ElektroshopWagner.de Spam: Rechnung zu Ihrer Bestellung: K10500-648187

OTL logfile created on: 21.05.2013 21:10:58 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Su\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,93 Gb Total Physical Memory | 6,27 Gb Available Physical Memory | 79,09% Memory free
15,86 Gb Paging File | 14,21 Gb Available in Paging File | 89,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149,90 Gb Total Space | 34,17 Gb Free Space | 22,79% Space Free | Partition Type: NTFS
Drive D: | 315,76 Gb Total Space | 276,22 Gb Free Space | 87,48% Space Free | Partition Type: NTFS
 
Computer Name: SU-PC | User Name: Su | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Su\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Su\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe (PACE Anti-Piracy, Inc.)
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe ( Hewlett-Packard Development Company, L.P.)
PRC - C:\Windows\SysWOW64\bgsvcgen.exe (B.H.A Corporation)
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe (Andrea Electronics Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (BTHSSecurityMgr) -- C:\Programme\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel(R) Corporation)
SRV - (AMPPALR3) -- C:\Programme\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (HPDrvMntSvc.exe) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (PaceLicenseDServices) -- C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe (PACE Anti-Piracy, Inc.)
SRV - (DisplayLinkService) -- C:\Programme\DisplayLink Core Software\DisplayLinkManager.exe (DisplayLink Corp.)
SRV - (nosGetPlusHelper) -- C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe (IDT, Inc.)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe (Andrea Electronics Corporation)
SRV - (bgsvcgen) -- C:\Windows\SysWOW64\bgsvcgen.exe (B.H.A Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (DisplayLinkUsbPort) -- C:\Windows\SysNative\drivers\DisplayLinkUsbPort_6.3.40660.0.sys (hxxp://libusb-win32.sourceforge.net)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\Netwsw00.sys (Intel Corporation)
DRV:64bit: - (AMPPALP) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AMPPAL) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (e1kexpress) -- C:\Windows\SysNative\drivers\e1k62x64.sys (Intel Corporation)
DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation)
DRV:64bit: - (sscebus) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation)
DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadserd) -- C:\Windows\SysNative\drivers\ssadserd.sys (MCCI Corporation)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia)
DRV:64bit: - (Tpkd) -- C:\Windows\SysNative\drivers\Tpkd.sys (PACE Anti-Piracy, Inc.)
DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (dlkmd) -- C:\Windows\SysNative\drivers\dlkmd.sys (DisplayLink Corp.)
DRV:64bit: - (dlkmdldr) -- C:\Windows\SysNative\drivers\dlkmdldr.sys (DisplayLink Corp.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (rismcx64) -- C:\Windows\SysNative\drivers\rismcx64.sys (RICOH Company, Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (61883) -- C:\Windows\SysNative\drivers\61883.sys (Microsoft Corporation)
DRV:64bit: - (Avc) -- C:\Windows\SysNative\drivers\avc.sys (Microsoft Corporation)
DRV:64bit: - (MSDV) -- C:\Windows\SysNative\drivers\msdv.sys (Microsoft Corporation)
DRV:64bit: - (AVCSTRM) -- C:\Windows\SysNative\drivers\avcstrm.sys (Microsoft Corporation)
DRV:64bit: - (MSTAPE) -- C:\Windows\SysNative\drivers\mstape.sys (Microsoft Corporation)
DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (rimmptsk) -- C:\Windows\SysNative\drivers\rimmpx64.sys (REDC)
DRV:64bit: - (rismxdp) -- C:\Windows\SysNative\drivers\rixdpx64.sys (REDC)
DRV:64bit: - (rimsptsk) -- C:\Windows\SysNative\drivers\rimspx64.sys (REDC)
DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (Sentinel64) -- C:\Windows\SysNative\drivers\sentinel64.sys (SafeNet, Inc.)
DRV:64bit: - (Spyder2) -- C:\Windows\SysNative\drivers\Spyder2.sys ()
DRV:64bit: - (cdrbsdrv) -- C:\Windows\SysNative\drivers\cdrbsdrv.sys (B.H.A Corporation)
DRV - (xhc200w) -- c:\SWSetup\SP48109\32\xhc200w.sys (NEC Electronics Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKLM\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo1.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/?l=dis&o=15780
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 46 11 A1 E2 39 6D CB 01  [binary data]
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo1.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=CCS&o=15777&src=crm&q={searchTerms}&locale=de_US&apn_ptnrs=HO&apn_dtid=YYYYYYYYAT&apn_uid=ADF5BF9E-C63E-46CA-B692-05C02482922A&apn_sauid=5502A8D0-3058-4C58-A77B-EF12C1E861CD
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\SearchScopes\Plasmoo: "URL" = hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}
IE - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "Plasmoo"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: crossriderapp16150%40crossrider.com:0.91.39
FF - prefs.js..extensions.enabledAddons: firegestures%40xuldev.org:1.7.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.232.0
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.91
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.48
FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:1.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2011.01.25
FF - prefs.js..keyword.URL: "hxxp://plasmoo.com/index.htm?SearchMashine=true&q="
FF - prefs.js..network.proxy.gopher: ""
FF - prefs.js..network.proxy.gopher_port: 0
FF - prefs.js..network.proxy.no_proxies_on: ""
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+(R),version=1.6.2.91: C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011.02.14 14:42:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.12 09:25:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.12 09:25:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012.03.06 00:25:33 | 000,000,000 | ---D | M]
 
[2011.03.05 14:48:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\Extensions
[2011.03.05 14:48:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\Extensions\celtx@celtx.com
[2013.05.21 11:04:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\Firefox\Profiles\sapjxzrp.default\extensions
[2013.04.22 16:54:06 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Su\AppData\Roaming\mozilla\Firefox\Profiles\sapjxzrp.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013.02.27 23:33:56 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Su\AppData\Roaming\mozilla\Firefox\Profiles\sapjxzrp.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2013.05.08 13:08:16 | 000,000,000 | ---D | M] ("DKB-Cashback") -- C:\Users\Su\AppData\Roaming\mozilla\Firefox\Profiles\sapjxzrp.default\extensions\crossriderapp16150@crossrider.com
[2011.05.27 12:52:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\Firefox\Profiles\sapjxzrp.default\extensions\nostmp
[2013.05.08 13:08:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\Firefox\Profiles\sapjxzrp.default\extensions\crossriderapp16150@crossrider.com\chrome\content\extensionCode
[2013.05.21 11:04:15 | 000,143,251 | ---- | M] () (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\firefox\profiles\sapjxzrp.default\extensions\firegestures@xuldev.org.xpi
[2012.12.12 15:15:21 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\firefox\profiles\sapjxzrp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.05.13 21:38:17 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\firefox\profiles\sapjxzrp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.21 15:40:56 | 000,685,671 | ---- | M] () (No name found) -- C:\Users\Su\AppData\Roaming\mozilla\firefox\profiles\sapjxzrp.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
[2010.09.28 22:39:14 | 000,002,333 | ---- | M] () -- C:\Users\Su\AppData\Roaming\mozilla\firefox\profiles\sapjxzrp.default\searchplugins\askcom.xml
[2010.10.17 17:36:32 | 000,002,314 | ---- | M] () -- C:\Users\Su\AppData\Roaming\mozilla\firefox\profiles\sapjxzrp.default\searchplugins\forestle-de.xml
[2013.04.12 09:25:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.04.12 09:25:35 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.04.12 09:25:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.07.11 23:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.01.15 12:20:35 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.02 16:21:59 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.15 12:20:35 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.15 12:20:35 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.15 12:20:35 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.15 12:20:35 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DKB-Cashback) - {11111111-1111-1111-1111-110111611150} - C:\Program Files (x86)\DKB-Cashback\DKB-Cashback.dll (dkbbrowserextension)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo1.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo1.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O3 - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\..\Toolbar\WebBrowser: (uTorrentBar_DE Toolbar) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - C:\Program Files (x86)\uTorrentBar_DE\prxtbuTo1.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet File not found
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [NUSB3MON] c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000..\Run: []  File not found
O4 - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000..\Run: [Spotify] C:\Users\Su\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000..\Run: [Spotify Web Helper] C:\Users\Su\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-2832888591-1627658017-1370293167-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: &Citavi Picker... - file://C:\Program Files (x86)\Internet Explorer\PLUGINS\Citavi Picker\\ShowContextMenu.html File not found
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Su\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Citavi Picker... - file://C:\Program Files (x86)\Internet Explorer\PLUGINS\Citavi Picker\\ShowContextMenu.html File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Su\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 10.13.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEE24570-8139-466E-B4EC-D0D3CA39579D}: DhcpNameServer = 168.95.1.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{5265f59f-9dca-11e2-af3b-70f395804e0d}\Shell - "" = AutoRun
O33 - MountPoints2\{5265f59f-9dca-11e2-af3b-70f395804e0d}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{5265f5a3-9dca-11e2-af3b-70f395804e0d}\Shell - "" = AutoRun
O33 - MountPoints2\{5265f5a3-9dca-11e2-af3b-70f395804e0d}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{61ca7013-a278-11e2-b08f-0024d74b03c0}\Shell - "" = AutoRun
O33 - MountPoints2\{61ca7013-a278-11e2-b08f-0024d74b03c0}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{61ca701c-a278-11e2-b08f-0024d74b03c0}\Shell - "" = AutoRun
O33 - MountPoints2\{61ca701c-a278-11e2-b08f-0024d74b03c0}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{61ca703e-a278-11e2-b08f-0024d74b03c0}\Shell - "" = AutoRun
O33 - MountPoints2\{61ca703e-a278-11e2-b08f-0024d74b03c0}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{61ca7041-a278-11e2-b08f-0024d74b03c0}\Shell - "" = AutoRun
O33 - MountPoints2\{61ca7041-a278-11e2-b08f-0024d74b03c0}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{f4366e11-0983-11e0-bbd9-88ae1db4770f}\Shell - "" = AutoRun
O33 - MountPoints2\{f4366e11-0983-11e0-bbd9-88ae1db4770f}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.21 15:17:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.05.21 11:44:31 | 000,000,000 | ---D | C] -- C:\Users\Su\AppData\Roaming\mresreg
[2013.05.21 11:43:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\E-Mail Converter
[2013.05.21 11:40:02 | 006,518,472 | ---- | C] (IN MEDIA KG                                                 ) -- C:\Users\Su\Desktop\emc_setup.exe
[2013.05.20 21:09:26 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Su\Desktop\OTL.exe
[2013.05.19 21:44:16 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.05.19 21:44:15 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.05.19 21:44:14 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.05.19 21:44:14 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.05.19 21:44:14 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.05.19 21:44:14 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.05.19 21:44:14 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.05.19 21:44:14 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.05.19 21:44:14 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.05.19 21:44:14 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.05.19 21:44:14 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.05.19 21:44:13 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.05.19 21:44:12 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.05.19 21:44:12 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.05.19 21:44:11 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.05.19 21:39:05 | 000,000,000 | ---D | C] -- C:\Users\Su\Desktop\wagnerelektro
[2013.05.19 19:31:50 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.05.19 19:31:50 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.05.19 19:31:30 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.05.19 19:31:27 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.05.19 19:31:25 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.05.19 19:31:25 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.05.19 19:21:33 | 000,000,000 | ---D | C] -- C:\Users\Su\AppData\Local\Spotify
[2013.05.19 19:19:36 | 000,000,000 | ---D | C] -- C:\Users\Su\AppData\Roaming\Spotify
[2013.05.19 10:28:16 | 000,000,000 | ---D | C] -- C:\Users\Su\AppData\Roaming\Meewr
[2013.05.19 10:28:16 | 000,000,000 | ---D | C] -- C:\Users\Su\AppData\Roaming\Loirhe
[2013.05.19 10:28:16 | 000,000,000 | ---D | C] -- C:\Users\Su\AppData\Roaming\Eneq
[2013.05.19 10:27:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Local Settings
[2013.05.13 21:35:52 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.04.22 16:57:53 | 000,000,000 | ---D | C] -- C:\Users\Su\Documents\Nokia Suite
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.21 21:14:19 | 000,015,168 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.21 21:14:19 | 000,015,168 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.21 21:11:48 | 001,480,602 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.21 21:11:48 | 000,647,376 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.21 21:11:48 | 000,610,094 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.21 21:11:48 | 000,127,404 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.21 21:11:48 | 000,104,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.21 21:06:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.21 21:06:00 | 4221,005,823 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.21 20:45:06 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.21 14:11:06 | 005,001,480 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.21 11:43:11 | 000,000,900 | ---- | M] () -- C:\Users\Su\Desktop\E-Mail Converter.lnk
[2013.05.21 11:40:19 | 006,518,472 | ---- | M] (IN MEDIA KG                                                 ) -- C:\Users\Su\Desktop\emc_setup.exe
[2013.05.20 21:09:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Su\Desktop\OTL.exe
[2013.05.19 20:36:12 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.19 20:36:12 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.19 19:21:32 | 000,001,795 | ---- | M] () -- C:\Users\Su\Desktop\Spotify.lnk
[2013.05.13 21:35:40 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.21 11:43:11 | 000,000,900 | ---- | C] () -- C:\Users\Su\Desktop\E-Mail Converter.lnk
[2013.05.19 19:21:32 | 000,001,795 | ---- | C] () -- C:\Users\Su\Desktop\Spotify.lnk
[2013.05.19 19:21:32 | 000,001,781 | ---- | C] () -- C:\Users\Su\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2013.03.18 16:16:10 | 000,000,058 | ---- | C] () -- C:\Windows\SysWow64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2013.03.18 16:16:10 | 000,000,058 | ---- | C] () -- C:\Users\Su\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2013.02.18 15:04:43 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\dlumd9.dll
[2013.02.18 15:04:43 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\dlumd11.dll
[2013.02.18 15:04:43 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\dlumd10.dll
[2012.12.12 16:21:34 | 000,044,544 | ---- | C] () -- C:\Windows\SysWow64\Gif89.dll
[2012.03.06 16:25:48 | 000,038,414 | ---- | C] () -- C:\Users\Su\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
[2012.03.06 12:19:47 | 000,038,421 | ---- | C] () -- C:\Users\Su\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2012.02.03 17:55:42 | 000,000,218 | ---- | C] () -- C:\Users\Su\.recently-used.xbel
[2012.01.31 19:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.01.31 19:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.01.31 19:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.01.31 19:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.01.31 19:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.01.18 21:49:49 | 000,221,184 | ---- | C] () -- C:\Windows\SysWow64\hp_nls.dll
[2011.08.06 19:33:40 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI
[2011.07.04 18:04:33 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011.06.29 13:30:33 | 001,500,444 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.17 22:24:49 | 000,000,132 | ---- | C] () -- C:\Users\Su\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.11 11:17:12 | 000,000,132 | ---- | C] () -- C:\Users\Su\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.03.24 19:46:00 | 000,001,456 | ---- | C] () -- C:\Users\Su\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2011.03.10 23:56:53 | 000,000,939 | ---- | C] () -- C:\Users\Su\RPSTD2010.lic
[2011.03.10 23:56:46 | 000,000,019 | ---- | C] () -- C:\Users\Su\rp.ini
[2011.01.15 15:30:59 | 000,059,392 | ---- | C] () -- C:\Users\Su\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.17 20:20:02 | 000,007,626 | ---- | C] () -- C:\Users\Su\AppData\Local\Resmon.ResmonCfg
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.06.16 01:07:10 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\CheckPoint
[2011.06.16 01:11:30 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Swiss Academic Software
[2011.06.16 13:04:52 | 000,000,000 | ---D | M] -- C:\Users\REJECTED\AppData\Roaming\CheckPoint
[2011.06.28 19:45:32 | 000,000,000 | ---D | M] -- C:\Users\REJECTED\AppData\Roaming\Swiss Academic Software
[2010.11.05 16:12:59 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Academic Software Zurich
[2013.04.05 21:33:45 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\AllDup
[2012.03.01 11:58:10 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\AquaSoft
[2012.03.10 01:03:01 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Audacity
[2012.01.21 15:12:44 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Avid
[2012.02.17 21:40:59 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Brorsoft
[2011.03.07 23:37:45 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\CAD-KAS
[2010.10.18 18:58:28 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.10.16 16:26:02 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\CheckPoint
[2012.05.27 20:15:39 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Cocoon Software
[2011.11.25 14:41:15 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\com.adobe.ResourceCentral
[2011.04.17 13:36:25 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\com.prezi.PreziDesktop
[2013.03.18 16:16:10 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\DonationCoder
[2013.05.21 08:21:17 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Dropbox
[2012.11.13 20:19:13 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\DVDVideoSoft
[2012.11.13 20:19:08 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\DVDVideoSoftIEHelpers
[2013.05.19 10:48:02 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Eneq
[2013.02.16 20:31:04 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\GHISLER
[2011.03.05 14:48:30 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Greyfirst
[2010.12.15 15:41:23 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Leadertech
[2011.07.20 17:02:00 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\LiteOn
[2013.05.19 10:28:23 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Loirhe
[2012.03.01 12:17:00 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\MAGIX
[2013.05.19 10:28:16 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Meewr
[2011.03.02 00:29:50 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\MPEG Streamclip
[2013.05.21 11:44:31 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\mresreg
[2012.03.06 02:27:31 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\MyPhoneExplorer
[2012.03.06 00:26:05 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Nokia
[2010.11.23 17:51:06 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Nokia Ovi Suite
[2012.03.06 01:14:48 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Nokia Suite
[2011.01.20 19:22:03 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\OpenOffice.org
[2012.01.21 15:11:43 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\PACE Anti-Piracy
[2012.05.27 18:09:53 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Pavtube
[2010.11.23 17:41:16 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\PC Suite
[2011.12.19 11:27:50 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\proDAD
[2011.03.24 01:10:13 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2012.03.06 12:34:04 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Samsung
[2011.03.02 16:04:25 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\SendSpace
[2013.05.21 21:09:40 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Spotify
[2010.10.16 17:54:50 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.02.14 14:58:03 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Swiss Academic Software
[2012.04.12 21:20:20 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Temp
[2013.03.01 18:23:35 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\uTorrent
[2012.01.31 19:17:20 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Workrave
[2010.12.15 15:42:07 | 000,000,000 | ---D | M] -- C:\Users\Su\AppData\Roaming\Xerox
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 959 bytes -> C:\Users\Su\AppData\Local\ReMysqOAQYu:I389lvEdyjtYF9F9rFamty
@Alternate Data Stream - 935 bytes -> C:\ProgramData\Microsoft:ZIXxybeinlH0b5xOdZmgDk1
@Alternate Data Stream - 1365 bytes -> C:\Program Files (x86)\Common Files\System:D9CsmnUWzKIv52cUcB5u1z
@Alternate Data Stream - 1288 bytes -> C:\ProgramData\Microsoft:vurc1UfghgWuWl8t4Hq5x
@Alternate Data Stream - 1254 bytes -> C:\ProgramData\Microsoft:nq4xNHE0blHN3OZwPtwUbfSc
@Alternate Data Stream - 1226 bytes -> C:\ProgramData\Microsoft:H2mp2ABrefCOb7GOoDJw
@Alternate Data Stream - 1182 bytes -> C:\ProgramData\Microsoft:OTMlZiK6oLIshwebRP1sVj
@Alternate Data Stream - 1167 bytes -> C:\ProgramData\Microsoft:iFnkJ6cJrmuhRIPbK9JStbMO
@Alternate Data Stream - 1124 bytes -> C:\Users\Su\AppData\Local\qBZxI5QsmN:Fe7Urji4DCH8hfWOXBFn2He6I
@Alternate Data Stream - 1116 bytes -> C:\Program Files\Common Files\System:4X8T5vKiUQZDhg4THw9a7vucb
@Alternate Data Stream - 1034 bytes -> C:\Users\Su\AppData\Local\WcLwzTHQJcGcSdI:5LVQvcOmzg2RFYHR87hk
@Alternate Data Stream - 1031 bytes -> C:\ProgramData\Microsoft:5p2KSbsXMEmchXslE6qMhPf44
@Alternate Data Stream - 1018 bytes -> C:\ProgramData\Microsoft:OlpQ5nWtpwksj1YiqCVhr2Yo3dBU

< End of report >