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.12.13 12:49:44 | 000,451,160 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2012.11.22 16:33:30 | 000,027,056 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2012.11.15 22:06:10 | 000,587,096 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2011.02.08 12:46:58 | 000,673,792 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw66xxx.sys -- (hcw66xxx)
DRV - [2010.11.25 07:59:16 | 000,541,800 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.10.22 03:00:00 | 000,586,752 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2010.10.22 03:00:00 | 000,004,352 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2010.01.09 01:42:40 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009.04.11 06:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2008.11.11 16:05:18 | 000,003,768 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SndTVideo.sys -- (SndTVideo)
DRV - [2008.11.11 16:05:16 | 000,023,096 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SndTAudio.sys -- (SndTAudio)
DRV - [2008.07.22 10:21:08 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.07.08 03:32:52 | 001,050,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.05.27 13:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008.04.03 14:58:46 | 000,076,688 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2008.01.10 03:34:43 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2008.01.10 03:34:42 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2007.12.11 10:52:12 | 000,026,784 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2007.04.24 18:52:10 | 000,016,688 | ---- | M] (IBM) [Kernel | System | Running] -- C:\Windows\System32\drivers\LUMDriver.sys -- (LUMDriver)
DRV - [2006.02.17 21:34:24 | 000,083,344 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510obex.sys -- (k510obex)
DRV - [2006.02.17 21:34:22 | 000,085,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mgmt.sys -- (k510mgmt)
DRV - [2006.02.17 21:34:17 | 000,094,064 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mdm.sys -- (k510mdm)
DRV - [2006.02.17 21:34:15 | 000,008,336 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510mdfl.sys -- (k510mdfl)
DRV - [2006.02.17 21:34:10 | 000,058,288 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k510bus.sys -- (k510bus)
DRV - [2005.10.28 05:38:18 | 000,402,432 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZD1211BU.sys -- (ZD1211BU(ZyDAS)
DRV - [2004.10.25 13:40:58 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2004.05.02 10:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GVCplDrv.sys -- (GVCplDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FUJC
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{1993C63F-2963-4CC7-9B04-BAE0986821CE}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FUJC
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: sammelfreund@webmiles.de:1.12
FF - prefs.js..extensions.enabledItems: firefox1@myibay.com:1.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {f4e6547e-325b-403c-a3bb-ad29ed37a92f}:3.2.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.08 16:04:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013.03.10 12:41:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2013.03.29 00:26:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.09 10:23:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.04.07 18:24:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2013.01.05 14:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins
 
[2012.10.22 19:56:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Extensions
[2012.03.06 00:13:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2013.03.24 01:10:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions
[2013.02.24 11:55:21 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.12.16 12:15:03 | 000,000,000 | ---D | M] (SaveByclick) -- C:\Users\MrM\AppData\Roaming\mozilla\Firefox\Profiles\6sbpq4ea.default\extensions\50cd9c8a1087a@50cd9c8a108b4.com
[2012.03.06 00:13:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\Sunbird\Profiles\v4xtg7wk.default\extensions
[2013.03.24 01:10:13 | 000,549,639 | ---- | M] () (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\extensions\toolbar@web.de.xpi
[2012.11.30 23:21:31 | 000,077,690 | ---- | M] () (No name found) -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}.xpi
[2012.08.30 20:48:29 | 000,002,209 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\englische-ergebnisse.xml
[2012.08.30 20:48:29 | 000,010,506 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\gmx-suche.xml
[2013.04.03 12:31:56 | 000,000,950 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\icqplugin-4.xml
[2012.08.30 20:48:29 | 000,002,368 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\lastminute.xml
[2012.08.30 20:48:29 | 000,005,489 | ---- | M] () -- C:\Users\MrM\AppData\Roaming\mozilla\firefox\profiles\6sbpq4ea.default\searchplugins\webde-suche.xml
[2013.03.29 00:14:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.12 18:08:47 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2013.03.09 10:23:22 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.07.12 18:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.06.09 18:21:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.01 07:14:06 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.09 18:21:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.09 18:21:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.09 18:21:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.09 18:21:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: facemoods (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\25.0.1364.152\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files\DNA\plugins\npbtdna.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - Extension: Google Drive = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Google Drive = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\MrM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2013.03.24 00:50:13 | 000,000,855 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe File not found
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2444975696-2725477063-918493955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93EE8C1B-E6AA-477C-BCF4-83EB576532FA}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEC4CDDA-2E91-4054-B793-810AF647FA13}: DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F28C8241-B159-4809-A324-152F55DBB8AE}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.06 10:33:41 | 001,015,328 | ---- | C] (Solid State Networks) -- C:\Users\MrM\Desktop\install_reader10_de_mssd_aih.exe
[2013.04.06 10:31:31 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2013.04.03 12:25:13 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\PC_repair
[2013.03.29 00:26:41 | 000,000,000 | ---D | C] -- C:\Users\MrM\Documents\ForceField Shared Files
[2013.03.29 00:26:41 | 000,000,000 | ---D | C] -- C:\Users\MrM\AppData\Roaming\CheckPoint
[2013.03.29 00:26:25 | 000,587,096 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2013.03.29 00:26:25 | 000,075,096 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klflt.sys
[2013.03.29 00:26:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2013.03.29 00:18:38 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2013.03.29 00:18:28 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2013.03.29 00:03:03 | 000,000,000 | ---D | C] -- C:\Program Files\G Data
[2013.03.29 00:03:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\G Data
[2013.03.24 00:59:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2013.03.24 00:59:27 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.03.24 00:57:28 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.03.23 23:58:27 | 000,181,064 | ---- | C] (Sysinternals) -- C:\Windows\PSEXESVC.EXE
[2013.03.23 20:17:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sitecom 150N USB Wireless LAN Utility
[2013.03.23 20:16:58 | 000,380,928 | R--- | C] (Realtek) -- C:\Windows\System32\RtlUI2.exe
[2013.03.23 20:16:58 | 000,380,928 | R--- | C] (Realtek) -- C:\Windows\RtlUI2.exe
[2013.03.23 20:16:54 | 000,000,000 | ---D | C] -- C:\Program Files\SITECOM
[2013.03.23 16:21:59 | 000,000,000 | ---D | C] -- C:\Users\MrM\AppData\Local\temp
[2013.03.23 16:16:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.03.23 16:02:09 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.03.23 16:02:09 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.03.23 16:02:09 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.03.23 16:01:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.23 16:01:33 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.03.20 22:18:44 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\Neuer Ordner (2)
[2013.03.20 19:45:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.03.20 19:45:31 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.03.20 19:45:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.03.10 17:29:08 | 000,000,000 | ---D | C] -- C:\Users\MrM\Desktop\REACh
[2013.03.10 12:41:09 | 000,000,000 | ---D | C] -- C:\Users\MrM\Documents\PDF Architect Files
[2013.03.10 12:41:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect
[2013.03.10 12:40:44 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Architect
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.07 18:34:13 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.04.07 18:34:13 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.04.07 18:34:13 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.04.07 18:34:13 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.04.07 18:29:00 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.07 18:28:53 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.04.07 18:28:53 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.04.07 18:28:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.07 11:42:24 | 000,028,733 | ---- | M] () -- C:\Users\MrM\Desktop\ferienzeiten_nrw_2012.jpg
[2013.04.07 11:28:11 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.06 10:33:45 | 001,015,328 | ---- | M] (Solid State Networks) -- C:\Users\MrM\Desktop\install_reader10_de_mssd_aih.exe
[2013.03.29 00:31:36 | 000,417,507 | ---- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
[2013.03.29 00:26:09 | 000,000,639 | ---- | M] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2013.03.29 00:04:28 | 000,049,528 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\PktIcpt.sys
[2013.03.24 00:57:51 | 000,410,144 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.03.24 00:55:34 | 000,181,064 | ---- | M] (Sysinternals) -- C:\Windows\PSEXESVC.EXE
[2013.03.24 00:50:13 | 000,000,855 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.03.23 20:17:26 | 000,002,046 | ---- | M] () -- C:\Users\Public\Desktop\Sitecom 150N USB Wireless LAN Utility.lnk
[2013.03.23 16:16:02 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts_bak_223
[2013.03.20 22:20:49 | 000,130,048 | ---- | M] () -- C:\Users\MrM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.03.17 12:49:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.03.12 20:45:22 | 000,001,356 | ---- | M] () -- C:\Users\MrM\AppData\Local\d3d9caps.dat
[2013.03.10 12:36:08 | 000,009,239 | ---- | M] () -- C:\Users\MrM\Desktop\Zahlungsbeleg -GOLDEN THAI- PayPal.pdf
 
========== Files Created - No Company Name ==========
 
[2013.04.07 11:42:24 | 000,028,733 | ---- | C] () -- C:\Users\MrM\Desktop\ferienzeiten_nrw_2012.jpg
[2013.03.29 00:26:43 | 000,417,507 | ---- | C] () -- C:\Windows\System32\drivers\vsconfig.xml
[2013.03.29 00:26:09 | 000,000,639 | ---- | C] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2013.03.23 20:17:26 | 000,002,046 | ---- | C] () -- C:\Users\Public\Desktop\Sitecom 150N USB Wireless LAN Utility.lnk
[2013.03.23 20:16:54 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe
[2013.03.23 16:02:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.03.23 16:02:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.03.23 16:02:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.03.23 16:02:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.03.23 16:02:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.03.10 12:36:05 | 000,009,239 | ---- | C] () -- C:\Users\MrM\Desktop\Zahlungsbeleg -GOLDEN THAI- PayPal.pdf
[2013.01.13 12:19:04 | 000,106,574 | ---- | C] () -- C:\Users\MrM\attachment.pdf
[2012.12.21 17:37:31 | 000,426,370 | ---- | C] () -- C:\Users\MrM\perso_vo.jpg
[2012.12.21 17:37:31 | 000,400,394 | ---- | C] () -- C:\Users\MrM\perso_ru.jpg
[2012.12.15 11:19:19 | 000,000,138 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.10.03 11:23:34 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2011.10.02 19:02:07 | 000,015,565 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2011.10.01 22:49:40 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll
[2011.10.01 22:49:40 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe
[2011.10.01 22:49:40 | 000,015,872 | ---- | C] () -- C:\Windows\System32\InsDrvZD64.DLL
[2011.10.01 22:49:40 | 000,013,312 | ---- | C] () -- C:\Windows\System32\VistaRundll.exe
[2011.08.28 20:17:36 | 000,004,447 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.06.20 19:31:14 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.04.22 11:33:10 | 000,163,840 | ---- | C] () -- C:\Windows\System32\12kUBusd.dll
[2011.04.22 11:28:26 | 000,000,000 | ---- | C] () -- C:\Windows\UI.INI
[2011.02.26 10:39:45 | 001,456,640 | ---- | C] () -- C:\Program Files\Common Files\Falk Navi-Manager.msi
[2010.08.15 20:06:46 | 000,000,205 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\mdbu.bin
[2010.04.10 12:59:05 | 000,001,356 | ---- | C] () -- C:\Users\MrM\AppData\Local\d3d9caps.dat
[2010.03.13 11:58:00 | 001,029,272 | ---- | C] () -- C:\Users\MrM\Ein Geld Kleid.pdf
[2010.02.18 20:24:14 | 000,310,593 | ---- | C] () -- C:\Users\MrM\Toyota Avensis Forum    Old...pdf
[2010.02.04 01:10:38 | 002,003,705 | ---- | C] () -- C:\Users\MrM\Migraenekalender.pdf
[2010.02.04 00:57:03 | 001,932,534 | ---- | C] () -- C:\Users\MrM\netdoktor-kopfschmerzkalender.pdf
[2009.12.19 23:16:11 | 000,000,148 | ---- | C] () -- C:\Users\MrM\AppData\Roaming\AVSMediaPlayer.m3u
[2009.12.13 21:51:58 | 000,001,383 | ---- | C] () -- C:\Users\MrM\remove_WGA.rtf
[2009.10.22 07:25:12 | 000,127,663 | ---- | C] () -- C:\Users\MrM\img177.jpg
[2009.10.22 07:25:12 | 000,125,090 | ---- | C] () -- C:\Users\MrM\img178.jpg
[2009.10.20 23:09:32 | 003,680,024 | ---- | C] () -- C:\Users\MrM\blechumformung.pdf
[2009.10.20 23:08:01 | 000,278,293 | ---- | C] () -- C:\Users\MrM\umform-grundlagen.pdf
[2009.10.20 23:07:53 | 002,263,047 | ---- | C] () -- C:\Users\MrM\umformen_allg.pdf
[2009.10.20 12:16:16 | 000,085,672 | ---- | C] () -- C:\Users\MrM\bar hemingway_stralsund_cocktails.pdf
[2009.07.01 19:17:40 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.03.22 22:29:58 | 000,201,071 | ---- | C] () -- C:\Users\MrM\impfen_impfbuch.pdf
[2009.03.22 22:29:58 | 000,087,623 | R--- | C] () -- C:\Users\MrM\liniennetz_tschech.pdf
[2009.03.22 22:29:58 | 000,032,980 | ---- | C] () -- C:\Users\MrM\service.gmx.pdf
[2008.12.31 03:28:08 | 000,130,048 | ---- | C] () -- C:\Users\MrM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\Windows\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\Windows\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2011.11.23 21:34:06 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\IrfanView
[2009.08.19 21:58:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Keynote Systems
[2011.10.09 21:59:59 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Opera
[2009.08.19 21:58:19 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Keynote Systems
[2009.08.19 21:58:19 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Keynote Systems
[2011.05.03 22:25:41 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\AllDup
[2012.12.16 12:03:36 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\APP_NAME_NON_STRING
[2013.03.12 20:39:13 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\BitTorrent
[2010.05.27 19:34:00 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Canneverbe Limited
[2013.03.29 00:26:41 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\CheckPoint
[2013.01.27 16:47:44 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\DassaultSystemes
[2010.07.27 17:50:51 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\DeepBurner
[2010.02.26 00:11:22 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\FreeBurner
[2012.09.24 23:32:22 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\FreeFLVConverter
[2011.05.30 22:43:21 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\GetRightToGo
[2010.02.20 14:34:38 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\gtk-2.0
[2011.08.11 22:09:49 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Gutscheinmieze
[2010.06.08 21:37:58 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\ICQ
[2011.04.24 11:09:39 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\ImTOO
[2012.09.04 21:54:50 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Irateh
[2011.05.03 21:11:10 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\IrfanView
[2009.08.16 23:24:59 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Keynote Systems
[2009.01.22 22:11:19 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\MAGIX
[2010.05.29 10:28:00 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Nokia
[2010.05.29 10:28:01 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Nokia Ovi Suite
[2010.10.07 07:09:59 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Nonoh
[2011.02.11 11:36:31 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Opera
[2010.05.21 21:07:38 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\PC Suite
[2013.01.01 22:27:09 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\PDF Architect
[2010.07.05 21:15:44 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Samsung
[2008.12.31 11:50:48 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Serif
[2011.11.09 22:02:57 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Tipp4u
[2009.01.20 20:23:27 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Tunebite
[2012.11.23 11:16:45 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Vso
[2012.09.26 23:46:40 | 000,000,000 | ---D | M] -- C:\Users\MrM\AppData\Roaming\Zyog
[2009.08.19 21:58:19 | 000,000,000 | ---D | M] -- C:\Users\UpdatusUser\AppData\Roaming\Keynote Systems
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >

--- --- ---

aharonov · 07.04.2013, 19:33

Schritt 1

Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.

Schliesse alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Schritt 2

Starte bitte die OTL.exe.

Setze den Haken bei Scan all Users.
Drücke auf den Quick Scan Button.
Poste den Inhalt von OTL.txt hier in den Thread.

Bitte poste in deiner nächsten Antwort:

Log von AdwCleaner
Log von OTL

26.03.2013, 16:01	#8
aharonov /// TB-Ausbilder	BKA-Trojaner auf Vista-32bit PC mit XP als 2. BS Sorry, das Thema hier ist mir irgendwie untergegangen. Aber das Log von FSS sieht weiterhin sehr merkwürdig aus. Da fehlen unter anderem Systemfiles.. Ist das eine ganz normale legale Windows-Version..? __________________ cheers, Leo

07.04.2013, 17:10	#13
aharonov /// TB-Ausbilder	BKA-Trojaner auf Vista-32bit PC mit XP als 2. BS Hi, Starte bitte die OTL.exe. Setze den Haken bei Scan all Users. Drücke auf den Quick Scan Button. Poste den Inhalt von OTL.txt hier in den Thread. __________________ cheers, Leo

BKA-Trojaner auf Vista-32bit PC mit XP als 2. BS

Plagegeister aller Art und deren Bekämpfung: BKA-Trojaner auf Vista-32bit PC mit XP als 2. BS