Hallo Community,

ich bin mir nicht sicher ob ich hier richtig bin, aber wie der Titel schon sagt habe ich Probleme mit meinem PC - Windows Vista.

Ich selbst habe auf meinem Laptop Kaspersky und leider schaffe ich es nicht die genannten Probleme zu beseitigen. Da ich mich mit dem Thema nicht auskenne kann ich auch nicht genau sagen, ob mein Windows mehr Tjoaner & Co. hat.


Gesucht habe ich in diesem Forum eine weile, finde allerdings nur ältere Beiträge und abgelaufene Links.


Ich wäre euch sehr dankbar, wenn ihr mir helfen könntet - bitte nicht im bekannten Fach-Chinesisch.

Gruß Bernhard

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
  Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
• Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
• Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
• Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
  Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
  Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
  Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen.

Habe dein Thema in den richtigen Bereich verschoben.

Servus,



so gehts los:




Schritt 1
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden).

• Starte bitte die OTL.exe.
• Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Standard Ausgabe.
• Setze einen Haken bei Scanne alle Benutzer.
• Unter Extra Registry, wähle bitte Use SafeList.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

activex
msconfig
CREATERESTOREPOINT
         

• Schließe bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Scan Button.
• Am Ende des Suchlaufs werden 2 Logdateien erstellt.
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Schritt 2
Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

• Starte das Tool mit Doppelklick.
• Klicke nun auf den Disable Button, um die Treiber gewisser Emulatoren zu deaktivieren.
• Defogger wird dich fragen "Defogger will forcefully terminate and disable all CD Emulator related drivers and processes... Continue?" bestätige diese Sicherheitsabfrage mit Ja.
• Wenn der Scan beendet wurde (Finished), klicke auf OK.
• Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
• Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.log. Poste deren Inhalt mit deiner nächsten Antwort.

Klicke den Re-enable Button nicht ohne Anweisung!





Schritt 3
Bitte lade dir GMER herunter: (Dateiname zufällig)

• Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
• Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:

  WARNING !!!
  GMER has found system modification, which might have been caused by ROOTKIT activity.
  Do you want to fully scan your system ?
  

  Unbedingt auf "No" klicken.
• Entferne rechts den Haken bei: IAT/EAT und Show All
• Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
• Starte den Scan mit "Scan".
• Mache nichts am Computer während der Scan läuft.
• Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Tauchen Probleme auf?

• Probiere alternativ den abgesicherten Modus.
• Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.

Bitte poste mit deiner nächsten Antwort

• die beiden Logdateien von OTL,
• die Logdatei von DeFogger,
• die Logdatei von GMER.

SCHRITT 1 OTL:
OTL Logfile:
OTL EXTRAS Logfile:

OTL logfile created on: 01.06.2013 14:56:11 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Gross\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 57,04% Memory free
6,20 Gb Paging File | 4,61 Gb Available in Paging File | 74,38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,32 Gb Total Space | 169,98 Gb Free Space | 58,96% Space Free | Partition Type: NTFS
 
Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.01 14:52:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gross\Desktop\OTL.exe
PRC - [2013.03.22 16:09:37 | 002,787,280 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
PRC - [2012.12.14 13:45:40 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.06.23 17:19:14 | 000,711,200 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerTray.exe
PRC - [2009.06.23 17:19:14 | 000,707,104 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerSvc.exe
PRC - [2009.06.23 17:19:12 | 000,453,152 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerEvent.exe
PRC - [2009.05.26 15:26:20 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.18 10:46:30 | 001,160,736 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\SetupMyPC\SmpSys.exe
PRC - [2009.03.07 00:48:52 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared files\brs.exe
PRC - [2009.02.19 05:42:50 | 000,866,824 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe
PRC - [2009.02.01 08:43:30 | 000,049,250 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\Apoint2K\Hidfind.exe
PRC - [2008.11.06 05:53:58 | 000,474,168 | ---- | M] (Conexant Systems, Inc.) -- C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe
PRC - [2008.10.17 10:44:58 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.09.11 01:45:04 | 000,124,832 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.03.22 16:09:37 | 002,787,280 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
MOD - [2013.03.22 16:08:36 | 002,520,016 | ---- | M] () -- c:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll
MOD - [2012.08.17 21:40:16 | 000,068,024 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\QtWebKit\qmlwebkitplugin4.dll
MOD - [2012.08.17 21:38:56 | 000,479,160 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.08.16 18:06:02 | 000,141,312 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2003.06.07 23:30:08 | 000,057,344 | ---- | M] () -- C:\Programme\Launch Manager\PowerUtl.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (gupdate1cac2454df83dc4)
SRV - [2013.06.01 14:33:57 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.23 20:23:12 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.03.22 16:09:37 | 002,787,280 | ---- | M] () [Auto | Running] -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2012.12.14 13:45:40 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.23 17:19:14 | 000,707,104 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009.05.26 15:26:20 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.03.25 19:52:50 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.11 01:45:04 | 000,124,832 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwrchid.sys -- (btwrchid)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwavdt.sys -- (btwavdt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2013.05.12 12:20:37 | 000,145,040 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kneps.sys -- (kneps)
DRV - [2013.05.12 12:20:36 | 000,594,528 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2013.05.12 12:20:36 | 000,044,432 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kltdi.sys -- (kltdi)
DRV - [2012.12.14 13:45:34 | 000,025,944 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2012.12.14 13:45:34 | 000,025,944 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klkbdflt.sys -- (klkbdflt)
DRV - [2012.08.02 15:09:30 | 000,024,408 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2012.06.19 17:28:12 | 000,136,024 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\kl1.sys -- (kl1)
DRV - [2011.05.10 08:06:14 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2009.06.22 15:50:00 | 009,753,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.05.25 05:50:50 | 000,203,824 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2009.05.01 07:43:34 | 000,064,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009.03.30 05:43:02 | 001,124,864 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.03.17 20:28:50 | 000,452,096 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2009.03.06 14:48:38 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/09/28 08:31:56] [Kernel | Auto | Running] -- c:\Programme\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
DRV - [2008.09.04 06:12:56 | 000,223,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x)
DRV - [2008.01.21 04:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0909&m=easynote_tj65
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.holasearch.com/?affID=121962&tt=gc_&babsrc=HP_ss&mntrId=0E150CEEE680D95C
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0909&m=easynote_tj65
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.holasearch.com/?q={searchTerms}&affID=121962&tt=gc_&babsrc=SP_ss&mntrId=0E150CEEE680D95C
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\..\SearchScopes\{B6D76258-1AD5-4C5C-85A6-CE11356D7C86}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACPW_deDE353
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.order.1: "Hola Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA%402020Technologies.com:5.0.94.0
FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\Gross\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.03.19 16:12:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013.05.12 12:20:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013.05.12 12:20:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013.05.12 12:20:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013.05.12 12:20:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013.05.12 12:20:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.23 20:23:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.06.01 13:53:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.03.19 16:12:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.23 20:23:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.06.01 13:53:21 | 000,000,000 | ---D | M]
 
[2012.03.14 18:35:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gross\AppData\Roaming\mozilla\Extensions
[2013.05.26 15:57:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gross\AppData\Roaming\mozilla\Firefox\Profiles\pwd0s67d.default\extensions
[2013.05.26 11:40:43 | 000,006,498 | ---- | M] () -- C:\Users\Gross\AppData\Roaming\mozilla\firefox\profiles\pwd0s67d.default\searchplugins\babylon.xml
[2013.05.26 11:40:43 | 000,006,498 | ---- | M] () -- C:\Users\Gross\AppData\Roaming\mozilla\firefox\profiles\pwd0s67d.default\searchplugins\BrowserProtect.xml
[2013.05.26 11:41:25 | 000,001,304 | ---- | M] () -- C:\Users\Gross\AppData\Roaming\mozilla\firefox\profiles\pwd0s67d.default\searchplugins\holasearch.xml
[2013.05.23 20:23:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.05.23 20:23:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2013.05.23 20:23:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.05.23 20:23:14 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.05.12 12:20:57 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerTrayLauncher.exe (Acer Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [BDRegion] c:\Programme\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3343815118-449700181-1052238350-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 File not found
O4 - HKU\S-1-5-21-3343815118-449700181-1052238350-1000..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe File not found
O4 - HKU\S-1-5-21-3343815118-449700181-1052238350-1000..\Run: [SmpcSys] C:\Programme\Packard Bell\SetupMyPC\SmpSys.exe (Acer Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.17.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CE98DAD6-890E-40D1-8DA8-86FBE2197C38}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FACE51E9-2200-43CD-9AE2-9AA371276FD6}: DhcpNameServer = 193.189.244.225 193.189.244.206
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Gross\Pictures\Dies&Das\Unbenanntaa.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gross\Pictures\Dies&Das\Unbenanntaa.jpg
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{21e5fba3-e0b5-11de-b199-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{21e5fba3-e0b5-11de-b199-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5d022050-d802-11de-9a1c-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{5d022050-d802-11de-9a1c-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5d02208c-d802-11de-9a1c-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{5d02208c-d802-11de-9a1c-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8c5a1b73-ddd7-11de-b5a9-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{8c5a1b73-ddd7-11de-b5a9-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b859b8f3-de38-11de-8f43-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{b859b8f3-de38-11de-8f43-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d14339d0-cef3-11de-8f64-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{d14339d0-cef3-11de-8f64-00262d50b6c2}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.01 14:52:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Gross\Desktop\OTL.exe
[2013.06.01 14:33:57 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.06.01 14:33:57 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.06.01 14:02:56 | 000,000,000 | R--D | C] -- C:\Users\Gross\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
[2013.06.01 13:24:50 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{56D8B14C-31B2-49D3-8FC2-09FE3BB6283C}
[2013.05.31 18:35:52 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{9914A269-A0C2-42A4-9FC2-047B7CC7DC0D}
[2013.05.30 13:09:32 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{026402E5-0F9A-453B-949E-13388D69F9E2}
[2013.05.29 18:28:34 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{A835DD17-4053-4B6B-B284-C200CC226242}
[2013.05.28 16:33:45 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{F57F51F4-CC11-4E37-B659-E0A83C1A098A}
[2013.05.27 20:04:07 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{26236FC2-167B-4C8E-862D-71AE97DF791C}
[2013.05.26 15:42:30 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.05.26 15:38:11 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.05.26 15:37:36 | 000,000,000 | ---D | C] -- C:\JRT
[2013.05.26 14:55:09 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{81C6BF93-118A-4B42-BAC6-4B41E7680F57}
[2013.05.26 14:52:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.05.26 14:52:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.05.26 11:45:49 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\LogicCircuit
[2013.05.26 11:35:52 | 000,000,000 | ---D | C] -- C:\Program Files\Iminent
[2013.05.26 11:34:55 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
[2013.05.26 11:34:47 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect
[2013.05.26 11:34:11 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Roaming\PerformerSoft
[2013.05.26 11:34:11 | 000,000,000 | ---D | C] -- C:\ProgramData\IBUpdaterService
[2013.05.26 11:34:05 | 000,018,096 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe
[2013.05.26 11:33:57 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Roaming\Babylon
[2013.05.26 11:33:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013.05.25 16:32:46 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{D8870CF8-9795-4D84-AC56-BC5816EC101F}
[2013.05.24 16:22:33 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{3751826A-476A-4CB8-A99D-5220D51A423C}
[2013.05.23 20:22:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.05.23 19:06:45 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{C69C70BD-BE90-4F72-B232-970827BB3A34}
[2013.05.21 19:31:49 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{DE3F4E77-E5D0-4B81-B668-192F2DAF771C}
[2013.05.20 14:40:52 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{A890BB69-2BE4-40CF-A450-FA017542FCB9}
[2013.05.19 14:58:39 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{A0DDE1B6-1B75-4E4C-8BF9-3EF8BBC8D06A}
[2013.05.17 18:08:55 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{A2C23713-FCAC-46CF-8FD6-1DC0E65C4893}
[2013.05.17 16:40:19 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{70A71323-9D86-410C-9E09-F37806160AEC}
[2013.05.16 16:22:45 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.05.16 16:11:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.05.16 16:11:32 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.05.16 16:11:32 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.05.16 16:11:31 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.05.16 16:11:30 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.05.16 16:11:30 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.05.16 16:11:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.05.16 16:06:28 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{294DE48E-57FC-432D-9B56-5D6340B29D17}
[2013.05.15 20:33:42 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.05.15 20:33:33 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.05.15 20:24:48 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{46A4751C-860D-4330-8910-B9DB1F3490AB}
[2013.05.12 17:33:34 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{71F4E25E-D76E-4632-9460-3BF51B02332B}
[2013.05.12 12:04:01 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{E26C5FF9-1A02-4226-B54A-26C6C1B76BC0}
[2013.05.11 14:02:59 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{95FE7681-C55D-4BEA-9486-28AF569B449C}
[2013.05.11 13:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013
[2013.05.11 13:29:18 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{361F1B37-BB9E-4F21-8C91-FB8E0E53FB90}
[2013.05.11 09:43:39 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{1A3CC48E-E025-4BBA-AC64-FE6F4D95A9DC}
[2013.05.10 12:14:34 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{1D24A4A9-9D24-4597-879D-DF81991F23FF}
[2013.05.10 00:13:58 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{042717CB-B8F8-4E46-8C02-820C70B38BC2}
[2013.05.08 15:54:55 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{B5E1A42D-F3BB-4FBE-AF07-C52AEADBD694}
[2013.05.07 19:48:33 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{9028E68F-64EA-4A52-9CE1-E21034850EA1}
[2013.05.06 19:57:25 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{DB452A7E-2571-4690-BDF1-01F8114453EE}
[2013.05.05 19:17:55 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{E8DD6A21-F398-4072-A6D0-FA56128FE01A}
[2013.05.04 10:51:56 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\{0B0B2C61-7D84-4096-B338-2AC13923F83B}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.01 14:52:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gross\Desktop\OTL.exe
[2013.06.01 14:44:57 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.01 14:33:57 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.06.01 14:33:57 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.06.01 14:02:45 | 000,060,275 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013.06.01 14:02:35 | 000,060,275 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013.06.01 14:02:29 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.01 14:02:29 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.01 14:02:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.01 14:02:16 | 3215,908,864 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.01 14:00:51 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.05.31 18:56:24 | 002,062,259 | ---- | M] () -- C:\Users\Gross\Desktop\IMG_3393.JPG
[2013.05.26 11:56:08 | 000,000,862 | ---- | M] () -- C:\Windows\System32\InstallUtil.InstallLog
[2013.05.23 20:31:37 | 000,628,992 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.23 20:31:37 | 000,596,246 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.23 20:31:37 | 000,126,704 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.23 20:31:37 | 000,104,320 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.16 18:56:18 | 000,352,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.12 17:34:03 | 000,002,123 | ---- | M] () -- C:\Users\Gross\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.05.12 12:20:37 | 000,145,040 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\kneps.sys
[2013.05.12 12:20:36 | 000,594,528 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\klif.sys
[2013.05.12 12:20:36 | 000,074,848 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\klflt.sys
[2013.05.12 12:20:36 | 000,044,432 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\kltdi.sys
[2013.05.11 13:43:42 | 000,001,025 | ---- | M] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.05.11 10:34:31 | 000,386,623 | ---- | M] () -- C:\Users\Gross\Documents\Unbenannt (4).wma
[2013.05.09 12:28:50 | 002,377,313 | ---- | M] () -- C:\Users\Gross\Desktop\IMG_3277.JPG
[2013.05.09 11:59:59 | 002,278,644 | ---- | M] () -- C:\Users\Gross\Desktop\IMG_3276.JPG
[2013.05.05 21:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.01 14:34:01 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.31 18:56:15 | 002,062,259 | ---- | C] () -- C:\Users\Gross\Desktop\IMG_3393.JPG
[2013.05.26 11:36:16 | 000,000,862 | ---- | C] () -- C:\Windows\System32\InstallUtil.InstallLog
[2013.05.12 17:40:05 | 002,377,313 | ---- | C] () -- C:\Users\Gross\Desktop\IMG_3277.JPG
[2013.05.12 17:40:02 | 002,278,644 | ---- | C] () -- C:\Users\Gross\Desktop\IMG_3276.JPG
[2013.05.11 14:04:15 | 000,002,123 | ---- | C] () -- C:\Users\Gross\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.05.11 13:48:07 | 000,001,025 | ---- | C] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.05.11 10:34:31 | 000,386,623 | ---- | C] () -- C:\Users\Gross\Documents\Unbenannt (4).wma
[2012.02.26 19:31:12 | 000,001,024 | ---- | C] () -- C:\Users\Gross\.rnd
[2012.02.26 19:30:51 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini
[2012.02.20 23:13:30 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.10.16 17:50:11 | 000,044,838 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\UserTile.png
[2010.02.03 09:26:50 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.11.11 21:19:58 | 000,013,824 | ---- | C] () -- C:\Users\Gross\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.11 18:54:52 | 000,003,248 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\wklnhst.dat
[2009.09.28 08:20:41 | 000,060,275 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.09.28 08:19:07 | 000,060,275 | ---- | C] () -- C:\ProgramData\nvModes.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
         

--- --- ---

--- --- ---
OTL EXTRAS Logfile:

OTL Extras logfile created on: 01.06.2013 14:56:11 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Gross\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 57,04% Memory free
6,20 Gb Paging File | 4,61 Gb Available in Paging File | 74,38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,32 Gb Total Space | 169,98 Gb Free Space | 58,96% Space Free | Partition Type: NTFS
 
Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01464E45-F7B5-4F8C-A84C-4622C3D67FB8}" = rport=138 | protocol=17 | dir=out | app=system | 
"{12996536-73A8-4453-A5DA-CD205B0836F6}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{1409B7AD-D536-49F4-A8FC-761CFDE959C5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{16A6541F-633E-4220-B0E9-8334D1D0AFAA}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{18C63752-3021-47CA-873A-01359E6FAD82}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{44FE9174-9F3C-451B-83A0-C37E3D08A233}" = lport=137 | protocol=17 | dir=in | app=system | 
"{552C1AFB-1596-4269-80FC-EA9A77E34820}" = lport=445 | protocol=6 | dir=in | app=system | 
"{55C6BD14-9217-4F63-93AF-B3AAE4242B3B}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{5F4F396F-48E0-4A1D-A473-BF910A9E7B78}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6B3BEB85-87B6-4F48-951B-4722EE56E49C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{6E65FF5D-01E7-4CCD-8568-48B1C3654C64}" = rport=139 | protocol=6 | dir=out | app=system | 
"{9EFABD56-7EEC-4026-A6AB-18431955659E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A1EE2027-E97B-4826-82D7-5929E7255B72}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B4852F84-3C79-455F-8A6F-DD4F9A8842FA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B7CB6A3D-0887-4E7C-ADD8-B89D9F8E7A66}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C26BF341-95ED-478F-8BDE-B43F91A02A34}" = lport=139 | protocol=6 | dir=in | app=system | 
"{D2C4DD8F-4910-4032-A3A2-68A41D57CA8F}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{D8D8B8D3-7948-427A-B213-6FB7F9404F5C}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{DD88B2A4-D893-42A5-9BC5-4269AA6FD6A2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{DEE26831-8DF3-456B-84D7-FDA35AC0523C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{ECFFF5F0-21D6-4FA6-AF7D-65B602389C24}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FC6A611E-FC74-4D65-88D4-B4F7052F4BCA}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{014A6003-92BE-473B-838E-6BACFF9EF414}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{02C8F669-3BF2-45AD-998A-A490E0384591}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{0A6ECA7E-3445-4D9C-93E0-5B2B06FA1BA2}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | 
"{0B1AB39B-30EA-4E57-B09B-369032C9ECC6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{0E9E13B4-58A7-4FD8-BD8F-BDCC49CAF8B2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{103ED349-F5C7-4A8B-95A1-E671FAFEA637}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{1261708B-5E71-4DB3-AE02-EB5B6B6A0E5E}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{1472DDBE-8F15-46EF-8001-3560FD965224}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{1559C067-0AFF-47BD-A165-A0D78AC6BD48}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2AF2A102-FDE8-4321-8248-F60FEBDF5018}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{30D38BE6-D7AD-4454-994A-6AA1F35261DE}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{32291547-78A8-4851-8459-7A5408965189}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{3876889C-AB6C-4CFD-9762-C431F08C1A49}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{38893A20-1389-402A-ABFF-2D299F7317A3}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{3B8BB51E-C465-4D72-849F-D7CC70DF7D0B}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3E9C8112-62AF-4C2A-9AFA-5F7E0F28EC3C}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{4C8B5F4D-2746-4815-909D-3C9C9FA4CDED}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4D5283E5-73F5-4909-8251-48DE3A194284}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{5377F1A6-43B1-4FDC-88C6-82A609C62139}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{54324804-A75D-4055-B6F3-954344EF5917}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{5575C0C1-739E-48E3-9F59-4B5F05424148}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{5C23CE3A-EC71-4B69-BAB0-52B12E4E6425}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{6008AAA7-F6D3-486D-B574-82C1890ECC98}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{6318114D-CA74-461C-907D-3A4F80ADC389}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{6666E796-B1BB-4BB8-88BC-7717F5B901EB}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{66C3FB2F-F0DF-4F0A-B424-F509F0A1EDF4}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{6DDCB517-6977-4806-95D5-302CD36CA205}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{7037D8B4-5AAF-40F4-8DE0-276132096DBE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{86343E94-1DD8-4482-B8C3-EC7FD36F4F95}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{86AC755E-2777-427D-88F2-47BFF8B6C21E}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{86EFCF8B-05A9-4A9A-B43E-5331929FF5EF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{8E1EE149-E008-4B6F-B699-41129B3BE269}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{966091FC-D443-4770-9A39-873C8B15903D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{97312977-5C28-4D7E-82B6-6FA1923349A7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{A943412F-FC47-4D77-8813-89630000E9F1}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{B1DCB529-635B-4249-A5CC-00C0EC8D7C54}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{B26A2CB3-97B4-4EC1-B93E-34C979D155C6}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{BA3E94AD-D898-42AD-B24B-0B67CC4D448B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{BA504E98-ACCD-47BB-AB84-E3FBEF2B259D}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{BCAE4B72-A9A9-4F58-A201-BD3778137167}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{BE0A69DE-7D67-460D-A3AE-F9D703AE1E5B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\polnik\counter-strike\hl.exe | 
"{BE1229CF-E6B9-4ADA-9375-871C323F27F5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\polnik\counter-strike\hl.exe | 
"{BE7E3AC4-40B5-4D1A-B3F6-FFA11F9CFD1C}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{BE99AB80-F195-4BAE-8333-C78CA1520E34}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{BF5B8ED8-9CA5-403B-9EA8-61E6670519BB}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{C95DF809-3047-4F29-AA15-8683EB6EC59B}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{CAA0874C-9BC6-4FDF-A166-53F73ED905FD}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{CB8743D1-450D-4A8E-B768-B4932283630A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{CC03E1B7-8635-4C43-92EA-2559B7AE97D8}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{DB6E9BD2-091C-4008-A2DB-13FE44FF569D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E62F38E3-C7D3-4374-B398-C5F46394DF49}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{EC60A95C-63A6-494D-853C-4E57855AEE4E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{EF1D5EFE-A411-4BEA-B917-F29D96DD342E}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{F09057FF-F203-494B-97C8-8998291A033B}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{F4F2A5E7-220D-4633-BEBC-28F35BBA6D14}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F55FAE31-A2C4-4CA8-9D2F-A41B92687441}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{F8721641-F293-48AE-9C72-0AAF781417B7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{FF9E2DF9-EA36-4363-A5DD-A172CC54CF60}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0A042C19-1F48-4952-B3B6-828E8028A187}" = B209a-m
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{12A1B519-5934-4508-ADBD-335347B0DC87}" = Video Web Camera
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserProtect
"{15F02176-0D12-4FAF-B2CD-2767C7781427}" = Google SketchUp 8
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell PowerSave Solution
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{545DF825-0A9A-499F-B9A8-2A1A355ED7FC}" = PhoenixRC
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5DDB3393-E08B-447E-925F-6C00B95D0FE7}" = iCloud
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9AF0B106-56F1-461B-A270-95BC1682E282}" = Broadcom Gigabit NetLink Controller
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FEF1A18-8F26-4F49-A5A4-956C12210624}" = HP Photosmart Plus B209a-m All-In-One Driver Software 13.0 Rel .6
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B65759DD-26C6-4EA6-9014-CA798907EBFD}" = PS_AIO_06_B209a-m_SW_Min
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"FL Studio_is1" = FL Studio v7.0
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.0.128
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"Identity Card" = Identity Card
"Infocenter" = Infocenter
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Packard Bell MyBackup
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Packard Bell Customer Registration" = Packard Bell Customer Registration
"PackardBell Screensaver" = PackardBell ScreenSaver
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"rgcAudio z3ta Plus v1.40" = rgcAudio z3ta Plus v1.40
"SetupMyPC" = SetupMyPC
"Shop for HP Supplies" = Shop for HP Supplies
"Uninstall_is1" = Uninstall 1.0.0.1
"Updator" = Updator
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Protect Disc License Helper" = Protect Disc License Helper 1.0.125 (IE)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.06.2013 07:23:53 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 07:23:53 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 07:23:53 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 07:23:53 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 07:26:27 | Computer Name = Gross-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ePowerTray.exe, Version 4.1.3016.0, Zeitstempel
 0x4a409dcb, fehlerhaftes Modul ePowerTray.exe, Version 4.1.3016.0, Zeitstempel 
0x4a409dcb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ca46,  Prozess-ID 0x13b8, 
Anwendungsstartzeit 01ce5ebaa0230a5a.
 
Error - 01.06.2013 08:03:22 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 08:03:22 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksCal.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 08:03:22 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 08:03:22 | Computer Name = Gross-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe".
Die
 abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.06.2013 08:04:04 | Computer Name = Gross-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ePowerTray.exe, Version 4.1.3016.0, Zeitstempel
 0x4a409dcb, fehlerhaftes Modul ePowerTray.exe, Version 4.1.3016.0, Zeitstempel 
0x4a409dcb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ca46,  Prozess-ID 0x11d0, 
Anwendungsstartzeit 01ce5ec018cbb533.
 
[ System Events ]
Error - 01.06.2013 07:24:53 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 07:24:53 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 07:53:18 | Computer Name = Gross-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 01.06.2013 07:53:18 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 01.06.2013 07:53:18 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 08:03:34 | Computer Name = Gross-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 01.06.2013 08:03:54 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 08:03:54 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 08:44:48 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 01.06.2013 08:44:48 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---



SCHRITT 2 DEFOGGER


defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:21 on 01/06/2013 (Gross)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


Von Defogger ist allerdings noch ein Fenster offen, dass ich erstmal so belasse:

"Defogger is a tool to disable CD Emulator. Drivers that interfere with Anti-Rootkit programs and other Anti-Malware tools.
It you are using this in conjunction with assistance from a Malware Removal professional, please wait until they have finished assisting you before clicking Re-enable.


SCHRITT 3 GMER:


GMER Logfile:

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-01 15:54:21
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Gross\AppData\Local\Temp\fgloqpoc.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwAdjustPrivilegesToken [0x9A4786BA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwAlpcConnectPort [0x9A42BC02]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwAlpcCreatePort [0x9A42BF4A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwAlpcSendWaitReceivePort [0x9A42C390]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwClose [0x9A41428C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwConnectPort [0x9A42B8DC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateEvent [0x9A414804]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateMutant [0x9A4146EA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreatePort [0x9A42BDAE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateSection [0x9A47B528]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateSemaphore [0x9A414924]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateThread [0x9A47A9BC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateWaitablePort [0x9A42BE7C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwDebugActiveProcess [0x9A47A506]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwDeviceIoControlFile [0x9A4142D0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwDuplicateObject [0x9A4787FC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwLoadDriver [0x9A478464]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwMapViewOfSection [0x9A47B320]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwNotifyChangeKey [0x9A42A06C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwOpenEvent [0x9A41489A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwOpenMutant [0x9A41477A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwOpenProcess [0x9A47A0AE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwOpenSection [0x9A47B7D4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwOpenSemaphore [0x9A4149BA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwOpenThread [0x9A47A718]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwQueryDirectoryObject [0x9A414A44]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwQueryObject [0x9A42A27A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwQueueApcThread [0x9A47B1D4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwReplyPort [0x9A42C174]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwReplyWaitReceivePort [0x9A42C002]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwReplyWaitReceivePortEx [0x9A42C0B8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwRequestWaitReplyPort [0x9A42C1E4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwResumeThread [0x9A47AEFE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSecureConnectPort [0x9A42BA6A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSetContextThread [0x9A47B05C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSetInformationToken [0x9A414AE6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSetSystemInformation [0x9A47856E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSuspendProcess [0x9A47A24E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSuspendThread [0x9A47ADA6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwSystemDebugControl [0x9A414AF8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwTerminateProcess [0x9A47A3AE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwTerminateThread [0x9A47A8B8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwUnmapViewOfSection [0x9A47B93C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwWriteVirtualMemory [0x9A47B666]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateThreadEx [0x9A47ABFC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                                                 ZwCreateUserProcess [0x9A47A660]

INT 0x62        ?                                                                                                                                     91A60CD0
INT 0x82        ?                                                                                                                                     91A60550
INT 0x91        ?                                                                                                                                     91EAF550
INT 0xA1        ?                                                                                                                                     91EAF7D0
INT 0xA2        ?                                                                                                                                     91A60050
INT 0xB0        ?                                                                                                                                     91A60A50
INT 0xB2        ?                                                                                                                                     91A607D0

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 119                                                                                                         8C2BF85C 4 Bytes  [BA, 86, 47, 9A]
.text           ntkrnlpa.exe!KeSetEvent + 13D                                                                                                         8C2BF880 8 Bytes  [02, BC, 42, 9A, 4A, BF, 42, ...]
.text           ntkrnlpa.exe!KeSetEvent + 181                                                                                                         8C2BF8C4 4 Bytes  [90, C3, 42, 9A]
.text           ntkrnlpa.exe!KeSetEvent + 1A9                                                                                                         8C2BF8EC 4 Bytes  [8C, 42, 41, 9A]
.text           ntkrnlpa.exe!KeSetEvent + 1C1                                                                                                         8C2BF904 4 Bytes  [DC, B8, 42, 9A]
.text           ...                                                                                                                                   
.vmp2           C:\Windows\system32\drivers\acedrv11.sys                                                                                              entry point in ".vmp2" section [0x87C9469D]
.text           c:\Program Files\CyberLink\PowerDVD8\000.fcl                                                                                          section is writeable [0x87D8E000, 0x2892, 0xE8000020]
.vmp2           c:\Program Files\CyberLink\PowerDVD8\000.fcl                                                                                          entry point in ".vmp2" section [0x87DB1050]

---- User code sections - GMER 2.1 ----

.text           C:\Windows\system32\conime.exe[300] USER32.dll!DialogBoxParamW                                                                        766010B0 5 Bytes  JMP 753F4720 c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll
.text           C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[592] USER32.dll!DialogBoxParamW                766010B0 5 Bytes  JMP 753F4720 c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll
.text           C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe[660] USER32.dll!DialogBoxParamW                          766010B0 5 Bytes  JMP 753F4720 c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll
.text           C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe[736] USER32.dll!DialogBoxParamW  766010B0 5 Bytes  JMP 753F4720 c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll
.text           C:\Windows\system32\wininit.exe[748] USER32.dll!DialogBoxParamW                                                                       766010B0 5 Bytes  JMP 753F4720 c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll
.text           ...                                                                                                                                   

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                               kltdi.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                                                               kltdi.sys
AttachedDevice  \Driver\tdx \Device\RawIp                                                                                                             kltdi.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                              fltmgr.sys

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                                                 unknown MBR code

---- EOF - GMER 2.1 ----
         

--- --- ---

Servus,


DeFogger bitte einfach schließen.

SpyHunter solltest du versuchen zu deinstallieren.


So geht es weiter:




Schritt 1

• Folge folgendem Pfad: Start -> Systemsteuerung -> Software / Programme deinstallieren
• Suche in der Liste Software mit dem folgenden Namen
  • SpyHunter
  • Enigma Software Group
  und deinstalliere das Programm.
• Solltest du am Ende der Deinstallation zu einem Neustart aufgefordert werden, so führe diesen durch.
• Sollte es Probleme mit der Deinstallation geben, so lass es mich bitte wissen.

AdwCleaner bitte zweimal direkt hintereinander genau so ausführen und beide Logdateien davon posten!

Schritt 2
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/

• Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen
• Starte Zoek.exe mit einem Doppelklick.
• Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
• Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
  

  autoclean;
  emptyclsid;
           

• Nun klicke auf "Run script" und sei geduldig bis das Skript durchläuft.
• Wenn das Tool fertig ist wird sich Notepad mit dem Logfile öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
• Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)

Bitte poste mit deiner nächsten Antwort

• die beiden Logdateien von AdwCleaner,
• die Logdatei von JRT,
• die Logdatei von ZOEK.

SpyHunter - deinstalliert
Enigma Software Group - kann ich leider nicht in der Software liste finden.

Servus,


alles klar.

Weiter mit Schritt 2 bis 4. Danach alle 4 Logdateien dazu posten.

SCHRITT 2 AdwCleaner:AdwCleaner Logfile:

# AdwCleaner v2.301 - Datei am 01/06/2013 um 16:39:56 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Gross - GROSS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Gross\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : BrowserProtect

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\searchplugins\BrowserProtect.xml
Gelöscht mit Neustart : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files\Iminent
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\IBUpdaterService
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Users\Gross\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Gross\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Gross\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
Ordner Gelöscht : C:\Users\Gross\AppData\Roaming\PerformerSoft

***** [Registrierungsdatenbank] *****

Daten Gelöscht : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\browse~1\261249~1.132\{c16c1~1\browse~1.dll
Schlüssel Gelöscht : HKCU\Software\5b53dfdcbc69e847
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\5b53dfdcbc69e847
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7652513C62FF63448CFF05163719DB7
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKU\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16483

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\prefs.js

C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.newtab.url", "hxxp://www.holasearch.com/?affID=121962&tt=gc_&babsrc=NT_ss&mntrId=[...]
Gelöscht : user_pref("extensions.holasearch.admin", false);
Gelöscht : user_pref("extensions.holasearch.aflt", "babsst");
Gelöscht : user_pref("extensions.holasearch.appId", "{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}");
Gelöscht : user_pref("extensions.holasearch.autoRvrt", "false");
Gelöscht : user_pref("extensions.holasearch.dfltLng", "en");
Gelöscht : user_pref("extensions.holasearch.excTlbr", false);
Gelöscht : user_pref("extensions.holasearch.ffxUnstlRst", false);
Gelöscht : user_pref("extensions.holasearch.id", "0e158e460000000000000ceee680d95c");
Gelöscht : user_pref("extensions.holasearch.instlDay", "15851");
Gelöscht : user_pref("extensions.holasearch.instlRef", "sst");
Gelöscht : user_pref("extensions.holasearch.newTab", false);
Gelöscht : user_pref("extensions.holasearch.prdct", "holasearch");
Gelöscht : user_pref("extensions.holasearch.prtnrId", "holasearch");
Gelöscht : user_pref("extensions.holasearch.rvrt", "false");
Gelöscht : user_pref("extensions.holasearch.smplGrp", "none");
Gelöscht : user_pref("extensions.holasearch.tlbrId", "base");
Gelöscht : user_pref("extensions.holasearch.tlbrSrchUrl", "");
Gelöscht : user_pref("extensions.holasearch.vrsn", "1.8.16.16");
Gelöscht : user_pref("extensions.holasearch.vrsni", "1.8.16.16");
Gelöscht : user_pref("extensions.holasearch.vrsnTs", "1.8.16.1611:41:24");

*************************

AdwCleaner[S1].txt - [10776 octets] - [01/06/2013 16:39:56]

########## EOF - C:\AdwCleaner[S1].txt - [10837 octets] ##########
         

--- --- ---



SCHRITT 3 JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Gross on 01.06.2013 at 16:50:05,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Windows\system32\roboot.exe"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\browserprotect"
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{026402E5-0F9A-453B-949E-13388D69F9E2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{02D9717C-52F2-4B96-8E23-9638726F1984}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{042717CB-B8F8-4E46-8C02-820C70B38BC2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0599B9AF-659E-4294-AC98-9E442522E675}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0719C211-EBFF-4F45-8344-F29C0921DD83}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{08D74493-1783-4946-8178-812C2066EBB7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{096D0C57-3D5A-4671-B8D5-68E569496A92}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0A2030BE-92CF-458B-8072-EA7DE5F555D0}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0A8754D2-A034-4C51-89D3-D8814DDC217D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0B0B2C61-7D84-4096-B338-2AC13923F83B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0DA81EB2-3C20-443E-90BA-4D602EB21A1F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0DD16C7F-A8E5-439C-8DB6-656ADF8F4A0D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0F323CE0-F1C1-4118-84A4-EA634B97C935}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{0FCD6DBA-63A3-4736-90E2-44B6B7FEB651}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{11132C8A-12B7-46CF-9262-C119218C3F91}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1140E8AA-8B64-454B-B817-C902E453ECF3}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1194AC77-4B57-4287-A24A-0FE35B7356B6}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{11AF528E-87AC-427D-89AB-64C17DC4F478}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{12DFDDC8-968E-4B7E-B88F-AA670D290D0A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1300FAD2-A8BF-46DD-90D5-380230EA756E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1310A787-A500-4302-8731-74D540CDAB7A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{14DF01E0-EF89-4D73-8993-844D1D13CDAE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{154BAEB8-932B-4EF2-8A94-37DD39B65938}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1664A566-46F6-4BD0-95C9-93C0E2603E53}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{171B32BD-E5D7-4EBA-8C2F-5FBB5E2F966E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1729FAF4-EA88-401B-B270-D14BC9D2798E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{17741073-EC1A-44AE-A9BC-5070D8FBB8AE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{177C2D7E-67BB-4DE3-A5BA-5B5711F372F8}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{18D75A74-FF53-4C7F-9938-FEEACE8844F0}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{18ED8DB3-2018-41B4-83D7-2A14BC158B8B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1A3CC48E-E025-4BBA-AC64-FE6F4D95A9DC}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1B0B5A9A-9A12-4110-A716-B2AF32ECFF21}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1D24A4A9-9D24-4597-879D-DF81991F23FF}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1DC0A53C-26B5-41DD-8520-2C65B35A5DD7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1E1F9627-69E3-4BDA-AE64-1E096BFDDB86}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1E4DE27C-D629-4024-B6F2-7F3D70DE897F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{1E5FA887-4E02-403A-A95B-19B15B7EACA4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{208DE0F0-FC19-46D7-A5CC-8FCFCABE4A0D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{20BDD240-DD63-4A55-9382-F5ADC6384C0B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{20FD2BF2-964C-4A0D-9B4F-7D555F2F36F3}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{22A1FCA6-FCE5-4047-954C-9E4090367F2B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{23511621-EE83-4E42-B0BA-9018E2532FCC}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2421B07E-9016-4049-BD76-E4A4C317F79F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{26236FC2-167B-4C8E-862D-71AE97DF791C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{262BA9C5-C7C3-4B47-BE43-3FC1E85505CC}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{264CFC7F-084E-47B8-AD36-B7F18060840F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{27545811-C843-4E86-885B-D83CE058B9EA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{27E9E0B7-CA4D-45E6-A576-3DD67F1B67D2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{27EE5622-C6ED-46DF-9398-0957E7B5723A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{294DE48E-57FC-432D-9B56-5D6340B29D17}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2951D813-C55D-41F8-923D-577DCCE7697F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{299D75C6-C5E2-43BC-B73B-53E88B0F7FA0}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2B0531B0-4762-4EDE-9E3C-77A59E981D26}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2BA7CD47-FC4D-4F9C-B5DF-C1E020ABABB4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2CD42099-0052-4631-A8E7-E2CCFB7F853D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2ED8E0C0-C422-4B2D-83C3-4CD7B03D8700}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2FF89F59-7309-498C-ADA3-C2686ACCB908}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{2FFD94A4-CA29-42DD-BB34-6A67AD9E39AA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{304D1A2D-23E2-4F98-BBCB-EA569E105A06}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{31051405-511B-48FB-8855-F9F92BB0A773}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{32C3E181-8B81-4043-BB4E-C8CF1F5C9ABD}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3528D9BE-115B-435E-9792-BB1378C9C3AB}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{35724184-2EBB-4387-B69F-7950E67C5C31}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{35882C5E-05CA-488A-A5CE-C5FA67D2E618}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{361F1B37-BB9E-4F21-8C91-FB8E0E53FB90}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3678908E-7108-4799-8635-B25E14DBEE78}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3751826A-476A-4CB8-A99D-5220D51A423C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3848CA3A-6505-44BF-95F7-8371B80F0A65}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3A26892C-239C-4223-8E9D-1C1B65F02306}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3AEF7169-2CA0-49AD-93B0-65A87B6BCBCE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3BDAD9B3-162B-4294-B9E8-2E2941346DB5}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3C3A7CC0-EC60-40FC-85E8-4B6555C750AE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3D2000E7-96CD-43CF-8EAB-620093223A0B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{3DC03833-D2DD-43C2-88E9-A57434544AF9}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{4071356F-69C2-4309-9DC7-49FF4FDA6E35}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{41AFADA5-48F6-47AE-92AE-AF47B6BECD43}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{450FCFFE-5E32-42D0-9A74-E98CD6ABE310}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{45CDDA8F-E31C-471F-AB05-8C611A9E01DA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{4604593B-87F4-4736-8AF3-DF557AEA5418}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{46A4751C-860D-4330-8910-B9DB1F3490AB}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{47A02970-8D3E-4A7F-BCB8-C24E102BC921}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{47D07490-B83E-4906-A08C-7D2D1A39FB65}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{4832F186-4159-4389-900A-2FE755395445}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{4997E893-4B7C-452B-93E6-B8D6C0085805}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{51EC862F-4DDE-4C8D-9CE9-C5EF5E93967E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{528495D7-8D6C-4CF4-8B0F-5A7870420985}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{54D62520-3A01-4E18-BC37-FADC1BF3D488}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{5521E3D9-B620-44C0-A855-E01D1B5DFB70}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{55665004-63AE-42DB-AFFB-DF9A13DB0015}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{56D8B14C-31B2-49D3-8FC2-09FE3BB6283C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{56E57DF0-5351-4BAE-9623-3D93C5348B3D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{57255A12-1E24-49CB-86EA-2DAB30468F4C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{5953EC17-9B68-44F0-B820-A0E886688519}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{595F2CA8-A595-48D1-8D5D-0F3A35FCFDF7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{59CC187A-07DA-48EC-A016-931C4DD60255}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{5E8DE09C-1BF6-433C-B2AE-821718B31247}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6131D700-6B3F-460F-84B2-115E156E8AED}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{616DFBF7-B0BA-4A5E-9D35-B3611D356A33}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{623ADC0B-BCBD-48C3-8770-A1F9165C8A4B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{667FEF5A-4929-4F8B-B02B-264BCDBFAAB7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{677E8D39-09B6-436B-80E6-6206CF5C3E87}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6810875C-75B0-48B4-B09E-5143A3C7E1A4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6983FCBE-6267-470F-89B5-E42D2AFF9402}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6A6480D8-EB5A-4DD1-9FDB-B87EB28FF03B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6AD4232E-F5CD-4C35-BFBC-1D4D6BA8AD91}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6ADA54FD-F8B0-4F89-AA16-42B2FF5E2261}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6D436576-3E3A-4137-8167-6BDC03622070}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6DAEC2AA-87E8-4FF8-9E4B-5940DC0DCB83}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6E51D4A4-F7F1-4FD1-B603-77478F882FED}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{6F28FD59-6B21-49A0-AFFB-DBE887726CB5}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{70A71323-9D86-410C-9E09-F37806160AEC}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{71124B2C-2109-4747-A856-02485735A0D9}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{71F4E25E-D76E-4632-9460-3BF51B02332B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{76949714-1734-459F-90AD-A8A67ADAEACC}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{779B0B33-4FE9-48A4-8388-AA53DBF199F7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{7AB21C43-E4DB-42CC-BC10-A65B4C5EF37A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{7C7C682B-F333-4A06-9CBE-667121C139EE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{7FCA7A2A-793F-4F53-B8E4-0D00D101C954}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{7FF708CF-C37A-4D73-A7B3-1E7530982BBC}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{81761E57-10A5-438F-8139-11CFDE187548}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{81C6BF93-118A-4B42-BAC6-4B41E7680F57}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{81D79229-83D2-4D55-8E63-C233F7D85969}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8217BDF4-2354-4058-943B-AF892CB9A57C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{82670FFF-CBC0-4FEB-9A78-07B6D3126B11}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{866E1B31-D03E-44D3-9744-5B28283C7A9F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{86956C1F-4EED-4361-81A4-73B9F590D962}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{86D39EF2-2C0F-48FB-AAF3-4638FD937418}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8701315A-F65A-417E-8FB6-515D366350FA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{88C8F208-9DDC-4CFF-8E04-70CBFFDE566E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8A3BA3CC-E999-496A-8B9E-4BB861C2FBE3}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8A5D46E7-60DA-41AD-BE3A-C8DCC8A8DB86}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8C328BD0-1621-46B5-8F20-8DD6C62667C2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8C3BD61A-1D77-4C8E-89DD-594B519D13B4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{8DB7377D-608C-45C4-965E-31D0768B7517}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9028E68F-64EA-4A52-9CE1-E21034850EA1}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{91B5A743-006E-4DF2-BCF2-BD91BB1300CA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{939FCA5F-AAC1-4761-8E73-994007B7BD22}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{958E7D37-AB19-4E84-9167-C85434DFF973}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{95FE7681-C55D-4BEA-9486-28AF569B449C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9914A269-A0C2-42A4-9FC2-047B7CC7DC0D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{994D3F51-C6FB-4897-A5A1-D20F65C2885F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9B541F6F-9347-451C-BADF-DA3D888889F9}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9C50C674-BA2E-406D-9A70-3B3106A4ACAA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9CDEB5A0-B544-4493-93CD-B562BAC7EAED}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9DB6B551-AD8C-44E5-A6C9-64630BA45411}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{9FACBB40-D30B-47B4-8CF7-3B19D9D15AE8}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A0DDE1B6-1B75-4E4C-8BF9-3EF8BBC8D06A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A1701F3D-2525-422A-A6E8-81D23D243AB2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A21EF6E2-75A8-47EF-9AB5-535D740B0A35}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A2C23713-FCAC-46CF-8FD6-1DC0E65C4893}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A3472F72-39A2-4458-A900-B8066A21E744}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A3C7D005-2396-4288-909B-E6FDB7BFCDA0}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A3E462B8-20DC-4557-998C-1A952B603617}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A5021B58-2EBB-475F-A87A-BAC6E88DFE5C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A5D56FE4-3CC4-4CB4-9156-2622AF62CA77}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A6BA09AF-1E8E-4A1F-93DA-FD981FBEF17B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A77DE36A-3BD6-4C16-84AB-0A0803C1B758}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A835DD17-4053-4B6B-B284-C200CC226242}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A882E47C-3274-4EAF-99A0-CCD39486ACC6}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A890BB69-2BE4-40CF-A450-FA017542FCB9}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{A945A920-393F-4E07-BEA4-D2F852EA08DB}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AAAC11B9-C2A2-469E-9395-B1E773A4636B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AAF03A1B-ED9C-4B03-8D6B-0E463D8246BF}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AE77CEBF-1AAF-4C0F-A3A0-E9666B9DBBE9}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AEA68F94-6E83-402B-8710-44C99EF7A10A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AEFEA358-DEA7-4D77-BA98-243AB7CAC170}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AF5F5F9F-0E01-4C9D-B02B-15AB02A870A5}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{AFCA4CEA-43A4-4244-8339-19728A5C0CD2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B21E5793-3391-4862-BE57-B8A11E125A9F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B2C81FE3-AB94-4432-8746-D452EBA98E89}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B3AC8CA5-9227-4D37-B14B-B50D77961B86}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B4216469-029C-4161-8C76-0166764E53E4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B53C94F1-9297-45B5-A611-2B5CF0891F95}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B5E1A42D-F3BB-4FBE-AF07-C52AEADBD694}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B676A647-CF52-4EEC-81C1-EE4010D5BB52}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B7F9D6E7-EE04-451F-884F-4CD83E609F06}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{B8EAEF3F-072D-46F5-B8C4-9A2775617A97}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{BA383CB0-6C95-4AC0-8061-5B1D3D9E4944}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{BCD43B22-FE63-4BD0-99A3-6C54EB16E58B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{BCD92F00-4CD6-4391-ACD9-DDBDDCB03B62}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{BF5F3F41-AAC7-4F9A-A95F-2881D17E7F5D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{BF80F552-67B3-430E-9BDA-7E3A0B8450C4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C0CA9F10-34A4-4ECD-873B-6FD53D333F1D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C37B3E4F-8AF3-4379-944F-239C7323A115}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C3AB7BB4-1E34-4FF3-A32F-BF3836C4EC9D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C69BE57D-E6F7-4C25-906B-24D77E8F27B9}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C69C70BD-BE90-4F72-B232-970827BB3A34}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C6F21EF4-CF93-42B2-9D74-78A4D2365E49}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{C8DAC7D1-1FA9-45FA-A97D-E5D5B54D8CB7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{CB47246A-9107-455B-A298-D18280817036}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{CB4BC6EC-9309-4152-B730-9780B11EA1EE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{CCD7AEF6-688C-4272-B96E-6C3F71FC1639}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{CF74E4FB-C1B5-40BD-B9B2-A2E73050D443}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D1070A97-1959-48F5-8C7A-5525DCC9D3C7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D1CFBEDC-3EC7-4560-A262-7F559EAB6E15}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D1DA5B85-D7F9-4DB5-A7AF-16CD393E35F1}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D28E1050-A439-4550-B778-5B408C530EF4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D35B709A-0B62-4B5E-9BAF-B7EEE3A7C4D2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D5304F34-B8F8-46EB-B83D-63BA9E6DB1F5}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D60CA0C7-020E-4892-8E54-BF9D033965B2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D755DB69-0206-4A2E-AC33-1A8641FE317D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D8045578-7371-43AA-8062-28C9202A7614}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D8870CF8-9795-4D84-AC56-BC5816EC101F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D98FB01F-C6E2-4234-A50E-8932C4D6E997}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{D9D4AADF-080F-4A1E-A8E6-B170E763D0B7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{DB452A7E-2571-4690-BDF1-01F8114453EE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{DC0E0C8F-C5D0-4F4A-AA55-DE625F6241D7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{DC789DD1-8AC5-48CB-9819-6E744C569EF7}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{DE3F4E77-E5D0-4B81-B668-192F2DAF771C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{DE57A06A-596A-4887-981D-76CBC532E59F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E1664D68-50FD-46F7-B5B5-3C67F1D0DAAF}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E168A2EE-BF30-4663-86F9-AE17296F7D2D}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E1D9F701-AF1D-4A74-AB0C-37441991EA26}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E237F316-DDD2-4855-9CCD-1FAA41D14310}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E26C5FF9-1A02-4226-B54A-26C6C1B76BC0}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E4CA8AA2-AD76-4317-A3BE-C4EF8068DE4B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E5F8618B-A960-48C6-B758-4CDA377EAE2C}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E6F65188-9B2E-4791-8448-F4A17B0BCCA4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E7213682-6FAD-4706-8C1D-8B516C3A570F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E7306B7B-20F8-4E37-983E-148345C59A79}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E7A8B306-483E-4892-8198-93B5CC2A1B5E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E8D6409A-FBF0-4F13-9AFB-105FF26D2182}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E8DD6A21-F398-4072-A6D0-FA56128FE01A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E905734D-07DF-4019-8608-07EB4E89B5FD}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E958F6CB-D5F5-43BC-928D-DEDDD00DC290}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{E973751A-F655-44AE-AB8A-C10BD489625E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{EC57FF9D-E36B-4476-9933-B56494CC89D1}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{ECDAAE24-4A72-4FE3-A0C1-EFC30759DF6E}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{ED0687A9-781B-4941-BC8E-61805787C2AB}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{EE0688D1-33AB-42C3-8647-8FEA5B1C03B4}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{EE3481B7-D608-45B3-B1C3-089CD04FD2BA}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F15D09F4-1132-4387-A2AC-5EAC3E505E94}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F1FBC313-2198-4B3D-9EEE-E9C9F3A09700}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F2399F07-668F-4C48-BE2A-EB72C3B104C3}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F505B7AD-D236-4482-B9D2-C47051319D49}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F57F51F4-CC11-4E37-B659-E0A83C1A098A}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F5BEAA33-4BD3-4311-9F71-601C769A2FC1}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F758CDCC-1E7B-4EFA-848C-6B4C1D815D6B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F9A40F1F-4A09-42C0-AFF4-0EA7C0FF9489}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{F9CA698D-1938-479E-80C4-056D4CBCC82F}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FC193DEC-E33E-4928-A8A0-77AF1C495F5B}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FC6807D4-26F8-40CB-B4FA-CC779E64EBED}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FCA7AC46-7A45-4DF6-8553-46B473864694}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FD412A99-3049-46A8-BE9C-1BFA04E18AD2}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FE758430-CA10-4134-A1AF-EDA064DAD7FE}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FE8B9781-7D9A-4A45-8556-F9D02065C9C1}
Successfully deleted: [Empty Folder] C:\Users\Gross\appdata\local\{FED8CDD1-0FF0-4CA8-B942-7F13FDE98687}



~~~ FireFox

Successfully deleted: [File] C:\Users\Gross\AppData\Roaming\mozilla\firefox\profiles\pwd0s67d.default\searchplugins\babylon.xml
Emptied folder: C:\Users\Gross\AppData\Roaming\mozilla\firefox\profiles\pwd0s67d.default\minidumps [61 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.06.2013 at 16:53:58,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



SCHRITT 4 ZOEK:

1ster Versuch:

Zoek.exe Version 4.0.0.2 Updated 31-May-2013
Tool run by Gross on 01.06.2013 at 17:12:49,62.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode No Internet Access Detected

zoek.hta failed by unknown error.
Restart computer, and try again.
If this error returns, use another tool.

==== EOF on 01.06.2013 at 17:13:26,76 ======================

2ter Versuch nach Neustart:


Zoek.exe Version 4.0.0.2 Updated 31-May-2013
Tool run by Gross on 01.06.2013 at 17:17:30,02.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode No Internet Access Detected

==== Older Logs ======================

C:\zoek-results01.06.2013-1713.log 396 bytes

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== FireFox Fix ======================

ProfilePath: C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default

user.js not found
---- Lines Hola Search removed from prefs.js ----

user_pref("browser.search.order.1", "Hola Search");

---- Lines Hola Search modified from prefs.js ----


---- FireFox user.js and prefs.js backups ----

prefs__1721_.backup

==== Deleting Files \ Folders ======================

"C:\Users\Public\Documents\mstrust.dll" deleted
"C:\Users\Gross\Downloads\SoftonicDownloader_fuer_logiccircuit.exe" deleted
"C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default\searchplugins\holasearch.xml" deleted
"C:\Program Files\Common Files\DVDVideoSoft\bin" deleted
"C:\Windows\System32\searchplugins" deleted
"C:\Windows\System32\Extensions" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default
- Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com

AppDir: C:\Program Files\Mozilla Firefox
- ICQ Toolbar - %AppDir%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

==== Firefox Plugins ======================

Profilepath: C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Profiles\pwd0s67d.default
7ABE33792F2787D599B6963E71B9E8CD - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll - Shockwave Flash
05C4A7136F3012BB47107333B5D351D3 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java(TM) Platform SE 7 U17
D4BD9F86123C87ECA570418B69326F99 - C:\Windows\system32\npDeployJava1.dll - Java Deployment Toolkit 7.0.170.2
F00A0EF5835E1B96F783D617F1948704 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector
A5C14075B571AF1C9592595BE724D9D2 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll - Silverlight Plug-In
11EF47BE3D8A4A943E10A63870C1F2C6 - C:\Program Files\QuickTime\Plugins\npqtplugin7.dll - QuickTime Plug-in 7.7.3
4ACB977AAB250731739302CB45A807B3 - C:\Program Files\QuickTime\Plugins\npqtplugin6.dll - QuickTime Plug-in 7.7.3
6E7690D2EE4E530DAC8C562CF8CCE70B - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.3
D2E4BDDD297B6A481BAC612C25A1F10A - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.3
7A14B17E24CE74BBB603B824EDA79A72 - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.3
2A92F41DCBB5832872D8B0E941746112 - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.3
C1FD5EE5FD1F65CE223A5C3AE846DDF6 - C:\Program Files\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.3
C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery
5E186625C3E195C1D28A0C1E6E8DEED8 - C:\Users\Gross\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll - Protect Disc License Acquisition Plugin
AB87EEFFD18F2BAAFC274E7075EA6C67 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation
DFCAB29E8FD38F95650CC1E203E8D318 - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System
2AA3703D87E1327A2290C9D416D89A28 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrlui.dll - Microsoft® Silverlight


==== Deleting Files \ Folders ======================

"C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}" deleted

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dchlnpcodkpfdpacogkljefecpegganj - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx[14.12.2012 13:48]
hakdifolhalapjijoafobooafbilfakh - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx[14.12.2012 13:48]
hghkgaeecgjhjkannahfamoehjmkjail - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx[14.12.2012 13:48]
jagncdcchgajhfhijbbhecadmaiegcmh - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx[12.05.2013 12:06]
pjldcfjmnllhmgjclecdnfampinooman - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx[14.12.2012 13:48]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0909&m=easynote_tj65"
"ICQ Search"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0909&m=easynote_tj65"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{B6D76258-1AD5-4C5C-85A6-CE11356D7C86} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACPW_deDE353"

==== Empty IE Cache ======================

C:\Users\All Users\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\Gross\AppData\Local\Microsoft\Windows\TEMPORARY INTERNET FILES\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gross\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Gross\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gross\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\users\Gross\AppData\Local\Mozilla\Firefox\Profiles\pwd0s67d.default\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Gross\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Gross\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on 01.06.2013 at 17:24:03,92 ======================

Servus,




Schritt 1
Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.





Schritt 2
Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit)

• Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
• Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
  

  :filefind
  *bprotector*
  *Babylon*
  *BrowserProtect*
  *ICQ6Toolbar*
  *Iminent*
  *IBUpdater*
  *PerformerSoft*
  *dvdvideosoftiehelpers*
  *DataMngr*
  *Softonic*
  *YahooPartnerToolbar*
  *holasearch*
  
  :folderfind
  *bprotector*
  *Babylon*
  *BrowserProtect*
  *ICQ6Toolbar*
  *Iminent*
  *IBUpdater*
  *PerformerSoft*
  *dvdvideosoftiehelpers*
  *DataMngr*
  *Softonic*
  *YahooPartnerToolbar*
  *holasearch*
  :regfind
  bprotector
  Babylon
  BrowserProtect
  ICQ6Toolbar
  Iminent
  IBUpdater
  PerformerSoft
  dvdvideosoftiehelpers
  DataMngr
  Softonic
  YahooPartnerToolbar
  holasearch
           

• Klicke nun auf den Button Look, um den Scan zu starten.
• Der Suchlauf kann einige Zeit dauern.
• Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
• Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Wie läuft dein Rechner derzeit?
Gibt es noch Probleme mit Hola-Search? Wenn ja, in welchem Browser?





Bitte poste mit deiner nächsten Antwort

• die beiden Logdateien von OTL,
• die Logdatei von SystemLook,
• die Beantwortung der gestellten Fragen.

Servus Matthias,


1.OTL Logfile:

OTL logfile created on: 02.06.2013 01:52:52 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Gross\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,77 Gb Available Physical Memory | 59,17% Memory free
6,19 Gb Paging File | 4,89 Gb Available in Paging File | 79,08% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,32 Gb Total Space | 171,67 Gb Free Space | 59,54% Space Free | Partition Type: NTFS
 
Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.01 14:52:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gross\Desktop\OTL.exe
PRC - [2013.05.23 20:23:12 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.12.14 13:45:40 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.06.23 17:19:14 | 000,711,200 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerTray.exe
PRC - [2009.06.23 17:19:14 | 000,707,104 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerSvc.exe
PRC - [2009.06.23 17:19:12 | 000,453,152 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerEvent.exe
PRC - [2009.05.26 15:26:50 | 000,254,720 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
PRC - [2009.05.26 15:26:20 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.18 10:46:30 | 001,160,736 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\SetupMyPC\SmpSys.exe
PRC - [2009.03.07 00:48:52 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared files\brs.exe
PRC - [2009.02.19 05:42:50 | 000,866,824 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe
PRC - [2009.02.01 08:43:30 | 000,049,250 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\Apoint2K\Hidfind.exe
PRC - [2008.11.06 05:53:58 | 000,474,168 | ---- | M] (Conexant Systems, Inc.) -- C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe
PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.09.11 01:45:04 | 000,124,832 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.23 20:23:12 | 003,128,728 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.08.17 21:40:16 | 000,068,024 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\QtWebKit\qmlwebkitplugin4.dll
MOD - [2012.08.17 21:38:56 | 000,479,160 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.02.02 17:33:56 | 000,460,199 | ---- | M] () -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\sqlite3.dll
MOD - [2003.06.07 23:30:08 | 000,057,344 | ---- | M] () -- C:\Programme\Launch Manager\PowerUtl.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (gupdate1cac2454df83dc4)
SRV - [2013.06.01 14:33:57 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.23 20:23:12 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.12.14 13:45:40 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.23 17:19:14 | 000,707,104 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009.05.26 15:26:20 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.03.25 19:52:50 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.11 01:45:04 | 000,124,832 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btwrchid.sys -- (btwrchid)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwavdt.sys -- (btwavdt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2013.05.12 12:20:37 | 000,145,040 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kneps.sys -- (kneps)
DRV - [2013.05.12 12:20:36 | 000,594,528 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2013.05.12 12:20:36 | 000,044,432 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kltdi.sys -- (kltdi)
DRV - [2012.12.14 13:45:34 | 000,025,944 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2012.12.14 13:45:34 | 000,025,944 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klkbdflt.sys -- (klkbdflt)
DRV - [2012.08.02 15:09:30 | 000,024,408 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2012.06.19 17:28:12 | 000,136,024 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\kl1.sys -- (kl1)
DRV - [2011.05.10 08:06:14 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2009.06.22 15:50:00 | 009,753,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.05.25 05:50:50 | 000,203,824 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2009.05.01 07:43:34 | 000,064,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009.03.30 05:43:02 | 001,124,864 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.03.17 20:28:50 | 000,452,096 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2009.03.06 14:48:38 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/09/28 08:31:56] [Kernel | Auto | Running] -- c:\Programme\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
DRV - [2008.09.04 06:12:56 | 000,223,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x)
DRV - [2008.01.21 04:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0909&m=easynote_tj65
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
IE - HKCU\..\SearchScopes\{B6D76258-1AD5-4C5C-85A6-CE11356D7C86}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACPW_deDE353
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA%402020Technologies.com:5.0.94.0
FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\Gross\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.03.19 16:12:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013.05.12 12:20:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013.05.12 12:20:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013.05.12 12:20:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013.05.12 12:20:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013.05.12 12:20:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.23 20:23:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.06.01 13:53:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.03.19 16:12:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.23 20:23:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.06.01 13:53:21 | 000,000,000 | ---D | M]
 
[2012.03.14 18:35:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gross\AppData\Roaming\mozilla\Extensions
[2013.05.26 15:57:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gross\AppData\Roaming\mozilla\Firefox\Profiles\pwd0s67d.default\extensions
[2013.06.01 17:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.05.23 20:23:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.05.23 20:23:14 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.05.12 12:20:57 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell PowerSave Solution\ePowerTrayLauncher.exe (Acer Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [BDRegion] c:\Programme\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 File not found
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe File not found
O4 - HKCU..\Run: [SmpcSys] C:\Programme\Packard Bell\SetupMyPC\SmpSys.exe (Acer Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.17.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CE98DAD6-890E-40D1-8DA8-86FBE2197C38}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FACE51E9-2200-43CD-9AE2-9AA371276FD6}: DhcpNameServer = 193.189.244.225 193.189.244.206
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Gross\Pictures\Dies&Das\Unbenanntaa.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gross\Pictures\Dies&Das\Unbenanntaa.jpg
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{21e5fba3-e0b5-11de-b199-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{21e5fba3-e0b5-11de-b199-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5d022050-d802-11de-9a1c-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{5d022050-d802-11de-9a1c-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5d02208c-d802-11de-9a1c-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{5d02208c-d802-11de-9a1c-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8c5a1b73-ddd7-11de-b5a9-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{8c5a1b73-ddd7-11de-b5a9-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b859b8f3-de38-11de-8f43-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{b859b8f3-de38-11de-8f43-00262d50b6c2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d14339d0-cef3-11de-8f64-00262d50b6c2}\Shell - "" = AutoRun
O33 - MountPoints2\{d14339d0-cef3-11de-8f64-00262d50b6c2}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.01 17:24:06 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.01 17:22:36 | 000,000,000 | ---D | C] -- C:\Windows\Temp
[2013.06.01 17:22:36 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\Temp
[2013.06.01 16:48:17 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Gross\Desktop\JRT.exe
[2013.06.01 14:52:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Gross\Desktop\OTL.exe
[2013.06.01 14:33:57 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.06.01 14:33:57 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.06.01 14:02:56 | 000,000,000 | R--D | C] -- C:\Users\Gross\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
[2013.05.26 15:42:30 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.05.26 15:38:11 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.05.26 15:37:36 | 000,000,000 | ---D | C] -- C:\JRT
[2013.05.26 11:45:49 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\LogicCircuit
[2013.05.23 20:22:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.05.16 16:22:45 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.05.16 16:11:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.05.16 16:11:32 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.05.16 16:11:32 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.05.16 16:11:31 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.05.16 16:11:30 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.05.16 16:11:30 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.05.16 16:11:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.05.15 20:33:42 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.05.15 20:33:33 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.05.11 13:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.02 01:44:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.02 01:31:27 | 000,060,275 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013.06.02 01:31:26 | 000,060,275 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013.06.02 01:31:13 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.02 01:31:13 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.02 01:31:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.02 01:31:05 | 3215,908,864 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.01 17:35:10 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.06.01 17:17:12 | 000,024,064 | ---- | M] () -- C:\Windows\zoek-delete.exe
[2013.06.01 17:11:16 | 001,271,244 | ---- | M] () -- C:\Users\Gross\Desktop\zoek.exe
[2013.06.01 16:48:37 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Gross\Desktop\JRT.exe
[2013.06.01 16:40:13 | 000,000,097 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013.06.01 16:39:12 | 000,632,031 | ---- | M] () -- C:\Users\Gross\Desktop\adwcleaner.exe
[2013.06.01 15:24:17 | 000,377,856 | ---- | M] () -- C:\Users\Gross\Desktop\gmer_2.1.19163.exe
[2013.06.01 15:21:03 | 000,000,000 | ---- | M] () -- C:\Users\Gross\defogger_reenable
[2013.06.01 15:19:55 | 000,050,477 | ---- | M] () -- C:\Users\Gross\Desktop\Defogger.exe
[2013.06.01 14:52:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gross\Desktop\OTL.exe
[2013.06.01 14:33:57 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.06.01 14:33:57 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.05.31 18:56:24 | 002,062,259 | ---- | M] () -- C:\Users\Gross\Desktop\IMG_3393.JPG
[2013.05.26 11:56:08 | 000,000,862 | ---- | M] () -- C:\Windows\System32\InstallUtil.InstallLog
[2013.05.23 20:31:37 | 000,628,992 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.23 20:31:37 | 000,596,246 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.23 20:31:37 | 000,126,704 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.23 20:31:37 | 000,104,320 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.16 18:56:18 | 000,352,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.12 17:34:03 | 000,002,123 | ---- | M] () -- C:\Users\Gross\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.05.12 12:20:37 | 000,145,040 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\kneps.sys
[2013.05.12 12:20:36 | 000,594,528 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\klif.sys
[2013.05.12 12:20:36 | 000,074,848 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\klflt.sys
[2013.05.12 12:20:36 | 000,044,432 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\kltdi.sys
[2013.05.11 13:43:42 | 000,001,025 | ---- | M] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.05.11 10:34:31 | 000,386,623 | ---- | M] () -- C:\Users\Gross\Documents\Unbenannt (4).wma
[2013.05.09 12:28:50 | 002,377,313 | ---- | M] () -- C:\Users\Gross\Desktop\IMG_3277.JPG
[2013.05.09 11:59:59 | 002,278,644 | ---- | M] () -- C:\Users\Gross\Desktop\IMG_3276.JPG
[2013.05.05 21:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.01 17:22:37 | 000,024,064 | ---- | C] () -- C:\Windows\zoek-delete.exe
[2013.06.01 17:11:06 | 001,271,244 | ---- | C] () -- C:\Users\Gross\Desktop\zoek.exe
[2013.06.01 16:40:02 | 000,000,097 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013.06.01 16:39:04 | 000,632,031 | ---- | C] () -- C:\Users\Gross\Desktop\adwcleaner.exe
[2013.06.01 15:24:15 | 000,377,856 | ---- | C] () -- C:\Users\Gross\Desktop\gmer_2.1.19163.exe
[2013.06.01 15:21:03 | 000,000,000 | ---- | C] () -- C:\Users\Gross\defogger_reenable
[2013.06.01 15:19:54 | 000,050,477 | ---- | C] () -- C:\Users\Gross\Desktop\Defogger.exe
[2013.06.01 14:34:01 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.31 18:56:15 | 002,062,259 | ---- | C] () -- C:\Users\Gross\Desktop\IMG_3393.JPG
[2013.05.26 11:36:16 | 000,000,862 | ---- | C] () -- C:\Windows\System32\InstallUtil.InstallLog
[2013.05.12 17:40:05 | 002,377,313 | ---- | C] () -- C:\Users\Gross\Desktop\IMG_3277.JPG
[2013.05.12 17:40:02 | 002,278,644 | ---- | C] () -- C:\Users\Gross\Desktop\IMG_3276.JPG
[2013.05.11 14:04:15 | 000,002,123 | ---- | C] () -- C:\Users\Gross\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.05.11 13:48:07 | 000,001,025 | ---- | C] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.05.11 10:34:31 | 000,386,623 | ---- | C] () -- C:\Users\Gross\Documents\Unbenannt (4).wma
[2012.02.26 19:31:12 | 000,001,024 | ---- | C] () -- C:\Users\Gross\.rnd
[2012.02.26 19:30:51 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini
[2012.02.20 23:13:30 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.10.16 17:50:11 | 000,044,838 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\UserTile.png
[2010.02.03 09:26:50 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.11.11 21:19:58 | 000,013,824 | ---- | C] () -- C:\Users\Gross\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.11 18:54:52 | 000,003,248 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\wklnhst.dat
[2009.09.28 08:20:41 | 000,060,275 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.09.28 08:19:07 | 000,060,275 | ---- | C] () -- C:\ProgramData\nvModes.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
         

--- --- ---
OTL Logfile:

OTL Extras logfile created on: 02.06.2013 01:52:52 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Gross\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,77 Gb Available Physical Memory | 59,17% Memory free
6,19 Gb Paging File | 4,89 Gb Available in Paging File | 79,08% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,32 Gb Total Space | 171,67 Gb Free Space | 59,54% Space Free | Partition Type: NTFS
 
Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01464E45-F7B5-4F8C-A84C-4622C3D67FB8}" = rport=138 | protocol=17 | dir=out | app=system | 
"{12996536-73A8-4453-A5DA-CD205B0836F6}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{1409B7AD-D536-49F4-A8FC-761CFDE959C5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{16A6541F-633E-4220-B0E9-8334D1D0AFAA}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{18C63752-3021-47CA-873A-01359E6FAD82}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{44FE9174-9F3C-451B-83A0-C37E3D08A233}" = lport=137 | protocol=17 | dir=in | app=system | 
"{552C1AFB-1596-4269-80FC-EA9A77E34820}" = lport=445 | protocol=6 | dir=in | app=system | 
"{55C6BD14-9217-4F63-93AF-B3AAE4242B3B}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{5F4F396F-48E0-4A1D-A473-BF910A9E7B78}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6B3BEB85-87B6-4F48-951B-4722EE56E49C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{6E65FF5D-01E7-4CCD-8568-48B1C3654C64}" = rport=139 | protocol=6 | dir=out | app=system | 
"{9EFABD56-7EEC-4026-A6AB-18431955659E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A1EE2027-E97B-4826-82D7-5929E7255B72}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B4852F84-3C79-455F-8A6F-DD4F9A8842FA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B7CB6A3D-0887-4E7C-ADD8-B89D9F8E7A66}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C26BF341-95ED-478F-8BDE-B43F91A02A34}" = lport=139 | protocol=6 | dir=in | app=system | 
"{D2C4DD8F-4910-4032-A3A2-68A41D57CA8F}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{D8D8B8D3-7948-427A-B213-6FB7F9404F5C}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{DD88B2A4-D893-42A5-9BC5-4269AA6FD6A2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{DEE26831-8DF3-456B-84D7-FDA35AC0523C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{ECFFF5F0-21D6-4FA6-AF7D-65B602389C24}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FC6A611E-FC74-4D65-88D4-B4F7052F4BCA}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{014A6003-92BE-473B-838E-6BACFF9EF414}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{02C8F669-3BF2-45AD-998A-A490E0384591}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{0A6ECA7E-3445-4D9C-93E0-5B2B06FA1BA2}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | 
"{0B1AB39B-30EA-4E57-B09B-369032C9ECC6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{0E9E13B4-58A7-4FD8-BD8F-BDCC49CAF8B2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{103ED349-F5C7-4A8B-95A1-E671FAFEA637}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{1261708B-5E71-4DB3-AE02-EB5B6B6A0E5E}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{1472DDBE-8F15-46EF-8001-3560FD965224}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{1559C067-0AFF-47BD-A165-A0D78AC6BD48}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2AF2A102-FDE8-4321-8248-F60FEBDF5018}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{30D38BE6-D7AD-4454-994A-6AA1F35261DE}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{32291547-78A8-4851-8459-7A5408965189}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{3876889C-AB6C-4CFD-9762-C431F08C1A49}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{38893A20-1389-402A-ABFF-2D299F7317A3}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{3B8BB51E-C465-4D72-849F-D7CC70DF7D0B}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3E9C8112-62AF-4C2A-9AFA-5F7E0F28EC3C}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{4C8B5F4D-2746-4815-909D-3C9C9FA4CDED}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4D5283E5-73F5-4909-8251-48DE3A194284}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{5377F1A6-43B1-4FDC-88C6-82A609C62139}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{54324804-A75D-4055-B6F3-954344EF5917}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{5575C0C1-739E-48E3-9F59-4B5F05424148}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{5C23CE3A-EC71-4B69-BAB0-52B12E4E6425}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{6008AAA7-F6D3-486D-B574-82C1890ECC98}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{6318114D-CA74-461C-907D-3A4F80ADC389}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{6666E796-B1BB-4BB8-88BC-7717F5B901EB}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{66C3FB2F-F0DF-4F0A-B424-F509F0A1EDF4}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{6DDCB517-6977-4806-95D5-302CD36CA205}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{7037D8B4-5AAF-40F4-8DE0-276132096DBE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{86343E94-1DD8-4482-B8C3-EC7FD36F4F95}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{86AC755E-2777-427D-88F2-47BFF8B6C21E}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{86EFCF8B-05A9-4A9A-B43E-5331929FF5EF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{8E1EE149-E008-4B6F-B699-41129B3BE269}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{966091FC-D443-4770-9A39-873C8B15903D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{97312977-5C28-4D7E-82B6-6FA1923349A7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{A943412F-FC47-4D77-8813-89630000E9F1}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{B1DCB529-635B-4249-A5CC-00C0EC8D7C54}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{B26A2CB3-97B4-4EC1-B93E-34C979D155C6}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{BA3E94AD-D898-42AD-B24B-0B67CC4D448B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{BA504E98-ACCD-47BB-AB84-E3FBEF2B259D}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{BCAE4B72-A9A9-4F58-A201-BD3778137167}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{BE0A69DE-7D67-460D-A3AE-F9D703AE1E5B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\polnik\counter-strike\hl.exe | 
"{BE1229CF-E6B9-4ADA-9375-871C323F27F5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\polnik\counter-strike\hl.exe | 
"{BE7E3AC4-40B5-4D1A-B3F6-FFA11F9CFD1C}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{BE99AB80-F195-4BAE-8333-C78CA1520E34}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{BF5B8ED8-9CA5-403B-9EA8-61E6670519BB}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{C95DF809-3047-4F29-AA15-8683EB6EC59B}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{CAA0874C-9BC6-4FDF-A166-53F73ED905FD}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{CB8743D1-450D-4A8E-B768-B4932283630A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{CC03E1B7-8635-4C43-92EA-2559B7AE97D8}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{DB6E9BD2-091C-4008-A2DB-13FE44FF569D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E62F38E3-C7D3-4374-B398-C5F46394DF49}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{EC60A95C-63A6-494D-853C-4E57855AEE4E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{EF1D5EFE-A411-4BEA-B917-F29D96DD342E}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{F09057FF-F203-494B-97C8-8998291A033B}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{F4F2A5E7-220D-4633-BEBC-28F35BBA6D14}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F55FAE31-A2C4-4CA8-9D2F-A41B92687441}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{F8721641-F293-48AE-9C72-0AAF781417B7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{FF9E2DF9-EA36-4363-A5DD-A172CC54CF60}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0A042C19-1F48-4952-B3B6-828E8028A187}" = B209a-m
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{12A1B519-5934-4508-ADBD-335347B0DC87}" = Video Web Camera
"{15F02176-0D12-4FAF-B2CD-2767C7781427}" = Google SketchUp 8
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell PowerSave Solution
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{545DF825-0A9A-499F-B9A8-2A1A355ED7FC}" = PhoenixRC
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5DDB3393-E08B-447E-925F-6C00B95D0FE7}" = iCloud
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9AF0B106-56F1-461B-A270-95BC1682E282}" = Broadcom Gigabit NetLink Controller
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FEF1A18-8F26-4F49-A5A4-956C12210624}" = HP Photosmart Plus B209a-m All-In-One Driver Software 13.0 Rel .6
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B65759DD-26C6-4EA6-9014-CA798907EBFD}" = PS_AIO_06_B209a-m_SW_Min
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"FL Studio_is1" = FL Studio v7.0
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.0.128
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"Identity Card" = Identity Card
"Infocenter" = Infocenter
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Packard Bell MyBackup
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Packard Bell Customer Registration" = Packard Bell Customer Registration
"PackardBell Screensaver" = PackardBell ScreenSaver
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"rgcAudio z3ta Plus v1.40" = rgcAudio z3ta Plus v1.40
"SetupMyPC" = SetupMyPC
"Shop for HP Supplies" = Shop for HP Supplies
"Uninstall_is1" = Uninstall 1.0.0.1
"Updator" = Updator
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Protect Disc License Helper" = Protect Disc License Helper 1.0.125 (IE)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.06.2013 11:08:26 | Computer Name = Gross-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ePowerTray.exe, Version 4.1.3016.0, Zeitstempel
 0x4a409dcb, fehlerhaftes Modul ePowerTray.exe, Version 4.1.3016.0, Zeitstempel 
0x4a409dcb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ca46,  Prozess-ID 0x8c4, Anwendungsstartzeit
 01ce5ed9da5284b0.
 
Error - 01.06.2013 11:17:23 | Computer Name = Gross-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ePowerTray.exe, Version 4.1.3016.0, Zeitstempel
 0x4a409dcb, fehlerhaftes Modul ePowerTray.exe, Version 4.1.3016.0, Zeitstempel 
0x4a409dcb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ca46,  Prozess-ID 0xcac, Anwendungsstartzeit
 01ce5edb1bb39ee7.
 
Error - 01.06.2013 11:25:15 | Computer Name = Gross-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ePowerTray.exe, Version 4.1.3016.0, Zeitstempel
 0x4a409dcb, fehlerhaftes Modul ePowerTray.exe, Version 4.1.3016.0, Zeitstempel 
0x4a409dcb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ca46,  Prozess-ID 0xd04, Anwendungsstartzeit
 01ce5edc34882ab3.
 
Error - 01.06.2013 19:32:36 | Computer Name = Gross-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ePowerTray.exe, Version 4.1.3016.0, Zeitstempel
 0x4a409dcb, fehlerhaftes Modul ePowerTray.exe, Version 4.1.3016.0, Zeitstempel 
0x4a409dcb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000ca46,  Prozess-ID 0xca0, Anwendungsstartzeit
 01ce5f204b166c44.
 
[ System Events ]
Error - 01.06.2013 11:08:24 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 11:17:17 | Computer Name = Gross-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 01.06.2013 11:17:22 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 11:17:22 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 11:24:56 | Computer Name = Gross-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 01.06.2013 11:25:13 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 11:25:13 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 19:32:19 | Computer Name = Gross-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 01.06.2013 19:32:35 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 01.06.2013 19:32:35 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---


2.



SystemLook 30.07.11 by jpshortstuff
Log created at 02:05 on 02/06/2013 by Gross
Administrator - Elevation successful

========== filefind ==========

Searching for "*bprotector*"
No files found.

Searching for "*Babylon*"
C:\Users\Gross\Documents\Meine empfangenen Dateien\05-Ricky L feat. MCK - Born Again (Babylonia) (Balearic Soul Party Mix).mp3 --a---- 9005056 bytes [11:04 17/10/2010] [11:14 17/10/2010] AA87719105865F4CD1E50274B4C99515

Searching for "*BrowserProtect*"
C:\Windows\System32\Tasks\BrowserProtect --a---- 3346 bytes [14:30 01/06/2013] [14:32 01/06/2013] D9A0473DAE553D232F4706825D80F69E

Searching for "*ICQ6Toolbar*"
No files found.

Searching for "*Iminent*"
No files found.

Searching for "*IBUpdater*"
No files found.

Searching for "*PerformerSoft*"
No files found.

Searching for "*dvdvideosoftiehelpers*"
No files found.

Searching for "*DataMngr*"
No files found.

Searching for "*Softonic*"
No files found.

Searching for "*YahooPartnerToolbar*"
No files found.

Searching for "*holasearch*"
No files found.

========== folderfind ==========

Searching for "*bprotector*"
No folders found.

Searching for "*Babylon*"
C:\Program Files\ICQ7.2\Xtraz\icq\theme\babylon_feed d------ [17:56 29/12/2010]

Searching for "*BrowserProtect*"
No folders found.

Searching for "*ICQ6Toolbar*"
No folders found.

Searching for "*Iminent*"
No folders found.

Searching for "*IBUpdater*"
No folders found.

Searching for "*PerformerSoft*"
No folders found.

Searching for "*dvdvideosoftiehelpers*"
No folders found.

Searching for "*DataMngr*"
No folders found.

Searching for "*Softonic*"
No folders found.

Searching for "*YahooPartnerToolbar*"
No folders found.

Searching for "*holasearch*"
No folders found.

========== regfind ==========

Searching for "bprotector"
No data found.

Searching for "Babylon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"

Searching for "BrowserProtect"
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe"="Application Manager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1DF7F088-C634-4B59-8424-0FE9F49FA146}]
"Path"="\BrowserProtect"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BrowserProtect]
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe"="Application Manager"
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe"="Application Manager"

Searching for "ICQ6Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\ICQ\ICQToolbar]
"InstallDir"="C:\Program Files\ICQ6Toolbar\"

Searching for "Iminent"
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files\Iminent\inst\Bootstrapper\Bootstrapper.exe"="Iminent Setup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Iminent\inst\Bootstrapper\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Iminent\inst\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Iminent\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C]
"00000000000000000000000000000000"="C:\Program Files\Iminent\StartWeb.xml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A71991503412AEB42838B02C5ED9F9CD]
"00000000000000000000000000000000"="C:\Program Files\Iminent\UniverselyWeb.xml"
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files\Iminent\inst\Bootstrapper\Bootstrapper.exe"="Iminent Setup"
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files\Iminent\inst\Bootstrapper\Bootstrapper.exe"="Iminent Setup"

Searching for "IBUpdater"
No data found.

Searching for "PerformerSoft"
No data found.

Searching for "dvdvideosoftiehelpers"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to Mp3 Converter]
@="C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm"
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to Mp3 Converter]
@="C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm"

Searching for "DataMngr"
No data found.

Searching for "Softonic"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\6b323f20_0]
@="{0.0.0.00000000}.{a267ff2d-3149-49e9-80a1-28a8af6306ec}|\Device\HarddiskVolume2\Users\Gross\Downloads\SoftonicDownloader_fuer_logiccircuit.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-3343815118-449700181-1052238350-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\6b323f20_0]
@="{0.0.0.00000000}.{a267ff2d-3149-49e9-80a1-28a8af6306ec}|\Device\HarddiskVolume2\Users\Gross\Downloads\SoftonicDownloader_fuer_logiccircuit.exe%b{00000000-0000-0000-0000-000000000000}"

Searching for "YahooPartnerToolbar"
No data found.

Searching for "holasearch"
No data found.

-= EOF =-










Der Rechner läuft erstaunlich stabil und reagiert schneller.

Beim Neustarten vom Rechner erscheint eine Meldung:

AppleSyncNotifier.exe - Einsprungspunkt nicht gefunden

Der Proredureinsprungspunkt "xmlTextReaderConstName" wurde in der DLL "libxml2.dll" nicht gefunden

Probleme mit Hola-Search: Im Verlauf von dem Mozilla Browser ist Hola-Search noch zu finden.

Servus,




wir entfernen jetzt noch die letzten Funde und kontrollieren nochmal alles.


Die gepostet Fehlermeldung könnte von einem Apple Programm kommen. Evtl. musst du dieses deinstallieren und anschließend neu installieren.




Schritt 1

• Folge folgendem Pfad: Start -> Systemsteuerung -> Software / Programme deinstallieren
• Suche in der Liste Software mit dem folgenden Namen
  • Apple Mobile Device Support
  und deinstalliere das Programm.
• Solltest du am Ende der Deinstallation zu einem Neustart aufgefordert werden, so führe diesen durch.
• Sollte es Probleme mit der Deinstallation geben, so lass es mich bitte wissen.

Schritt 2

• Öffne Firefox
• Klicke auf Firefox > Einstellungen > Einstellungen
• Unter Datenschutz klicke auf gesamte bisherige Chronik löschen.
• Wähle oben Alles aus.
• Setzte darunter überall (sofern möglich) ein Häkchen und klicke auf Jetzt Löschen.
• Schließe die Firefox Einstellungen wieder mit Ok.
• Schließe Firefox.

Schritt 3

Fixen mit OTL

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

:OTL
SRV - File not found [Auto | Stopped] --  -- (gupdate1cac2454df83dc4)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
O4 - HKLM..\Run: []  File not found
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
[2013.05.26 15:42:30 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.06.01 16:40:13 | 000,000,097 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\ICQ\ICQToolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A71991503412AEB42838B02C5ED9F9CD]

:Commands
[emptytemp]
         

• Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
• Schließe bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
  ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
  Kopiere nun den Inhalt hier in Deinen Thread

Schritt 4
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 5

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 6
Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.





Bitte poste mit deiner nächsten Antwort

• die Logdatei von OTL,
• die Logdatei von MBAM,
• die Logdatei von ESET,
• die Logdatei von SecurityCheck.

Zu Schritt 3: Welchen Benutzername -> "*****" ?

Zitat von wodnik

Zu Schritt 3: Welchen Benutzername -> "*****" ?

Du hast deinen Namen nicht unkenntlich gemacht, also brauchst du diesen Hinweis nicht beachten.

Problem bei Schritt 6 Security-Check


Kaspersky sagt Malware/ Datei-Anti-Virus. -> Speziellen Desinfektionsvorgang ausführen? Ja, bei Neustart (empfohlen) / Nicht ausführen.

Zitat von wodnik

Kaspersky sagt Malware/ Datei-Anti-Virus. -> Speziellen Desinfektionsvorgang ausführen? Ja, bei Neustart (empfohlen) / Nicht ausführen.

Das ist Fehler von Kaspersky.... dein AV Programm bitte deaktivieren während SecurityCheck läuft.