Trojaner "Gesellschaft zur Verfügung von Urheberrechtsverletzungen"

markusg · 28.05.2013, 18:40

Neustarten bitte.
HitmanPro - Download - Filepony

Hitmanpro laden, doppelklicken.
Auf Scan.
Nichts löschen.
Auf weiter, Log speichern.
BZW als XML exportieren.
Die dann posten, bzw packen und anhängen.

vtopy · 28.05.2013, 19:05

HitmanPro hat nichts gefunden:

Code:

ATTFilter


	Code: 

 ATTFilter

  
	HitmanPro 3.7.5.199
www.hitmanpro.com

   Computer name . . . . : SCHREIBMASCHINE
   Windows . . . . . . . : 6.1.1.7601.X64/2
   User name . . . . . . : Schreibmaschine\***
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-05-28 19:55:27
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 7m 43s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 90

   Objects scanned . . . : 1.475.316
   Files scanned . . . . : 20.366
   Remnants scanned  . . : 396.439 files / 1.058.511 keys

Cookies _____________________________________________________________________

   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\0CA2E44S.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\209J2X92.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\2GE2I8LY.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\7A1Q24I5.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\8HJC2XFJ.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\E3RCBI0X.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EBZJ2U71.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EPBZMR0D.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GN95FHG0.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GTX0H9FA.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\LI1KC75E.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\R70RIZY2.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\UQY3JT8H.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\XLYGRUP0.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\YNCQG47D.txt

markusg · 28.05.2013, 19:29

ok funde löschen, neustart, neues otl log.

vtopy · 28.05.2013, 19:40

Das Löschen ist fehlgeschlagen, sagt HitmanPro. Ist das tragisch? Soll ich trotzdem das otl-log machen?

markusg · 28.05.2013, 20:14

Hattest du alle Browser geschlossen? falls nein, versuchs mal, falls ja, müssten wir das auch mit OTL schaffen :-)

vtopy · 28.05.2013, 20:37

Auch mit geschlossenen Browsern funktioniert es nicht.
Das neue OTL:

Code:

ATTFilter

OTL logfile created on: 28.05.2013 21:25:48 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,68 Gb Total Physical Memory | 2,56 Gb Available Physical Memory | 69,69% Memory free
7,35 Gb Paging File | 6,12 Gb Available in Paging File | 83,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 284,99 Gb Total Space | 26,24 Gb Free Space | 9,21% Space Free | Partition Type: NTFS
 
Computer Name: SCHREIBMASCHINE | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.05.28 12:33:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.05.07 15:38:13 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.03.28 11:45:01 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.03.28 11:44:47 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.03.19 01:34:25 | 000,002,560 | ---- | M] () -- C:\Windows\Runservice.exe
PRC - [2013.03.12 09:05:50 | 029,106,336 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2011.05.12 08:04:12 | 000,723,560 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
PRC - [2011.04.24 04:29:20 | 000,256,832 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
PRC - [2011.04.24 04:28:38 | 000,297,280 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
PRC - [2011.04.22 19:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2011.04.19 09:01:34 | 000,419,408 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe
PRC - [2011.04.19 09:01:34 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2011.04.19 09:01:32 | 001,097,808 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2011.04.19 09:01:32 | 000,353,872 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.01.30 02:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
PRC - [2005.01.31 09:45:20 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2011.04.24 04:29:56 | 000,465,640 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.05.22 00:52:36 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.03.28 11:45:01 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.03.28 11:44:47 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.03.19 01:34:25 | 000,002,560 | ---- | M] () [Auto | Running] -- C:\Windows\Runservice.exe -- (LicCtrlService)
SRV - [2013.02.07 14:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.02.25 15:29:27 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2011.05.10 15:01:08 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2011.04.24 04:29:20 | 000,256,832 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2011.04.22 19:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.04.19 09:01:32 | 000,353,872 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2011.03.29 07:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.09.23 04:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.16 03:13:16 | 002,538,520 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.09.16 03:13:08 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.30 02:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2005.01.31 09:45:20 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.05.04 17:02:34 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2013.05.04 17:02:33 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2013.03.28 11:45:07 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.03.28 11:45:07 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.03.28 11:45:07 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.14 07:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.06.10 05:16:08 | 012,230,912 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.06.02 05:37:32 | 002,750,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011.05.10 06:42:16 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2011.03.28 05:44:46 | 001,417,776 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.03.10 06:01:45 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2011.03.10 06:01:45 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010.12.01 10:12:06 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.05 17:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.02.26 10:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.09.17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: helper%40savefrom.net:1.79
FF - prefs.js..extensions.enabledAddons: youtubeunblocker%40unblocker.yt:0.4.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.07.12 16:28:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.22 00:52:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.28 18:31:02 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.22 00:52:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.28 18:31:02 | 000,000,000 | ---D | M]
 
[2012.07.07 16:14:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2013.05.24 11:26:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ncbypbyq.default\extensions
[2013.04.05 16:58:50 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ncbypbyq.default\extensions\ich@maltegoetz.de
[2013.05.15 21:28:39 | 000,101,681 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\ncbypbyq.default\extensions\helper@savefrom.net.xpi
[2013.05.24 11:26:13 | 000,008,019 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\ncbypbyq.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2012.12.16 19:51:37 | 000,036,139 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\ncbypbyq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.05.09 16:53:07 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\ncbypbyq.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.05.22 00:52:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.22 00:52:37 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\USERS\RALF SCHÃ¶NFELDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NCBYPBYQ.DEFAULT\EXTENSIONS\HELPER@SAVEFROM.NET.XPI
File not found (No name found) -- C:\USERS\RALF SCHÃ¶NFELDER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NCBYPBYQ.DEFAULT\EXTENSIONS\YOUTUBEUNBLOCKER@UNBLOCKER.YT.XPI
 
O1 HOSTS File: ([2013.05.28 16:48:05 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [UVS10 Preload] C:\Program Files (x86)\Ulead VideoStudio 10\uvPL.exe (Ulead Systems, Inc.)
O4 - HKCU..\Run: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C2CDFC6-0DA1-463C-89A1-59E36D10B77A}: DhcpNameServer = 172.22.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DECCFAD8-1D1C-4A81-80F7-6AFB835FE184}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.28 19:54:46 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013.05.28 19:35:14 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.05.28 18:47:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.05.28 18:30:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2013.05.28 18:28:49 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.05.28 17:44:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013.05.28 17:44:56 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013.05.28 16:34:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.05.28 16:34:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.05.28 16:34:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.05.28 16:21:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.05.28 16:20:54 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.05.28 12:32:57 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.05.28 12:13:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2013.05.28 12:13:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.28 12:13:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.05.28 12:13:27 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.05.28 12:13:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.05.28 10:05:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{BE960C05-EB43-4F17-82F2-DC2171A06762}
[2013.05.27 10:00:54 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{8A24FF27-909D-43CA-B23F-0E651CEA0C37}
[2013.05.26 11:57:27 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{70B55D86-F18F-45F2-AA38-C226983AD6B1}
[2013.05.25 14:50:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{80CD9A1B-7CB6-4AC1-A49C-D444A9B6278C}
[2013.05.24 11:25:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A3CD1F48-A6BD-478A-BF5F-D44700F8FD67}
[2013.05.23 09:07:28 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5A2660A5-E07A-4471-A934-79F4E96370DC}
[2013.05.22 00:52:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.05.22 00:29:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{88B2E5AE-E51D-4715-9878-EF6E1F68CAD4}
[2013.05.21 11:43:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4207ABB0-1805-4BAD-92C2-B251A2BC0299}
[2013.05.20 19:14:49 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{ABF4ED34-7FC2-4B88-A52E-92C7D96BC88A}
[2013.05.15 10:45:28 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6F415FFF-0198-416C-8241-8FE31DF2A29D}
[2013.05.15 09:55:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A1411827-AFE7-4F45-A84A-CA0FCC7F6B3F}
[2013.05.14 14:11:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6AF18987-0C7D-4C10-BB41-CF68F046601E}
[2013.05.13 22:08:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{487E4C33-7739-48D2-A78C-F755D47AE2CE}
[2013.05.13 09:52:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{334BD2C4-3334-4A6E-A06C-EB858D38E881}
[2013.05.12 16:55:18 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E0C73AEB-065E-4AC4-AD27-83F5E9B2144E}
[2013.05.11 11:42:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{D2BDC13C-D0B3-4A08-9ACA-4B6EAD57EDD7}
[2013.05.10 10:03:30 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{64F77BCE-7D81-4FCC-9CA2-54C4F7E3ACE1}
[2013.05.09 12:21:05 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{8EFE75B8-988D-4BA6-A449-159706DA8C28}
[2013.05.08 14:29:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{309D653F-2D10-43A2-A1E0-6B06E00332A5}
[2013.05.08 14:28:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{EC7D15DB-B315-40BE-8309-22276B5BAF69}
[2013.05.07 22:41:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{DCFF68B4-0690-424A-9795-8051E7BA4A18}
[2013.05.07 15:39:06 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.05.07 09:39:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F4330BCA-FD91-47C1-9F53-16836D6B080A}
[2013.05.06 09:40:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{60DFAD30-973F-469F-9AFB-99BE44FAA6DC}
[2013.05.05 15:34:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9FEAF07E-4942-4B9E-B6D2-DCB91118D62A}
[2013.05.04 20:51:07 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4F9CA7E6-3718-48DD-856E-16383910B348}
[2013.05.04 17:07:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Risen
[2013.05.04 17:02:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2013.05.04 17:02:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies
[2013.05.04 17:02:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\AGEIA
[2013.05.04 17:02:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013.05.04 16:55:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Deep Silver
[2013.05.03 09:17:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5BFDE256-2DA9-40FC-BDCC-F5B35EB088ED}
[2013.05.02 21:00:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{09E38A5D-0B68-48C4-82AE-BD99836436D9}
[2013.05.02 14:10:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{CBF772A7-9AC2-49BA-91AE-4184B9DFD4B9}
[2013.05.02 10:11:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{8A343F5E-E6A3-4B91-8268-4C5ADF71DEDA}
[2013.05.02 09:49:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{59E680AF-63ED-4E00-A8AF-725CA13076EB}
[2013.05.01 11:49:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{3393BF22-EA44-41EB-9614-D3EC989EBB9D}
[2013.05.01 00:36:07 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{DAFD2228-145C-4C71-AFF6-62A443D11805}
[2013.04.30 12:33:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{CFC71369-5D00-4947-8B48-B13F5E9D626E}
[2013.04.29 12:41:19 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9C71E391-F19D-44B0-8D7A-A031F7FA07A6}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.28 21:31:24 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.28 21:31:24 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.28 21:24:02 | 000,000,358 | ---- | M] () -- C:\Windows\Ulead32.ini
[2013.05.28 21:23:43 | 000,000,857 | -HS- | M] () -- C:\Windows\SysWow64\mmf.sys
[2013.05.28 21:23:34 | 000,067,584 | -H-- | M] () -- C:\Windows\bootstat.dat
[2013.05.28 21:23:25 | 2960,412,672 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.28 19:34:41 | 000,449,048 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.28 16:48:05 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.05.28 12:57:52 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.28 12:57:52 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.28 12:57:52 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.28 12:57:52 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.28 12:57:52 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.28 12:33:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.05.28 11:36:57 | 000,000,004 | ---- | M] () -- C:\Users\***\AppData\Roaming\skype.ini
[2013.05.07 15:38:52 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.05.04 17:02:34 | 000,314,016 | ---- | M] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2013.05.04 17:02:33 | 000,043,680 | ---- | M] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.28 18:31:02 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013.05.28 16:34:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.05.28 16:34:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.05.28 16:34:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.05.28 16:34:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.05.28 16:34:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.05.28 11:28:27 | 000,000,004 | ---- | C] () -- C:\Users\***\AppData\Roaming\skype.ini
[2013.05.04 17:02:34 | 000,314,016 | ---- | C] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2013.05.04 17:02:33 | 000,043,680 | ---- | C] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[2013.04.21 18:03:36 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2013.04.03 13:43:05 | 000,010,495 | ---- | C] () -- C:\Users\***\vtopy_elster_2048.pfx
[2013.03.19 01:34:25 | 000,048,640 | ---- | C] () -- C:\Windows\mmfs.dll
[2013.03.19 01:34:25 | 000,002,560 | ---- | C] () -- C:\Windows\Runservice.exe
[2013.03.19 01:34:25 | 000,000,857 | -HS- | C] () -- C:\Windows\SysWow64\mmf.sys
[2012.12.09 20:32:44 | 000,017,408 | ---- | C] () -- C:\Users\***\AppData\Local\WebpageIcons.db
[2012.11.24 04:25:24 | 000,005,081 | ---- | C] () -- C:\ProgramData\hnbdehzc.pfe
[2012.11.12 12:34:30 | 794,917,018 | ---- | C] () -- C:\Users\***\SaS - Oct 19, 2012 - Penny Pax and Danny Wylde (25842).wmv
[2012.07.12 17:29:15 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.07.12 17:29:15 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.07.12 17:16:52 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012.07.12 15:44:36 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\Iyvu9_32.dll
[2012.07.12 15:39:51 | 000,000,358 | ---- | C] () -- C:\Windows\Ulead32.ini
[2012.07.07 18:11:55 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.07.07 16:04:59 | 000,001,104 | ---- | C] () -- C:\Users\***\AppData\Roaming\AbsoluteReminder.xml
[2012.01.10 13:43:17 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2012.01.10 13:42:44 | 000,867,020 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2012.01.10 13:42:42 | 000,105,608 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2012.01.10 13:42:41 | 013,906,944 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.01.10 13:42:41 | 000,128,204 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.04.22 15:05:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DL
[2013.05.28 21:24:11 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2013.04.02 22:21:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2013.03.22 16:21:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular
[2012.11.24 04:11:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FreeFLVConverter
[2012.07.07 17:46:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lingo4u
[2013.05.27 23:24:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2012.07.08 13:27:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer
[2013.01.11 15:46:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xm1
 
========== Purity Check ==========
 
 

< End of report >

markusg · 28.05.2013, 20:43

Hi,

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
:files
:Commands
[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

schau mal, ob Hitmanpro noch was findet, wenn ja, Log noch mal posten.

vtopy · 28.05.2013, 21:07

Der Fix ist geschmeidig durchgelaufen.
Log:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: ***
->Temp folder emptied: 3010436 bytes
->Temporary Internet Files folder emptied: 9427011 bytes
->Java cache emptied: 1290533 bytes
->FireFox cache emptied: 294501452 bytes
->Flash cache emptied: 88220 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2899724 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 297,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05282013_215528

Files\Folders moved on Reboot...
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\***\AppData\Local\Temp\MMDUtl.log moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\LMutilps32.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

HitmanPro kommt leider zum gleichen Ergebnis:

Code:

ATTFilter


	Code: 

 ATTFilter

  
	HitmanPro 3.7.5.199
www.hitmanpro.com

   Computer name . . . . : SCHREIBMASCHINE
   Windows . . . . . . . : 6.1.1.7601.X64/2
   User name . . . . . . : Schreibmaschine\***
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-05-28 21:59:07
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 7m 7s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 90

   Objects scanned . . . : 1.465.815
   Files scanned . . . . : 18.469
   Remnants scanned  . . : 388.668 files / 1.058.678 keys

Cookies _____________________________________________________________________

   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\0CA2E44S.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\209J2X92.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\2GE2I8LY.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\7A1Q24I5.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\8HJC2XFJ.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\E3RCBI0X.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EBZJ2U71.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EPBZMR0D.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GN95FHG0.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GTX0H9FA.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\LI1KC75E.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\R70RIZY2.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\UQY3JT8H.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\XLYGRUP0.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\YNCQG47D.txt

markusg · 28.05.2013, 21:13

hattest du das Hitmanpro log nach neustart erstellt?
mach mal ne Datenträgerbereinigung:
Löschen von Dateien mithilfe der Datenträgerbereinigung
aktiviere dort alles, und dann starte sie, dann pc neustarten und noch mal Hitmanpro laufen lassenb

vtopy · 28.05.2013, 21:39

Die Datenträgerbereinigung wurde durchgeführt, neu gestartet, aber HitmanPro ist immer noch nicht zufrieden ...

Code:

ATTFilter


	Code: 

 ATTFilter

  
	HitmanPro 3.7.5.199
www.hitmanpro.com

   Computer name . . . . : SCHREIBMASCHINE
   Windows . . . . . . . : 6.1.1.7601.X64/2
   User name . . . . . . : Schreibmaschine\***
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-05-28 22:30:54
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 6m 41s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 75

   Objects scanned . . . : 1.464.768
   Files scanned . . . . : 18.480
   Remnants scanned  . . : 387.564 files / 1.058.724 keys

Cookies _____________________________________________________________________

   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\0CA2E44S.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\209J2X92.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\2GE2I8LY.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\7A1Q24I5.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\8HJC2XFJ.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\E3RCBI0X.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EBZJ2U71.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EPBZMR0D.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GN95FHG0.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GTX0H9FA.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\LI1KC75E.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\R70RIZY2.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\UQY3JT8H.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\XLYGRUP0.txt
   C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\YNCQG47D.txt

markusg · 28.05.2013, 21:44

ok dann leere den Ordner mal per hand:
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies
wenn das nicht klappt, so wichtig ists auch nicht, teste dann einfach, wie oben angefordert, wie der pc läuft

vtopy · 28.05.2013, 22:20

Seltsam. Habe den Ordner per Hand geleert, HitmanPro zeigt weiter die selben Dateien an.
Wie genau soll ich nun testen, wie der PC läuft? Bin mir nicht sicher, worauf Du dich beziehst.

markusg · 29.05.2013, 10:46

browser testen wies oben steht, allgemein schauen ob dir was auffällt.

vtopy · 29.05.2013, 14:15

Tut mir leid, ich stehe auf dem Schlauch. Was den Browser angeht, ging es bisher nur darum, dass ich ihn ausschalten soll, wenn HitmanPro läuft. Also, falls Du dich darauf beziehst, wenn Du "oben" schreibst, dann habe ich das getan: mit dem selben Ergebnis.
Ansonsten fällt mir nichts Ungewöhnliches auf.

markusg · 29.05.2013, 16:07

a sorry, mein Fehler.
bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.

28.05.2013, 19:29	#18
markusg /// Malware-holic	Trojaner "Gesellschaft zur Verfügung von Urheberrechtsverletzungen" ok funde löschen, neustart, neues otl log. __________________ __________________

Trojaner "Gesellschaft zur Verfügung von Urheberrechtsverletzungen"

Plagegeister aller Art und deren Bekämpfung: Trojaner "Gesellschaft zur Verfügung von Urheberrechtsverletzungen"