Hallo zusammen,


Ich habe mir den Bundestrojaner *Schweiz Poliyei* eingefangen.


Ich habe mit Anleitungen aus dem Forum OTLPE Heruntergeladen und gebrannt. Jetzt befinde ich mich im System Reatogo/X/EP.

Ich habe OTLPE gestartet und gescannt.

Jetzt brauche ich den fix.. habe alles probier es funktioniert nicht.


Hier waeren meine Daten>

OTL logfile created on: 6/23/2013 6:51:05 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 87.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = J: | %SystemRoot% = J:\Windows | %ProgramFiles% = J:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.33 Mb Free Space | 74.33% Space Free | Partition Type: NTFS
Drive D: | 29.80 Gb Total Space | 29.47 Gb Free Space | 98.87% Space Free | Partition Type: FAT32
Drive J: | 225.95 Gb Total Space | 99.47 Gb Free Space | 44.02% Space Free | Partition Type: NTFS
Drive K: | 226.71 Gb Total Space | 226.22 Gb Free Space | 99.78% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2013/02/25 17:05:10 | 000,384,048 | ---- | M] (McAfee, Inc.) [On_Demand] -- J:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV:64bit: - [2013/02/19 07:56:14 | 000,182,752 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Windows\System32\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2013/02/19 07:53:32 | 000,218,760 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire)
SRV:64bit: - [2013/02/19 07:51:54 | 000,241,456 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe -- (McShield)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Disabled] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McOobeSv)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV:64bit: - [2012/08/31 07:20:06 | 000,201,304 | ---- | M] (McAfee, Inc.) [Auto] -- J:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV:64bit: - [2011/01/28 06:28:54 | 000,225,216 | ---- | M] (McAfee, Inc.) [On_Demand] -- J:\Program Files\McAfee\MSC\McAWFwk.exe -- (McAWFwk)
SRV:64bit: - [2010/02/25 05:28:32 | 000,036,168 | ---- | M] (TuneUp Software) [Auto] -- J:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto] -- J:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2013/06/12 00:30:31 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- J:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto] -- J:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/03/21 14:54:18 | 004,561,152 | ---- | M] () [Auto] -- J:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll -- (Akamai)
SRV - [2013/02/28 12:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto] -- J:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/06/11 10:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand] -- J:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012/06/11 10:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto] -- J:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012/03/21 06:23:14 | 000,793,048 | ---- | M] (PC Tools) [Auto] -- J:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc)
SRV - [2010/02/28 09:32:32 | 000,607,048 | ---- | M] (TuneUp Software) [On_Demand] -- J:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag) @C:\Program Files (x86)
SRV - [2010/02/25 05:35:06 | 001,398,088 | ---- | M] (TuneUp Software) [Auto] -- J:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/02/25 05:28:24 | 000,030,024 | ---- | M] (TuneUp Software) [Auto] -- J:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2009/08/12 18:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto] -- J:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009/08/06 13:18:54 | 000,311,592 | ---- | M] () [Auto] -- J:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009/07/28 15:25:34 | 000,935,208 | ---- | M] (Nero AG) [On_Demand] -- J:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- J:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 22:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- J:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/06/04 09:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto] -- J:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2007/06/05 07:20:32 | 000,177,704 | ---- | M] () [Auto] -- J:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing)
SRV - [2007/01/19 06:49:26 | 000,049,152 | ---- | M] (Wireless Service) [Auto] -- J:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService)
SRV - [2007/01/10 22:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto] -- J:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013/02/19 07:59:06 | 000,070,112 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2013/02/19 07:56:26 | 000,340,216 | ---- | M] (McAfee, Inc.) [Kernel | Boot] -- J:\Windows\System32\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2013/02/19 07:55:14 | 000,106,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2013/02/19 07:54:32 | 000,771,536 | ---- | M] (McAfee, Inc.) [Kernel | Boot] -- J:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2013/02/19 07:53:42 | 000,515,968 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2013/02/19 07:53:02 | 000,309,840 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2013/02/19 07:52:44 | 000,179,280 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2012/04/20 10:40:58 | 000,196,440 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\HipShieldK.sys -- (HipShieldK)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/12 06:19:58 | 000,287,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\e1y62x64.sys -- (e1yexpress) Intel(R)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- J:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\netr7364.sys -- (netr7364)
DRV:64bit: - [2009/06/10 16:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- J:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- J:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/02 07:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- J:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 07:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- J:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 07:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- J:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/05/25 16:13:10 | 000,138,752 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV:64bit: - [2008/02/01 10:14:50 | 000,735,232 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\rt2870.sys -- (rt2870)
DRV - [2009/10/14 03:24:44 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand] -- J:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2007/05/12 11:39:32 | 000,048,128 | ---- | M] (Alpha Networks Inc.) [Kernel | Auto] -- J:\Windows\SysWOW64\ANIO64.sys -- (ANIO)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\irene_ON_J\Software\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\irene\Documents
IE - HKU\irene_ON_J\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0807&m=aspire_m3802&r=17360110ln16973754s15ud821gu89
IE - HKU\irene_ON_J\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bluewin.ch/
IE - HKU\irene_ON_J\..\URLSearchHook: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - Reg Error: Key error. File not found
IE - HKU\irene_ON_J\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - Reg Error: Key error. File not found
IE - HKU\irene_ON_J\..\URLSearchHook: {90eee664-34b1-422a-a782-779af65cdf6d} - Reg Error: Key error. File not found
IE - HKU\irene_ON_J\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - Reg Error: Key error. File not found
IE - HKU\irene_ON_J\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
IE - HKU\irene_ON_J\..\URLSearchHook: {e84cc2c1-b722-48fc-a39c-edb8b525c777} - Reg Error: Key error. File not found
IE - HKU\irene_ON_J\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\irene_ON_J\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>




FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: J:\Program Files\McAfee\MSC\npMcSnFFPl64.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: J:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: J:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@innoplus.de/inoPanoViewer: J:\Program Files (x86)\innoPlus\Rundum-Betrachter-innoPlus\npirsviewer.dll (INNOVA-engineering GmbH Dresden)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: J:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: J:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@mcafee.com/MSC,version=10: J:\Program Files (x86)\McAfee\MSC\npMcSnFFPl.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@mcafee.com/SAFFPlugin: J:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll (McAfee, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: J:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: J:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: J:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: J:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: J:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: J:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\quickprint@hp.com: C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2013/04/16 15:40:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2013/06/14 13:00:59 | 000,000,000 | ---D | M]

[2011/01/31 16:43:38 | 000,000,000 | ---D | M] (No name found) -- J:\Users\irene\AppData\Roaming\Mozilla\Extensions
[2011/04/08 06:04:57 | 000,002,428 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - J:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - J:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - J:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - J:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - J:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - J:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - J:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - J:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - J:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Productivity 2.2 Toolbar) - {e84cc2c1-b722-48fc-a39c-edb8b525c777} - J:\Program Files (x86)\Productivity_2.2\prxtbPro0.dll (Conduit Ltd.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - J:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - J:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - J:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - J:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - J:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - J:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - J:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Productivity 2.2 Toolbar) - {e84cc2c1-b722-48fc-a39c-edb8b525c777} - J:\Program Files (x86)\Productivity_2.2\prxtbPro0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\irene_ON_J\..\Toolbar\WebBrowser: (no name) - {09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - No CLSID value found.
O3:64bit: - HKU\irene_ON_J\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - J:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\irene_ON_J\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - J:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\irene_ON_J\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - J:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKU\irene_ON_J\..\Toolbar\WebBrowser: (Productivity 2.2 Toolbar) - {E84CC2C1-B722-48FC-A39C-EDB8B525C777} - J:\Program Files (x86)\Productivity_2.2\prxtbPro0.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [Corel Photo Downloader] J:\Program Files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe (Corel, Inc.)
O4:64bit: - HKLM..\Run: [IAAnotif] J:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] J:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] J:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ANIWZCS2Service] J:\Program Files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] J:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [BabylonToolbar] J:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKLM..\Run: [BackupManagerTray] J:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [Corel File Shell Monitor] J:\Program Files (x86)\Corel\Corel MediaOne\CorelIOMonitor.exe ()
O4 - HKLM..\Run: [Corel Photo Downloader] File not found
O4 - HKLM..\Run: [D-Link D-Link Wireless N DWA-140] J:\Program Files (x86)\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe (D-Link)
O4 - HKLM..\Run: [EgisTecLiveUpdate] J:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] J:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [mcui_exe] J:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Nikon Transfer Monitor] J:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] J:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [PlayMovie] J:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [ROC_roc_ssl_v12] File not found
O4 - HKLM..\Run: [SSDMonitor] J:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [Ulead AutoDetector v2] J:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O4 - HKU\irene_ON_J..\Run: [Akamai NetSession Interface] J:\Users\irene\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\irene_ON_J..\Run: [EPSON Stylus DX7400 Series] File not found
O4 - HKU\irene_ON_J..\Run: [IncrediMail] J:\Program Files (x86)\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.)
O4 - HKU\irene_ON_J..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] J:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe (Mozilla Foundation)
O4 - HKU\irene_ON_J..\Run: [RegistryBooster] File not found
O4 - HKU\LocalService_ON_J..\Run: [Sidebar] J:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_J..\Run: [Sidebar] J:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_J..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_J..\RunOnce: [mctadmin] File not found
O4 - Startup: J:\Users\irene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\irene_ON_J\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: &Add animation to IncrediMail Style Box - J:\Program Files (x86)\IncrediMail\Bin\resources\WebMenuImg.htm ()
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - J:\Program Files (x86)\IncrediMail\Bin\resources\WebMenuImg.htm ()
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - J:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - J:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {48580E34-E37A-454A-8EC4-FC7598B01D77} hxxp://order.ifolor.ch/GENERAL/LowRes/app_support/1/ActiveX/IfolorUploader_chkr.cab (IfolorUploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - J:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - J:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - J:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O20 - AppInit_DLLs: (c:\progra~2\sprote~1\sprote~1.dll) - J:\Program Files (x86)\SProtector\sprotector.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - J:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - J:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - J:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\irene_ON_J Winlogon: Shell - (cmd.exe) - J:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2013/06/23 15:54:13 | 002,237,440 | R--- | C] (OldTimer Tools) -- J:\OTLPE.exe
[2013/06/23 15:50:38 | 000,000,000 | ---D | C] -- J:\_OTL
[2013/06/21 00:29:04 | 000,000,000 | ---D | C] -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2013/06/15 16:22:41 | 000,391,168 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\ieui.dll
[2013/06/15 16:22:40 | 000,526,336 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\ieui.dll
[2013/06/13 00:43:33 | 000,196,440 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\HipShieldK.sys
[2013/06/13 00:43:06 | 000,000,000 | ---D | C] -- J:\Program Files (x86)\McAfee.com
[2013/06/13 00:42:56 | 000,010,728 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mfeclnk.sys
[2013/06/13 00:42:56 | 000,000,000 | ---D | C] -- J:\Program Files (x86)\Common Files\McAfee
[2013/06/13 00:42:49 | 000,771,536 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mfehidk.sys
[2013/06/13 00:42:49 | 000,515,968 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mfefirek.sys
[2013/06/13 00:42:49 | 000,340,216 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mfewfpk.sys
[2013/06/13 00:42:49 | 000,309,840 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mfeavfk.sys
[2013/06/13 00:42:49 | 000,179,280 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mfeapfk.sys
[2013/06/13 00:42:49 | 000,106,552 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\mferkdet.sys
[2013/06/13 00:42:49 | 000,070,112 | ---- | C] (McAfee, Inc.) -- J:\Windows\System32\drivers\cfwids.sys
[2013/06/13 00:42:42 | 000,000,000 | ---D | C] -- J:\Program Files\Common Files\McAfee
[2013/06/13 00:42:33 | 000,000,000 | ---D | C] -- J:\Program Files\McAfee.com
[2013/06/13 00:42:33 | 000,000,000 | ---D | C] -- J:\Program Files\McAfee
[2013/06/13 00:42:30 | 000,000,000 | ---D | C] -- J:\Program Files (x86)\McAfee
[2013/06/12 08:18:30 | 000,136,704 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\iesysprep.dll
[2013/06/12 08:18:30 | 000,109,056 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\iesysprep.dll
[2013/06/12 08:18:30 | 000,089,600 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\RegisterIEPKEYs.exe
[2013/06/12 08:18:30 | 000,071,680 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/12 08:18:30 | 000,067,072 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\iesetup.dll
[2013/06/12 08:18:30 | 000,061,440 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\iesetup.dll
[2013/06/12 08:18:30 | 000,051,712 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\ie4uinit.exe
[2013/06/12 08:18:30 | 000,039,936 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\iernonce.dll
[2013/06/12 08:18:30 | 000,033,280 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\iernonce.dll
[2013/06/12 08:18:29 | 000,603,136 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\msfeeds.dll
[2013/06/12 08:18:29 | 000,493,056 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\msfeeds.dll
[2013/06/12 08:18:28 | 003,958,784 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\jscript9.dll
[2013/06/12 08:18:28 | 000,855,552 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\jscript.dll
[2013/06/12 08:18:28 | 000,690,688 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\jscript.dll
[2013/06/12 08:18:27 | 002,877,440 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\jscript9.dll
[2013/06/12 00:37:44 | 000,751,104 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\win32spl.dll
[2013/06/12 00:37:44 | 000,492,544 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\win32spl.dll
[2013/06/12 00:37:38 | 000,030,720 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\cryptdlg.dll
[2013/06/12 00:37:38 | 000,024,576 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\cryptdlg.dll
[2013/06/12 00:37:34 | 001,424,384 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\WindowsCodecs.dll
[2013/06/12 00:37:31 | 001,464,320 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\crypt32.dll
[2013/06/12 00:37:31 | 001,192,448 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\certutil.exe
[2013/06/12 00:37:31 | 000,903,168 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\certutil.exe
[2013/06/12 00:37:31 | 000,139,776 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\cryptnet.dll
[2013/06/12 00:37:30 | 000,052,224 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\certenc.dll
[2013/06/12 00:37:30 | 000,043,008 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\certenc.dll
[2013/06/12 00:37:22 | 001,887,232 | ---- | C] (Microsoft Corporation) -- J:\Windows\System32\d3d11.dll
[2013/06/12 00:37:22 | 001,505,280 | ---- | C] (Microsoft Corporation) -- J:\Windows\SysWow64\d3d11.dll
[2009/08/27 15:18:34 | 000,036,136 | ---- | C] (Oberon Media) -- J:\ProgramData\FullRemove.exe

========== Files - Modified Within 30 Days ==========

[2013/06/23 11:34:33 | 000,067,584 | --S- | M] () -- J:\Windows\bootstat.dat
[2013/06/23 11:34:19 | 000,001,106 | ---- | M] () -- J:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/23 11:34:19 | 000,000,284 | ---- | M] () -- J:\Windows\tasks\RMAutoUpdate.job
[2013/06/23 11:33:29 | 3193,810,944 | -HS- | M] () -- J:\hiberfil.sys
[2013/06/23 05:45:19 | 000,000,007 | ---- | M] () -- J:\Windows\SysWow64\ANIWZCSUSERNAME{CEB21CA4-A7B8-4F62-8F60-CE3E3BA3D9D8}
[2013/06/21 07:26:50 | 000,009,920 | -H-- | M] () -- J:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/21 07:26:50 | 000,009,920 | -H-- | M] () -- J:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/21 01:01:00 | 000,000,256 | ---- | M] () -- J:\Windows\tasks\HP Photo Creations Messager.job
[2013/06/21 00:53:10 | 000,104,515 | ---- | M] () -- J:\Users\irene\AppData\Local\2433f433
[2013/06/21 00:53:10 | 000,104,487 | ---- | M] () -- J:\Users\irene\AppData\Roaming\2433f433
[2013/06/21 00:53:10 | 000,104,470 | ---- | M] () -- J:\ProgramData\2433f433
[2013/06/21 00:30:00 | 000,000,884 | ---- | M] () -- J:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/21 00:29:04 | 000,001,832 | ---- | M] () -- J:\Users\Public\Desktop\McAfee AntiVirus Plus.lnk
[2013/06/21 00:29:04 | 000,000,000 | ---D | M] -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2013/06/21 00:24:55 | 000,000,007 | ---- | M] () -- J:\Windows\SysWow64\ANIWZCSUSERNAME
[2013/06/20 16:17:01 | 000,001,110 | ---- | M] () -- J:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/20 13:01:39 | 000,000,286 | ---- | M] () -- J:\Windows\tasks\RMSchedule.job
[2013/06/20 00:21:45 | 000,002,187 | ---- | M] () -- J:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/17 04:54:45 | 000,000,030 | ---- | M] () -- J:\Windows\Iedit_.INI
[2013/06/16 04:28:31 | 000,648,466 | ---- | M] () -- J:\Windows\System32\perfh007.dat
[2013/06/16 04:28:31 | 000,611,134 | ---- | M] () -- J:\Windows\System32\perfh009.dat
[2013/06/16 04:28:31 | 000,128,724 | ---- | M] () -- J:\Windows\System32\perfc007.dat
[2013/06/16 04:28:31 | 000,105,314 | ---- | M] () -- J:\Windows\System32\perfc009.dat
[2013/06/12 00:30:30 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- J:\Windows\SysWow64\FlashPlayerApp.exe
[2013/06/12 00:30:30 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- J:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/06/10 13:32:18 | 267,734,327 | ---- | M] () -- J:\Windows\MEMORY.DMP
[2013/06/08 10:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- J:\Windows\System32\ieui.dll
[2013/06/08 07:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- J:\Windows\SysWow64\ieui.dll

========== Files Created - No Company Name ==========

[2013/06/21 00:53:10 | 000,104,515 | ---- | C] () -- J:\Users\irene\AppData\Local\2433f433
[2013/06/21 00:53:10 | 000,104,487 | ---- | C] () -- J:\Users\irene\AppData\Roaming\2433f433
[2013/06/21 00:53:10 | 000,104,470 | ---- | C] () -- J:\ProgramData\2433f433
[2013/06/13 00:44:08 | 000,001,832 | ---- | C] () -- J:\Users\Public\Desktop\McAfee AntiVirus Plus.lnk
[2013/04/29 14:23:05 | 000,002,763 | ---- | C] () -- J:\Users\irene\AppData\Local\recently-used.xbel
[2013/04/16 15:36:37 | 000,000,057 | ---- | C] () -- J:\ProgramData\Ament.ini
[2011/11/28 13:05:14 | 000,005,839 | ---- | C] () -- J:\Windows\SysWow64\RDDlg.dat
[2011/08/24 08:37:41 | 000,210,032 | ---- | C] () -- J:\Windows\SysWow64\DBCLIENT.DLL
[2011/06/21 06:29:57 | 000,252,928 | ---- | C] () -- J:\Windows\SysWow64\DShowRdpFilter.dll
[2011/04/15 10:04:44 | 000,000,030 | ---- | C] () -- J:\Windows\Iedit_.INI
[2011/04/15 09:58:39 | 000,001,472 | -HS- | C] () -- J:\Windows\SysWow64\KGyGaAvL.sys
[2011/02/24 00:43:24 | 000,000,056 | -H-- | C] () -- J:\Windows\SysWow64\ezsidmv.dat
[2010/08/25 14:34:30 | 000,982,240 | ---- | C] () -- J:\Windows\SysWow64\igkrng500.bin
[2010/08/25 14:34:30 | 000,439,308 | ---- | C] () -- J:\Windows\SysWow64\igcompkrng500.bin
[2010/08/25 14:34:30 | 000,092,356 | ---- | C] () -- J:\Windows\SysWow64\igfcg500m.bin
[2010/08/25 13:52:00 | 000,208,896 | ---- | C] () -- J:\Windows\SysWow64\iglhsip32.dll
[2010/08/25 13:52:00 | 000,143,360 | ---- | C] () -- J:\Windows\SysWow64\iglhcp32.dll
[2010/07/25 06:50:52 | 000,006,414 | ---- | C] () -- J:\Windows\SysWow64\content.ini
[2010/06/18 11:51:06 | 000,000,008 | RHS- | C] () -- J:\ProgramData\20C384F128.sys
[2010/06/16 12:21:42 | 000,003,766 | -HS- | C] () -- J:\ProgramData\KGyGaAvL.sys
[2010/03/14 11:52:17 | 000,245,760 | ---- | C] () -- J:\Windows\SysWow64\WlanApp.dll
[2010/03/14 11:52:17 | 000,049,152 | ---- | C] () -- J:\Windows\SysWow64\JJAKEn.dll
[2010/02/28 08:51:14 | 000,000,268 | RH-- | C] () -- J:\ProgramData\Quartz Composer
[2010/02/28 08:51:14 | 000,000,268 | RH-- | C] () -- J:\Users\irene\AppData\Roaming\PrintingModule
[2010/02/28 08:51:14 | 000,000,020 | -H-- | C] () -- J:\ProgramData\PKP_DLdw.DAT
[2010/02/28 08:51:14 | 000,000,012 | RH-- | C] () -- J:\ProgramData\Rock Kit
[2010/02/28 08:48:15 | 000,000,268 | RH-- | C] () -- J:\ProgramData\Profiles
[2010/02/28 08:48:15 | 000,000,268 | RH-- | C] () -- J:\Users\irene\AppData\Roaming\Printer Icons
[2010/02/28 08:48:15 | 000,000,020 | -H-- | C] () -- J:\ProgramData\PKP_DLdu.DAT
[2010/02/28 08:48:15 | 000,000,012 | RH-- | C] () -- J:\ProgramData\Resources
[2010/01/13 16:48:00 | 000,017,920 | ---- | C] () -- J:\Users\irene\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/13 16:15:39 | 000,000,590 | ---- | C] () -- J:\Users\irene\AppData\Roaming\wklnhst.dat
[2009/08/27 15:53:10 | 000,134,592 | ---- | C] () -- J:\Windows\SysWow64\igfcg500.bin
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- J:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- J:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- J:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- J:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- J:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- J:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- J:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- J:\Windows\SysWow64\mlang.dat
[2007/07/23 03:03:32 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2007/07/23 03:03:32 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelSwedish.dll
[2007/07/23 03:03:32 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelSpanish.dll
[2007/07/23 03:03:30 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2007/07/23 03:03:30 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelPortugese.dll
[2007/07/23 03:03:30 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelKorean.dll
[2007/07/23 03:03:30 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelJapanese.dll
[2007/07/23 03:03:30 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelGerman.dll
[2007/07/23 03:03:30 | 000,053,248 | ---- | C] () -- J:\Windows\SysWow64\AgCPanelFrench.dll
[2007/06/05 07:20:32 | 000,177,704 | ---- | C] () -- J:\Windows\SysWow64\PSIService.exe

========== LOP Check ==========

[2012/09/03 12:19:01 | 000,000,000 | ---D | M] -- J:\ProgramData\4Sync
[2009/08/27 15:31:29 | 000,000,000 | ---D | M] -- J:\ProgramData\Acer
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- J:\ProgramData\Application Data
[2010/01/14 13:32:52 | 000,000,000 | ---D | M] -- J:\ProgramData\Arcade Lab
[2009/08/27 15:25:44 | 000,000,000 | ---D | M] -- J:\ProgramData\BackupManager
[2012/09/05 05:08:59 | 000,000,000 | -H-D | M] -- J:\ProgramData\Common Files
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- J:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- J:\ProgramData\Documents
[2009/08/27 15:43:30 | 000,000,000 | ---D | M] -- J:\ProgramData\EgisTec
[2010/02/28 08:51:14 | 000,000,000 | ---D | M] -- J:\ProgramData\EnterNHelp
[2010/03/30 02:12:55 | 000,000,000 | ---D | M] -- J:\ProgramData\EPSON
[2009/08/27 15:41:48 | 000,000,000 | ---D | M] -- J:\ProgramData\eSobi
[2010/01/14 12:35:53 | 000,000,000 | ---D | M] -- J:\ProgramData\FarmFrenzy2
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- J:\ProgramData\Favorites
[2011/01/27 17:39:32 | 000,000,000 | ---D | M] -- J:\ProgramData\Fighters
[2013/06/16 04:57:03 | 000,000,000 | ---D | M] -- J:\ProgramData\firebird
[2012/11/25 15:59:25 | 000,000,000 | ---D | M] -- J:\ProgramData\Fixie
[2012/01/27 12:17:19 | 000,000,000 | ---D | M] -- J:\ProgramData\Fotopick Design-Center-ADP-DE
[2012/09/03 12:54:50 | 000,000,000 | ---D | M] -- J:\ProgramData\GBox
[2012/01/27 12:18:01 | 000,000,000 | ---D | M] -- J:\ProgramData\ifolor
[2010/01/13 14:45:42 | 000,000,000 | ---D | M] -- J:\ProgramData\IM
[2010/01/13 14:44:58 | 000,000,000 | ---D | M] -- J:\ProgramData\IncrediMail
[2012/09/03 15:43:10 | 000,000,000 | ---D | M] -- J:\ProgramData\InstallMate
[2012/01/22 09:08:40 | 000,000,000 | ---D | M] -- J:\ProgramData\mquadr.at
[2010/02/28 08:49:18 | 000,000,000 | ---D | M] -- J:\ProgramData\Nikon
[2009/08/27 15:43:30 | 000,000,000 | ---D | M] -- J:\ProgramData\OEM
[2010/02/04 02:00:24 | 000,000,000 | ---D | M] -- J:\ProgramData\Partner
[2011/03/17 13:19:53 | 000,000,000 | ---D | M] -- J:\ProgramData\Photo Notifier and Animation Creator
[2012/09/03 12:54:59 | 000,000,000 | ---D | M] -- J:\ProgramData\Premium
[2012/11/19 18:08:46 | 000,000,000 | ---D | M] -- J:\ProgramData\regid.1986-12.com.adobe
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- J:\ProgramData\Start Menu
[2013/06/23 11:34:31 | 000,000,000 | ---D | M] -- J:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- J:\ProgramData\Templates
[2012/06/12 04:26:43 | 000,000,000 | ---D | M] -- J:\ProgramData\tmp
[2010/01/17 09:30:42 | 000,000,000 | ---D | M] -- J:\ProgramData\TuneUp Software
[2011/04/15 09:50:38 | 000,000,000 | ---D | M] -- J:\ProgramData\Ulead Systems
[2010/02/28 08:51:14 | 000,000,000 | ---D | M] -- J:\ProgramData\Ultima_T15
[2011/04/14 01:44:49 | 000,000,000 | ---D | M] -- J:\ProgramData\Visan
[2010/01/18 12:23:56 | 000,000,000 | ---D | M] -- J:\ProgramData\WinZip
[2013/06/23 11:34:19 | 000,000,284 | ---- | M] () -- J:\Windows\Tasks\RMAutoUpdate.job
[2013/06/20 13:01:39 | 000,000,286 | ---- | M] () -- J:\Windows\Tasks\RMSchedule.job
[2013/06/17 00:23:47 | 000,032,632 | ---- | M] () -- J:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> J:\ProgramData\Temp1B5B4F1
@Alternate Data Stream - 124 bytes -> J:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 118 bytes -> J:\ProgramData\Temp:4CF61E54
< End of report >

Hoi syex0n und

Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten.

Eins vorneweg: Ich kann dir keine Garantien geben, dass ich alles finden werde. Bei schwerwiegenden Infektionen ist ein Formatieren und Neuinstallieren meist der schnellere und immer der sicherere Weg.
Wenn du dich für eine Bereinigung entscheidest, dann sollten wir gründlich vorgehen. Bleib also dran, bis ich dir eindeutig mitteile, dass wir fertig sind.
Auch wenn die auffälligen Symptome schon früh verschwinden, bedeutet das nicht, dass dein Rechner dann schon sauber und sicher ist.

Hinweise zum Ablauf

• Du bekommst von mir jeweils eine individuell auf dich abgestimmte schrittweise Anleitung.
  • Lese diese Anweisungen immer zuerst vollständig durch und frag bei Unklarheiten nach, bevor du beginnst.
  • Arbeite die Anleitungen dann sorgfältig und in der angegebenen Reihenfolge ab und poste deine Rückmeldungen und Logfiles erst zum Schluss gesammelt in einer Antwort.
  • Füge den Inhalt der Logfiles wenn immer möglich innerhalb von Code-Tags in deine Antwort ein.
  • Sollten Probleme auftauchen, dann brich an dieser Stelle ab und schildere sie so gut wie möglich.

• Es ist wichtig für mich, dass sich der Zustand deines Systems nicht plötzlich unvorhersehbar ändert:
  • Lasse keine Scanner oder Tools ohne Aufforderung laufen. Lösche nichts auf eigene Faust.
  • Installiere oder deinstalliere während der Bereinigung keine Software.

Los geht's:

Kannst du nach folgendem Fix den Rechner wieder normal starten?


Schritt 1

• Starte den infizierten Rechner mit der OTLpe-CD und öffne OTLpe.
• Kopiere nun den folgenden Inhalt aus der Codebox in die Textbox.
  Wichtig: Falls du deinen Benutzernamen im Log unkenntlich gemacht hast (z.B. durch ***), dann mach das hier wieder rückgängig.

:OTL
[2013/06/21 00:53:10 | 000,104,515 | ---- | C] () -- J:\Users\irene\AppData\Local\2433f433
[2013/06/21 00:53:10 | 000,104,487 | ---- | C] () -- J:\Users\irene\AppData\Roaming\2433f433
[2013/06/21 00:53:10 | 000,104,470 | ---- | C] () -- J:\ProgramData\2433f433
O20 - HKU\irene_ON_J Winlogon: Shell - (cmd.exe) - J:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKU\irene_ON_J..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] J:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe (Mozilla Foundation)

:files
J:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.dll
         

• Klicke jetzt auf den Fix Button.
• Starte danach neu und versuche wieder in den normalen Modus von Windows zu booten.
• Nach dem Neustart findest du ein Textdokument auf deinem Desktop.
  (Auch zu finden unter C:\OTL\MovedFiles\<time_date.log>)
• Kopiere nun dessen Inhalt hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

• Fixlog von OTLpe

Hallo :-)

Ich danke dir sehr, ich komme jetzt ins normale System wieder



========== OTL ==========
J:\Users\irene\AppData\Local\2433f433 moved successfully.
J:\Users\irene\AppData\Roaming\2433f433 moved successfully.
J:\ProgramData\2433f433 moved successfully.
Registry value HKEY_USERS\irene_ON_J\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:cmd.exe deleted successfully.
J:\Windows\SysWOW64\cmd.exe moved successfully.
Registry key HKEY_USERS\irene_ON_J\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
J:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe moved successfully.
========== FILES ==========
File\Folder J:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.dll not found.

OTLPE by OldTimer - Version 3.1.48.0 log created on 06232013_190505

Sehr gut, dann mach bitte so weiter:


Schritt 1

Lade SystemLook (von jpshortstuff) herunter und speichere das Tool auf dem Desktop.

• Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
  Vista und Win7 User: Rechtsklick und "als Administrator starten".
• Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
  
  

  :filefind
  *nkqlucxnprpjsfevq*
  
  :reg
  HKEY_CLASSES_ROOT\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03} /sub
  HKEY_CLASSES_ROOT\CLSID\{750fdf10-2a26-11d1-a3ea-080036587f03} /sub
  HKEY_CLASSES_ROOT\CLSID\{28949824-6737-0594-0930-223283753445} /sub
  
  :regfind
  nkqlucxnprpjsfevq
           

• Klicke nun auf den Button Look, um den Scan zu starten.
• Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen. Poste diese in deinen Thread.
• Das Log-File wird auch auf dem Desktop als SystemLook.txt gespeichert.

Schritt 2

Lade dir bitte OTL (von Oldtimer) herunter und speichere es auf deinen Desktop.

• Doppelklick auf die OTL.exe.
• Unter Extra Registry, wähle bitte Use SafeList.
• Setze den Haken bei Scan all Users.
• Klicke nun auf Run Scan.
• Wenn der Scan beendet ist, werden 2 Logfiles (OTL.txt und Extras.txt) erstellt.
• Poste den Inhalt dieser Logfiles hier in den Thread.

Bitte poste in deiner nächsten Antwort:

• Log von SystemLook
• Logs von OTL

Hallo

Der Log von SystemLook

SystemLook 30.07.11 by jpshortstuff
Log created at 16:41 on 23/06/2013 by irene
Administrator - Elevation successful

========== filefind ==========

Searching for "*nkqlucxnprpjsfevq*"






und der Log von OTLOTL Logfile:

OTL logfile created on: 6/23/2013 4:53:49 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\irene\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
3.97 Gb Total Physical Memory | 2.04 Gb Available Physical Memory | 51.32% Memory free
7.93 Gb Paging File | 6.03 Gb Available in Paging File | 76.07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 225.95 Gb Total Space | 98.46 Gb Free Space | 43.58% Space Free | Partition Type: NTFS
Drive D: | 226.71 Gb Total Space | 226.21 Gb Free Space | 99.78% Space Free | Partition Type: NTFS
Drive F: | 29.80 Gb Total Space | 29.67 Gb Free Space | 99.53% Space Free | Partition Type: FAT32
 
Computer Name: IRENE-PC | User Name: irene | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013/06/23 16:41:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\irene\Desktop\OTL.exe
PRC - [2013/06/18 12:18:39 | 000,308,816 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2013/05/25 17:23:47 | 000,632,031 | ---- | M] () -- C:\Users\irene\Desktop\erewr\adwcleaner.exe
PRC - [2013/05/11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/05/09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/05/09 10:58:27 | 000,137,960 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\afwServ.exe
PRC - [2013/04/04 14:50:32 | 000,887,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe
PRC - [2012/03/21 12:23:14 | 000,793,048 | ---- | M] (PC Tools) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2009/08/13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009/08/06 19:18:54 | 000,311,592 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009/07/04 03:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2009/06/05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2009/06/04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
PRC - [2007/06/05 13:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\SysWOW64\PSIService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013/05/25 17:23:47 | 000,632,031 | ---- | M] () -- C:\Users\irene\Desktop\erewr\adwcleaner.exe
MOD - [2012/08/07 17:02:46 | 000,323,584 | ---- | M] () -- c:\progra~2\sprote~1\sprote~1.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2013/05/09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2013/05/09 10:58:27 | 000,137,960 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\afwServ.exe -- (avast! Firewall)
SRV:64bit: - [2010/02/25 11:28:32 | 000,036,168 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV:64bit: - [2009/07/04 03:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2013/06/12 06:30:31 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/03/21 20:54:18 | 004,561,152 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll -- (Akamai)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe -- (BBUpdate)
SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe -- (BBSvc)
SRV - [2012/03/21 12:23:14 | 000,793,048 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc)
SRV - [2010/02/28 15:32:32 | 000,607,048 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010/02/25 11:35:06 | 001,398,088 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/02/25 11:28:24 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2009/08/13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009/08/06 19:18:54 | 000,311,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009/07/28 21:25:34 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)
SRV - [2009/06/04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2007/06/05 13:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing)
SRV - [2007/01/19 12:49:26 | 000,049,152 | ---- | M] (Wireless Service) [Auto | Stopped] -- C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService)
SRV - [2007/01/11 04:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/05/09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013/05/09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013/05/09 10:59:07 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2013/05/09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013/05/09 10:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2013/05/09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013/05/09 10:59:06 | 000,270,824 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswNdis2.sys -- (aswNdis2)
DRV:64bit: - [2013/05/09 10:59:06 | 000,131,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswFW.sys -- (aswFW)
DRV:64bit: - [2013/05/09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013/05/09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2013/05/09 10:59:06 | 000,022,600 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013/03/13 19:01:59 | 000,012,368 | ---- | M] (ALWIL Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswNdis.sys -- (aswNdis)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/08/25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/12 12:19:58 | 000,287,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1y62x64.sys -- (e1yexpress)
DRV:64bit: - [2009/06/10 22:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364)
DRV:64bit: - [2009/06/10 22:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/06/02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/05/25 22:13:10 | 000,138,752 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV:64bit: - [2009/05/06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009/05/06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2008/02/01 16:14:50 | 000,735,232 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rt2870.sys -- (rt2870)
DRV - [2009/10/14 09:24:44 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2007/05/12 17:39:32 | 000,048,128 | ---- | M] (Alpha Networks Inc.) [Kernel | Auto | Stopped] -- c:\Windows\SysWOW64\ANIO64.sys -- (ANIO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\irene\Documents
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Web News online - Aktuelles - Swisscom - Aktuelle Nachrichten - Neuigkeiten
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\URLSearchHook: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - No CLSID value found
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\URLSearchHook: {90eee664-34b1-422a-a782-779af65cdf6d} - No CLSID value found
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - No CLSID value found
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\SearchScopes\{45FB98CE-057C-4AA1-A0DC-1272DC80B498}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@innoplus.de/inoPanoViewer: C:\Program Files (x86)\innoPlus\Rundum-Betrachter-innoPlus\npirsviewer.dll (INNOVA-engineering GmbH Dresden)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quickprint@hp.com: C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2013/04/16 21:40:58 | 000,000,000 | ---D | M]
 
[2011/01/31 22:43:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\irene\AppData\Roaming\mozilla\Extensions
 
========== Chrome  ==========
 
CHR - homepage: 
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3 - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\Toolbar\WebBrowser: (no name) - {09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [Corel Photo Downloader] C:\Program Files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe (Corel, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ANIWZCS2Service] C:\Program Files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [Corel File Shell Monitor] C:\Program Files (x86)\Corel\Corel MediaOne\CorelIOMonitor.exe ()
O4 - HKLM..\Run: [Corel Photo Downloader] "C:\Program Files (x86)\Corel\Corel MediaOne\Corel PhotoDownloader.exe" -startup File not found
O4 - HKLM..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files (x86)\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe (D-Link)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [ROC_roc_ssl_v12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 File not found
O4 - HKLM..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe (Ulead Systems, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [Akamai NetSession Interface] C:\Users\irene\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICDE.EXE /FU "C:\Windows\TEMP\E_S4C1.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [IncrediMail] C:\Program Files (x86)\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.)
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe File not found
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\RunOnce: [DeleteOnReboot] C:\Windows\DeleteOnReboot.bat ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Program Files (x86)\IncrediMail\bin\resources\WebMenuImg.htm ()
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html File not found
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Program Files (x86)\IncrediMail\bin\resources\WebMenuImg.htm ()
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html File not found
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} MSN Games - Free Online Games (Checkers Class)
O16 - DPF: {48580E34-E37A-454A-8EC4-FC7598B01D77} hxxp://order.ifolor.ch/GENERAL/LowRes/app_support/1/ActiveX/IfolorUploader_chkr.cab (IfolorUploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} MSN Games - Free Online Games (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} Oracle Technology Network for Java Developers (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1475C761-93A8-4EDA-A634-16FC7BCEEF3D}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEB21CA4-A7B8-4F62-8F60-CE3E3BA3D9D8}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\sprote~1\sprote~1.dll) - c:\progra~2\sprote~1\sprote~1.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/06/23 21:54:13 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2013/06/23 21:50:38 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/23 16:24:12 | 000,378,432 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013/06/23 16:24:12 | 000,033,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013/06/23 16:24:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Internet Security
[2013/06/23 16:23:52 | 000,270,824 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswNdis2.sys
[2013/06/23 16:23:52 | 000,131,232 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFW.sys
[2013/06/23 16:23:51 | 001,025,808 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013/06/23 16:23:51 | 000,072,016 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2013/06/23 16:23:51 | 000,064,288 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013/06/23 16:23:51 | 000,022,600 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswKbd.sys
[2013/06/23 16:23:47 | 000,080,816 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013/06/23 16:23:44 | 000,287,840 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013/06/23 16:23:25 | 000,012,368 | ---- | C] (ALWIL Software) -- C:\Windows\SysNative\drivers\aswNdis.sys
[2013/06/23 16:22:57 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/06/23 16:22:50 | 000,000,000 | ---D | C] -- C:\Users\irene\AppData\Roaming\Malwarebytes
[2013/06/23 16:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/06/23 16:22:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/06/23 16:22:34 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013/06/23 16:22:30 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/06/23 16:22:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/06/23 16:22:22 | 000,000,000 | ---D | C] -- C:\Users\irene\AppData\Local\Programs
[2013/06/23 16:21:56 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013/06/15 22:22:41 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/15 22:22:40 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/12 14:18:30 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/12 14:18:30 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/12 14:18:30 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/12 14:18:30 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/12 14:18:30 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/12 14:18:30 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/12 14:18:30 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/12 14:18:30 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/12 14:18:30 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/12 14:18:29 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/12 14:18:28 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/12 14:18:28 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/12 14:18:28 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/12 06:37:44 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/12 06:37:44 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/12 06:37:38 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/12 06:37:38 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/12 06:37:34 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/12 06:37:31 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/12 06:37:31 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/12 06:37:31 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/12 06:37:31 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/12 06:37:30 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/12 06:37:30 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/12 06:37:22 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/12 06:37:22 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2010/09/21 15:25:50 | 001,228,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\irene\Photoshop_12_LS1.exe
[2009/08/27 21:18:34 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013/06/23 16:58:59 | 000,000,124 | ---- | M] () -- C:\Windows\wininit.ini
[2013/06/23 16:58:49 | 000,001,166 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013/06/23 16:37:10 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/23 16:37:10 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/23 16:36:45 | 000,000,150 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/23 16:31:06 | 000,000,007 | ---- | M] () -- C:\Windows\SysWow64\ANIWZCSUSERNAME
[2013/06/23 16:30:14 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/23 16:29:06 | 000,000,284 | ---- | M] () -- C:\Windows\tasks\RMAutoUpdate.job
[2013/06/23 16:29:05 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/23 16:28:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/23 16:28:48 | 3193,810,944 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/23 16:25:11 | 001,486,084 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/06/23 16:25:11 | 000,648,466 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013/06/23 16:25:11 | 000,611,134 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/06/23 16:25:11 | 000,128,724 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013/06/23 16:25:11 | 000,105,314 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/06/23 16:24:12 | 000,001,926 | ---- | M] () -- C:\Users\Public\Desktop\avast! Internet Security.lnk
[2013/06/23 16:23:47 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2013/06/23 16:22:36 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013/06/23 16:17:11 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/23 11:45:19 | 000,000,007 | ---- | M] () -- C:\Windows\SysWow64\ANIWZCSUSERNAME{CEB21CA4-A7B8-4F62-8F60-CE3E3BA3D9D8}
[2013/06/21 07:01:00 | 000,000,256 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Messager.job
[2013/06/20 19:01:39 | 000,000,286 | ---- | M] () -- C:\Windows\tasks\RMSchedule.job
[2013/06/20 06:21:45 | 000,002,187 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/17 10:54:45 | 000,000,030 | ---- | M] () -- C:\Windows\Iedit_.INI
[2013/06/12 06:30:30 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/06/12 06:30:30 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/06/10 19:32:18 | 267,734,327 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/06/08 16:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/08 13:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
 
========== Files Created - No Company Name ==========
 
[2013/06/23 16:36:15 | 000,000,150 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/23 16:24:12 | 000,001,926 | ---- | C] () -- C:\Users\Public\Desktop\avast! Internet Security.lnk
[2013/06/23 16:23:50 | 000,189,936 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013/06/23 16:23:49 | 000,065,336 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013/06/23 16:23:47 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2013/06/23 16:22:36 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013/04/29 20:23:05 | 000,002,763 | ---- | C] () -- C:\Users\irene\AppData\Local\recently-used.xbel
[2013/04/16 21:36:37 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2011/11/28 19:05:14 | 000,005,839 | ---- | C] () -- C:\Windows\SysWow64\RDDlg.dat
[2011/08/24 14:37:41 | 000,210,032 | ---- | C] () -- C:\Windows\SysWow64\DBCLIENT.DLL
[2010/09/22 17:15:43 | 1052,333,819 | -H-- | C] () -- C:\Users\irene\Photoshop_12_LS4.7z.part
[2010/09/22 17:15:43 | 000,000,000 | -H-- | C] () -- C:\Users\irene\Photoshop_12_LS4.exe.part
[2010/09/21 15:25:50 | 1026,293,791 | ---- | C] () -- C:\Users\irene\Photoshop_12_LS1.7z
[2010/06/18 17:51:06 | 000,000,008 | RHS- | C] () -- C:\ProgramData\20C384F128.sys
[2010/06/16 18:21:42 | 000,003,766 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010/02/28 14:51:14 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Quartz Composer
[2010/02/28 14:51:14 | 000,000,268 | RH-- | C] () -- C:\Users\irene\AppData\Roaming\PrintingModule
[2010/02/28 14:51:14 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2010/02/28 14:51:14 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Rock Kit
[2010/02/28 14:48:15 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Profiles
[2010/02/28 14:48:15 | 000,000,268 | RH-- | C] () -- C:\Users\irene\AppData\Roaming\Printer Icons
[2010/02/28 14:48:15 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2010/02/28 14:48:15 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Resources
[2010/01/13 22:48:00 | 000,017,920 | ---- | C] () -- C:\Users\irene\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/13 22:15:39 | 000,000,590 | ---- | C] () -- C:\Users\irene\AppData\Roaming\wklnhst.dat
 
========== ZeroAccess Check ==========
 
[2011.12.22 10:26:06 | 003,194,825 | R--- | M] () -- C:\Users\irene\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{9E5A2791-6392-4BCF-9E0A-AC8170F2C7DE}-Anuschka.n
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 98 bytes -> C:\ProgramData\Temp:D1B5B4F1
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54

< End of report >
         

--- --- ---

Hallo,

der SystemLook-Scan war wohl noch nicht abgeschlossen...
Kannst du diesen Schritte bitte wiederholen?

Sorry,

Hier ist der Log:

SystemLook 30.07.11 by jpshortstuff
Log created at 17:27 on 23/06/2013 by irene
Administrator - Elevation successful

========== filefind ==========

Searching for "*nkqlucxnprpjsfevq*"
No files found.

========== reg ==========

[HKEY_CLASSES_ROOT\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03}]
(Unable to open key - key not found)

[HKEY_CLASSES_ROOT\CLSID\{750fdf10-2a26-11d1-a3ea-080036587f03}]
(Unable to open key - key not found)

[HKEY_CLASSES_ROOT\CLSID\{28949824-6737-0594-0930-223283753445}]
(Unable to open key - key not found)

========== regfind ==========

Searching for "nkqlucxnprpjsfevq"
[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"AutoRun"=""C:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe""
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"qcgce2mrvjq91kk1e7pnbb19m52fx"="C:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe"
[HKEY_USERS\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Command Processor]
"AutoRun"=""C:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe""
[HKEY_USERS\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"qcgce2mrvjq91kk1e7pnbb19m52fx"="C:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe"

-= EOF =-

Ok, dann machen wir noch eine Kontrolle.
Wie läuft der Rechner?


Schritt 1

Fixen mit OTL

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

:OTL
@Alternate Data Stream - 98 bytes -> C:\ProgramData\Temp:D1B5B4F1
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54
O20 - AppInit_DLLs: (c:\progra~2\sprote~1\sprote~1.dll) - c:\progra~2\sprote~1\sprote~1.dll ()
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\irene\AppData\Local\Temp\nkqlucxnprpjsfevq.exe File not found
O4 - HKU\S-1-5-21-696997077-478625755-1814817659-1000..\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000  File not found
IE - HKU\S-1-5-21-696997077-478625755-1814817659-1000\..\SearchScopes\{45FB98CE-057C-4AA1-A0DC-1272DC80B498}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"AutoRun"=-

:commands
[emptytemp]
         

• Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
• Schließe bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
  ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
  Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.



Bitte poste in deiner nächsten Antwort:

• Fixlog von OTL
• Log von ESET
• Log von SecurityCheck

Danke :-)

Leider muss ich jetzt weg, werde die logs ca. um 20:00 Posten.

Ich bedanke mich bei dir das du mir so toll und einfach geholfen hast.

Freundliche Grüsse bis dann Andreas

Ok, alles klar. Bis später.

Hallo

Ich habe jetzt der Log von OTL:

All processes killed
========== OTL ==========
ADS C:\ProgramData\Temp1B5B4F1 deleted successfully.
Unable to delete ADS C:\ProgramData\Temp:E1F04E8D .
Unable to delete ADS C:\ProgramData\Temp:4CF61E54 .
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~2\sprote~1\sprote~1.dll deleted successfully.
File c:\progra~2\sprote~1\sprote~1.dll not found.
Registry value HKEY_USERS\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx deleted successfully.
Registry value HKEY_USERS\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Windows\CurrentVersion\Run\\RegistryBooster deleted successfully.
Registry key HKEY_USERS\S-1-5-21-696997077-478625755-1814817659-1000\Software\Microsoft\Internet Explorer\SearchScopes\{45FB98CE-057C-4AA1-A0DC-1272DC80B498}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45FB98CE-057C-4AA1-A0DC-1272DC80B498}\ not found.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Command Processor\\AutoRun deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33103 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: irene
->Temp folder emptied: 1922700800 bytes
->Temporary Internet Files folder emptied: 380509277 bytes
->Java cache emptied: 13678318 bytes
->FireFox cache emptied: 29522304 bytes
->Google Chrome cache emptied: 391074331 bytes
->Flash cache emptied: 761 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 41433064 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 26461779 bytes

Total Files Cleaned = 2'675.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 06232013_192301

Files\Folders moved on Reboot...
C:\Users\irene\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\irene\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...



Das Programm Securitycheck funktioniert nicht, kommt immer ein fehler er kann den pfad nicht finden.


Eset ist seit 1 Stunde und 40 Minuten am laufen, ich werde morgen den Log posten, kann ganz ne weile gehen.

Freundliche Grüsse Andreas

Hallo Andreas,

Eset ist seit 1 Stunde und 40 Minuten am laufen, ich werde morgen den Log posten, kann ganz ne weile gehen.

Ja, der ESET-Scan kann lange dauern, das ist normal..

Hallo

Hier ist der Log von ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=82f82a8781bd034983505cb18c94bbc8
# engine=14135
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-23 08:37:38
# local_time=2013-06-23 10:37:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=772 16777213 83 94 22437 148729730 0 0
# compatibility_mode=5893 16776574 66 94 1007959 123649708 0 0
# scanned=282688
# found=0
# cleaned=0
# scan_time=9849

Sieht gut aus. Der SecurityCheck-Scan sollte jetzt wieder sehr viel schneller gehen..

Ok :-) Super

SecurityCheck funktioniert nicht kommt immer eine Meldung konnte nicht gefunden werden . Stellen sie sicher das sie den Namen richtig eingegeben habe und wiederholen sie den Vorgang