Deinstallieren von : HEUR: Exploit.Java.CVE-2013-2423.gen

Meklura

Frage:
Kaspersky Internet Security (KIS) 2013 hat bei der letzten Untersuchung folgendes trojanisches Programm entdeckt: "HEUR:Exploit.Java.CVE-2013-2423.gen". Programm "inaktiv".

Wie kann ich dieses trojanische Programm löschen/deinstallieren ?

Problem:
Ich bin leider PC-mäßig ein vollkommener Laie.

Anbei: OTL.txt; EXTRAS.txt; Gmer.txt

Vielen Dank für die Hilfe bereits im Voraus!

OTL logfile created on: 17.06.2013 20:11:02 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,38 Gb Available Physical Memory | 68,97% Memory free
3,84 Gb Paging File | 3,41 Gb Available in Paging File | 88,75% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,65 Gb Total Space | 54,66 Gb Free Space | 55,97% Space Free | Partition Type: NTFS
Drive D: | 135,22 Gb Total Space | 135,15 Gb Free Space | 99,95% Space Free | Partition Type: NTFS

Computer Name: RALPH-92E2022C3 | User Name: Kluttig | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.06.17 18:06:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\Downloads\OTL.exe
PRC - [2013.04.26 12:20:45 | 000,181,664 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe
PRC - [2013.03.12 07:32:50 | 000,253,816 | ---- | M] (Oracle Corporation) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2013.01.24 12:25:38 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
PRC - [2012.08.11 17:43:06 | 000,055,184 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2012.01.03 16:31:34 | 001,391,272 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2011.12.08 20:33:36 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011.12.08 20:31:24 | 001,527,104 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011.11.10 14:05:00 | 001,694,608 | ---- | M] (Bandoo Media, inc) -- C:\Programme\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
PRC - [2008.08.08 07:03:41 | 000,524,288 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.11.13 19:38:28 | 002,510,848 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.bin
PRC - [2007.11.13 19:38:26 | 002,359,296 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.exe


========== Modules (No Company Name) ==========

MOD - [2013.01.24 12:25:34 | 001,310,136 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll
MOD - [2012.11.28 15:13:52 | 000,087,952 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll
MOD - [2012.11.28 15:13:30 | 001,242,512 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll
MOD - [2012.08.17 22:38:56 | 000,479,160 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
MOD - [2008.08.08 07:03:41 | 000,524,288 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
MOD - [2007.08.13 11:39:15 | 000,022,723 | ---- | M] () -- C:\WINDOWS\system32\cl31cl3.dll
MOD - [2007.08.08 19:15:02 | 000,828,416 | ---- | M] () -- C:\Programme\OpenOffice.org 2.3\program\libxml2.dll


========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2013.06.12 19:35:35 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.17 21:27:35 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.04.26 12:20:45 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013.01.24 12:25:38 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2012.08.11 17:43:06 | 000,055,184 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2011.12.08 20:31:24 | 001,527,104 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.12.08 20:28:00 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTGLM7X.sys -- (SetupNTGLM7X)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTACCESS.sys -- (NTACCESS)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\install4\MSICPL.sys -- (MSICPL)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2013.04.25 18:16:27 | 000,591,968 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2013.04.25 18:16:27 | 000,145,040 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kneps.sys -- (kneps)
DRV - [2013.04.25 18:16:27 | 000,044,432 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kltdi.sys -- (kltdi)
DRV - [2012.10.25 13:42:02 | 000,024,920 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2012.10.25 13:42:02 | 000,024,408 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klkbdflt.sys -- (klkbdflt)
DRV - [2012.06.27 15:09:08 | 000,035,672 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2012.06.19 18:28:12 | 000,136,024 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1)
DRV - [2010.10.07 12:34:32 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.08.21 03:08:00 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2009.08.21 03:08:00 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2009.08.21 03:08:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007.05.17 15:57:36 | 002,164,736 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007.05.10 12:28:08 | 004,419,584 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2007.04.14 10:28:00 | 000,094,592 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007.01.29 20:26:24 | 000,984,832 | R--- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2007.01.12 20:09:53 | 000,082,296 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02)
DRV - [2006.12.28 06:44:44 | 000,084,992 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdAud.sys -- (HdAudAddService)
DRV - [2006.07.10 18:19:58 | 000,027,032 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02)
DRV - [2006.07.05 14:46:06 | 000,063,352 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01a.sys -- (sfdrv01a)
DRV - [2006.07.02 00:30:28 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2006.06.14 16:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A4 9B 8D 61 04 48 CE 01 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{66931605-E952-4653-B60F-2731E71F7B20}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=60477ADB-E5B5-4CAB-9E10-7AED9212FD17&apn_sauid=CD00E7F6-0E9D-41D8-87B9-AEF972CBAECA
IE - HKCU\..\SearchScopes\{9A91B9B3-F488-407B-9B0C-B280531C437D}: "URL" = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADRA_de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.30 14:40:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013.04.25 18:16:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013.04.25 18:16:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013.04.25 18:16:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013.04.25 18:16:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013.04.25 18:16:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.05.17 21:27:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.05.17 21:27:26 | 000,000,000 | ---D | M]

[2012.01.26 17:10:12 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\Mozilla\Extensions
[2013.05.10 09:01:17 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\Mozilla\Firefox\Profiles\lh47inzy.default-1348742887734\extensions
[2012.10.18 12:00:26 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\Mozilla\Firefox\Profiles\lh47inzy.default-1348742887734\extensions\toolbar@ask.com
[2013.05.10 09:01:17 | 000,870,680 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\Mozilla\Firefox\Profiles\lh47inzy.default-1348742887734\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.01.03 16:27:44 | 000,002,333 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\Mozilla\Firefox\Profiles\lh47inzy.default-1348742887734\searchplugins\askcom.xml
[2013.05.17 21:27:37 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.05.17 21:27:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.17 21:27:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.05.17 21:27:24 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
[2013.05.17 21:27:24 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
[2013.05.17 21:27:37 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.05.17 21:27:37 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.04.25 18:16:32 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAMME\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM
[2013.02.25 19:06:28 | 000,171,584 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Programme\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.01.26 17:09:54 | 000,002,515 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml

O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\Kluttig\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk = C:\Programme\OpenOffice.org 2.3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {4D054067-DE3A-48F9-B19B-BCD229B9AE8D} hxxp://www.samsungdp.com/printerhelp/ActiveX/DrPrinter.cab (PrinterHelpEtcActiveX Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222177035406 (MUWebControl Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77882B82-07C5-4100-8AA6-5C3F6A5CA2EB}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI9130~1\Datamngr\datamngr.dll) - C:\Programme\Windows Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI9130~1\Datamngr\IEBHO.dll) - C:\Programme\Windows Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Kluttig\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Kluttig\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2007.12.06 17:10:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{8b50fe1d-adcb-11de-adfa-0019dbd0a945}\Shell\AutoRun\command - "" = J:\instdata\xaver\bin\xaver.exe -id intro -skin allianz wk_gesetze_usb
O33 - MountPoints2\{8b50fe1d-adcb-11de-adfa-0019dbd0a945}\Shell\command - "" = J:\instdata\xaver\bin\xaver.exe -id intro -skin allianz wk_gesetze_usb
O33 - MountPoints2\{90a4595d-4fa7-11e0-be58-0019dbd0a945}\Shell\AutoRun\command - "" = F:\Menu.exe
O33 - MountPoints2\{b01fbdd5-0922-11df-b8a8-0019dbd0a945}\Shell - "" = AutoRun
O33 - MountPoints2\{b01fbdd5-0922-11df-b8a8-0019dbd0a945}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b01fbdd5-0922-11df-b8a8-0019dbd0a945}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.17 20:04:11 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Kluttig\Recent
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.06.17 20:10:00 | 000,000,230 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.06.17 20:08:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.06.17 20:08:22 | 2146,816,000 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.17 19:35:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.06.17 19:34:32 | 000,000,835 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Desktop\Verknüpfung mit gmer_2.1.19163.lnk
[2013.06.17 19:25:09 | 000,000,805 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Desktop\Verknüpfung mit Defogger.lnk
[2013.06.17 19:24:00 | 000,000,774 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Desktop\Verknüpfung mit OTL.lnk
[2013.06.17 18:02:45 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\defogger_reenable
[2013.06.17 16:12:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013.06.16 17:54:01 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013.06.15 10:17:56 | 000,057,631 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\1011172_465244493561655_1105679321_n.jpg
[2013.06.14 15:36:41 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.06.12 16:26:39 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013.06.11 13:19:15 | 000,006,281 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\231_239_03706_Bestätigung der Annahme UStVA 2012 - 4. Quartal_ElsterOnline2.pdf
[2013.05.26 21:42:34 | 000,000,848 | ---- | M] () -- C:\Dokumente und Einstellungen\Kluttig\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.06.17 19:34:32 | 000,000,835 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Desktop\Verknüpfung mit gmer_2.1.19163.lnk
[2013.06.17 19:25:09 | 000,000,805 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Desktop\Verknüpfung mit Defogger.lnk
[2013.06.17 19:24:00 | 000,000,774 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Desktop\Verknüpfung mit OTL.lnk
[2013.06.17 17:53:51 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\defogger_reenable
[2013.06.15 10:17:55 | 000,057,631 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\1011172_465244493561655_1105679321_n.jpg
[2013.06.11 10:46:43 | 000,006,281 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\231_239_03706_Bestätigung der Annahme UStVA 2012 - 4. Quartal_ElsterOnline2.pdf
[2013.05.26 21:42:34 | 000,000,848 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk
[2012.12.20 19:29:38 | 000,010,599 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Meklura_elster_2048.pfx
[2012.02.16 09:43:53 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.15 13:26:45 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.01.23 13:57:09 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2009.09.11 11:24:43 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2008.06.24 11:28:22 | 000,015,872 | ---- | C] () -- C:\Dokumente und Einstellungen\Kluttig\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.12.06 17:44:13 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

========== ZeroAccess Check ==========

[2007.12.06 17:46:00 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 04:22:25 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 04:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013.01.13 16:43:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012.10.18 11:50:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask
[2012.10.23 13:31:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2012.07.05 16:13:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2007.12.06 19:17:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2009.10.20 18:11:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TrackMania United
[2012.08.04 15:01:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2012.08.03 22:25:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WEBDE
[2013.03.19 16:16:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\.minecraft
[2011.12.30 14:41:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\DDMSettings
[2012.07.05 16:14:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\elsterformular
[2012.01.26 17:04:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\FreeAudioPack
[2011.04.29 19:25:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\LG Electronics
[2008.10.15 20:43:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\MSNInstaller
[2012.01.28 13:13:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\searchquband
[2012.01.28 13:13:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\searchqutoolbar
[2012.08.03 22:25:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\SmartSurfer
[2012.08.04 14:58:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\TuneUp Software
[2012.08.03 22:25:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kluttig\Anwendungsdaten\WEBDE

========== Purity Check ==========



< End of report >

OTL Extras logfile created on: 17.06.2013 18:07:25 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Kluttig\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 56,78% Memory free
3,84 Gb Paging File | 3,08 Gb Available in Paging File | 80,17% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,65 Gb Total Space | 54,60 Gb Free Space | 55,91% Space Free | Partition Type: NTFS
Drive D: | 135,22 Gb Total Space | 135,15 Gb Free Space | 99,95% Space Free | Partition Type: NTFS

Computer Name: RALPH-92E2022C3 | User Name: Kluttig | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\TrackMania United\TmUnited.exe" = C:\Programme\TrackMania United\TmUnited.exe:*:Enabled:TmUnited -- ()
"C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Programme\Windows Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe:*:EnabledTX broker -- (Visicom Media Inc.)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Programme\Bonjour\mDNSResponder.exe" = C:\Programme\Bonjour\mDNSResponder.exe:*:Enabledienst "Bonjour" -- (Apple Inc.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00030407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Small Business
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00E496EB-5A5B-A998-9FF2-424A92BABA9B}" = CCC Help Japanese
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07609E38-A02A-07F8-73A2-AC6C25E69638}" = Catalyst Control Center Graphics Light
"{07BEDD0C-50F5-DCEB-454A-13BBA039DEFC}" = CCC Help English
"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION
"{09939F99-C34A-7233-5EED-8B49FA540BF4}" = Catalyst Control Center Localization Hungarian
"{0AD80596-57E4-63A1-58E9-0CABC290C7E7}" = Catalyst Control Center Localization Thai
"{0DCE2831-93B9-BE50-7C89-786521CAAEBF}" = CCC Help Thai
"{0F5C0F08-A81A-25AC-90EE-BC908AE43E13}" = ccc-utility
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{158140DF-5B6D-3201-D5DF-63BD0E15B4D8}" = CCC Help Polish
"{15AD0EB0-66CC-094F-C7A1-5A5A5B104CBC}" = Catalyst Control Center Graphics Previews Common
"{227A080C-B0BF-CC7D-3137-4B64CF083F7D}" = CCC Help French
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2B840A47-C17C-683C-A5DE-F9B342BD5AAF}" = CCC Help Portuguese
"{2BAFD97B-30EE-5E6B-A1B0-666893727EEB}" = CCC Help Norwegian
"{34DE4705-909A-728D-E909-BA8B2C8BADB0}" = CCC Help Chinese Traditional
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3749BD99-4124-AFBD-A1C6-D50F35F60278}" = Catalyst Control Center Localization Turkish
"{38B3EA53-E7D5-89C7-83AB-D2C45CE8B318}" = CCC Help Russian
"{3A7A2683-589A-F91A-FB89-6A29E5A07A81}" = Catalyst Control Center Localization Polish
"{3A9C01BB-BFF3-692D-DEB3-F1B26667AA6A}" = CCC Help Turkish
"{3FF1EA42-9A52-5829-B3B6-0786B7782127}" = Catalyst Control Center Localization Russian
"{405A6A6A-8519-52ED-B212-8422D3A68037}" = CCC Help Swedish
"{42BD6963-8B25-7DC7-EACC-7E5F0402FF7F}" = Catalyst Control Center Localization Dutch
"{459699C3-9430-4381-964B-4248D87B49F9}" = Apple Mobile Device Support
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51D4E7CD-92AC-518F-75D9-BA4AFAFA41A4}" = Catalyst Control Center Localization Chinese Traditional
"{52E52AF0-9508-3A65-5A81-26C344C14171}" = CCC Help Italian
"{53771D20-41A5-F9D9-810B-17B636F30B36}" = Catalyst Control Center Localization Chinese Standard
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{615871A2-2AA3-2728-3C1D-6C6B40246B1A}" = Catalyst Control Center Core Implementation
"{6A740790-6A18-2D14-0A6F-8C162733416D}" = Catalyst Control Center Localization Swedish
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{74903FDD-9B95-75AC-4AFA-3C363AA3A9C9}" = CCC Help Chinese Standard
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7902E313-FF0F-4493-ACB1-A8147B78DCD0}" = HPSSupply
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79F21E91-A669-87B9-7B1C-A44858B6A050}" = Catalyst Control Center Localization Czech
"{7EA21982-40BC-3DAE-F28F-59A3269B5684}" = Catalyst Control Center Localization Danish
"{8509C6C3-AE0F-9264-7C07-F3A2CA0A0ED3}" = CCC Help Greek
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8770DCB2-E559-2015-FFFF-9108FE5244AF}" = CCC Help German
"{884E125A-DF2A-B1F8-E9D4-1E2EACDFD1C5}" = Catalyst Control Center Localization Norwegian
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{897AC50D-A6D4-BA66-04A4-5670525D6E53}" = CCC Help Hungarian
"{8F386713-FF80-BFEC-B485-9B947A102628}" = CCC Help Spanish
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{909F0729-E612-3ADA-33D3-81CC657CDDB5}" = ccc-core-static
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9595227C-36DC-287F-7A96-89DF89A1A176}" = Catalyst Control Center Localization German
"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E403F82-6AF4-1041-AF28-DD0850F0DD26}" = CCC Help Dutch
"{A0703699-AF1B-AFFC-ADBB-71335895B4E4}" = CCC Help Korean
"{A224B56B-D297-AF86-86E1-101BEC645F44}" = Skins
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A479FCD2-19DF-B215-8DA4-357BE9BC73D1}" = Catalyst Control Center Localization Portuguese
"{A82D052A-0806-42DF-80CD-1730A1AC0ED3}" = MrvlUsgTracking
"{AA8CF082-D505-A6F6-012B-4F100D0CB732}" = Catalyst Control Center Graphics Full New
"{ABD7DBE3-E344-4BCA-B8AD-4360494DD1D9}" = LG MC USB U330 driver
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{AD09CC9A-6901-4921-B66D-9402FF32EF27}_is1" = PDF-XChange Lite 2012
"{B0261E53-B6F1-474A-864B-E7C3CBF468E0}" = iTunes
"{B801BB90-D033-9815-79D1-DF25DB123297}" = CCC Help Czech
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB7754B4-C226-1B75-7EBF-042492B9FBE6}" = CCC Help Finnish
"{BD25EFA9-F937-A35E-EF00-55AF2AA8D0BB}" = Catalyst Control Center Localization Italian
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4813A99-BF27-E270-4311-F14712A6615E}" = Catalyst Control Center Localization Finnish
"{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}" = AVIVO Codecs
"{CA4D9B60-60B1-497F-BFD1-F60CC9D882AA}" = Crazy Machines Gold Edition
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D137B59C-551C-4659-8AA8-206FA650BF40}" = LG USB Modem Drivers
"{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}" = Canon PhotoRecord
"{D9817EC6-104D-BB73-EE0B-4AC897DE72F9}" = Catalyst Control Center Localization Korean
"{DB43EB58-9629-C7D6-1DCB-C5BC98D052E1}" = Catalyst Control Center Graphics Full Existing
"{DD5B65F7-7CA5-4DE4-AEE7-7E8F26BF78F5}" = OpenOffice.org 2.3
"{E2AA11B8-4B98-FDBD-1E8A-4499D8CA3BFA}" = Catalyst Control Center Localization Spanish
"{EF47A29F-D565-DAF3-9F91-8AB4F598AB81}" = Catalyst Control Center Localization Greek
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1A68156-BA7B-11A4-06DE-DB5776FC790B}" = Catalyst Control Center Localization Japanese
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F5F10078-CC82-21C6-4FA5-CEFBBAA788CD}" = ccc-core-preinstall
"{F8AF1965-6271-C4A1-D651-41850F9B1CB0}" = CCC Help Danish
"{FCD43500-A909-C3DF-7A60-08ECBDD410A8}" = Catalyst Control Center Localization French
"3B18191663CDFABAA2A93D4267E54D683153FF60" = Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"DivX Setup" = DivX-Setup
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Easy-WebPrint" = Easy-WebPrint
"ElsterFormular 13.2.0.8623u" = ElsterFormular
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Samsung CLP-310 Series" = Samsung CLP-310 Series
"SchmerzensgeldBeträge2_is1" = SchmerzensgeldBeträge
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"TmUnited_is1" = TrackMania United 0.2.0.8
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"VLC media player" = VLC media player 1.1.11
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Searchqu Toolbar" = Windows Searchqu Toolbar
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 13.06.2013 12:08:13 | Computer Name = RALPH-92E2022C3 | Source = Application Hang | ID = 1001
Description = Fehlerhafter Speicherbereich -710996888.

Error - 13.06.2013 12:58:22 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 13.06.2013 12:58:22 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1485188

Error - 13.06.2013 12:58:22 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1485188

Error - 16.06.2013 14:51:28 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 16.06.2013 14:51:28 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1953

Error - 16.06.2013 14:51:28 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1953

Error - 16.06.2013 16:40:27 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 16.06.2013 16:40:27 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6540515

Error - 16.06.2013 16:40:27 | Computer Name = RALPH-92E2022C3 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6540515

[ System Events ]
Error - 16.06.2013 05:15:13 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2013 05:15:13 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2013 17:25:03 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2013 17:25:03 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2013 06:18:09 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2013 06:18:09 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2013 07:43:37 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2013 07:43:37 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2013 09:43:28 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2013 09:43:28 | Computer Name = RALPH-92E2022C3 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2


< End of report >

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-17 22:17:45
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e MAXTOR_STM3250310AS rev.3.AAC 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\DOKUME~1\Kluttig\LOKALE~1\Temp\kfldaaow.sys


---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAdjustPrivilegesToken [0xAA1479E4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwClose [0xAA0E3410]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwConnectPort [0xAA0FA588]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateEvent [0xAA0E3988]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateMutant [0xAA0E386E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreatePort [0xAA0FA8AE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateProcess [0xAA14995E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateProcessEx [0xAA149B7A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSection [0xAA14AA3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSemaphore [0xAA0E3AA8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThread [0xAA14A03E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateWaitablePort [0xAA0FA97C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDebugActiveProcess [0xAA149804]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeleteKey [0xAA0F460E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeleteValueKey [0xAA0F5DF6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeviceIoControlFile [0xAA0E3454]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDuplicateObject [0xAA147B26]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwEnumerateKey [0xAA0F5602]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwEnumerateValueKey [0xAA0F5F96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadDriver [0xAA14778E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadKey [0xAA0F5146]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadKey2 [0xAA0F539E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwMapViewOfSection [0xAA14A836]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwNotifyChangeKey [0xAA0F8D4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenEvent [0xAA0E3A1E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenMutant [0xAA0E38FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenProcess [0xAA1493AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSection [0xAA14ACEA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSemaphore [0xAA0E3B3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenThread [0xAA149D9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryKey [0xAA0F4442]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryMultipleValueKey [0xAA0F5C04]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryObject [0xAA0F8F58]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryValueKey [0xAA0F59F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueueApcThread [0xAA14A6EA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRenameKey [0xAA0F4722]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplaceKey [0xAA0F4D94]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplyPort [0xAA0FABBC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplyWaitReceivePort [0xAA0FAA4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplyWaitReceivePortEx [0xAA0FAB00]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRequestWaitReplyPort [0xAA0FAC2C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRestoreKey [0xAA0F4F9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwResumeThread [0xAA14A414]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKey [0xAA0F48C6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKeyEx [0xAA0F4A5C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveMergedKeys [0xAA0F4BF8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSecureConnectPort [0xAA0FA716]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetContextThread [0xAA14A572]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetInformationToken [0xAA0E3BC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetSystemInformation [0xAA147898]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetValueKey [0xAA0F57C2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendProcess [0xAA14954C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendThread [0xAA14A2BC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSystemDebugControl [0xAA0E3BDA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateProcess [0xAA1496AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateThread [0xAA149F3A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwUnmapViewOfSection [0xAA14AE52]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwWriteVirtualMemory [0xAA14AB7C]

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2D40 80504628 12 Bytes [AE, A8, 0F, AA, 5E, 99, 14, ...] {SCASB ; TEST AL, 0xf; STOSB ; POP ESI; CDQ ; ADC AL, 0xaa; JP 0xffffffa5; ADC AL, 0xaa}
.text ntkrnlpa.exe!ZwCallbackReturn + 2E0C 805046F4 12 Bytes [8E, 77, 14, AA, 46, 51, 0F, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2E7C 80504764 8 Bytes [EA, AC, 14, AA, 3E, 3B, 0E, ...] {JMP FAR 0xe3b:0x3eaa14ac; STOSB }
.text ntkrnlpa.exe!ZwCallbackReturn + 2F58 80504840 4 Bytes JMP E0AA14A6
.text ntkrnlpa.exe!ZwCallbackReturn + 2F88 80504870 20 Bytes [22, 47, 0F, AA, 94, 4D, 0F, ...]
.text ...

---- User code sections - GMER 2.1 ----

? C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[216] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[216] ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes JMP 6CD01A54 C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\ushata.dll
? C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[216] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[216] USER32.dll!AlignRects 7E362A78 4 Bytes [53, 2A, D0, 6C] {PUSH EBX; SUB DL, AL; INS BYTE [ES:EDI], DX}
? C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[880] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[880] ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes JMP 6CD01A54 C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\ushata.dll
? C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[880] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[880] USER32.dll!AlignRects 7E362A78 4 Bytes [53, 2A, D0, 6C] {PUSH EBX; SUB DL, AL; INS BYTE [ES:EDI], DX}

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\Tcpip \Device\Ip kltdi.sys
AttachedDevice \Driver\Tcpip \Device\Tcp kltdi.sys

Device \Driver\atapi \Device\Ide\IdePort0 sfsync02.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 sfsync02.sys
Device \Driver\atapi \Device\Ide\IdePort1 sfsync02.sys
Device \Driver\atapi \Device\Ide\IdePort2 sfsync02.sys
Device \Driver\atapi \Device\Ide\IdePort3 sfsync02.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-e sfsync02.sys
Device \Driver\USBSTOR \Device\00000075 sfsync02.sys
Device \Driver\USBSTOR \Device\00000076 sfsync02.sys
Device \Driver\USBSTOR \Device\00000077 sfsync02.sys
Device \Driver\USBSTOR \Device\00000078 sfsync02.sys
Device \Driver\USBSTOR \Device\00000079 sfsync02.sys

AttachedDevice \Driver\Tcpip \Device\Udp kltdi.sys
AttachedDevice \Driver\Tcpip \Device\RawIp kltdi.sys

---- EOF - GMER 2.1 ----

Na, ob das so richtig war, mit den drei Berichten?