Hallo und guten Abend,

ich habe mir auf unsrem Laptop mit Windows 7 /64bit den BKA bzw. Interpoltrojaner mit Bezahlaufforderung eingefangen. Das scheint ein neuer sogar mit Bild von Angela Merkel zu sein!!

Ich kann mein Benutzerkonto auch nicht im abgesicherten Modus starten. Allerdings funktioniert das 2. Benutzerkonto meiner Frau ohne Probleme.
Der Versuch einer Systemwiederherstellung schlug fehl. Avira DE Cleaner hat (unter dem Benutzerkonto meiner Frau durchgeführt) nichts gefunden. TrendMicro läuft seit fast drei Stunden auf dem Konto meiner Frau und ist bei 40%. Ich aber wenig Hoffnung, dass etwas gefunden wird.

Ich hatte auch mal HitMan versucht auf anraten der BKA Seite versucht. Er hat eine Cache.dat gefunden. Allerdings war es mir zu unsicher, da ich das Programm nicht kannte und eine Registrierung für den HitMan notwendig ist.

Über Google bin ich auf dieses Forum gestoßen. Soweit ich das rauslesen kann besteht ja noch Hoffnung.

Ihr macht tolle Arbeit

Ich habe daher auch gleich den FRST Scan gemacht. Vielen Dank vorab schon einmal für eine Antwort.

Viele Grüße
Markus

Hier das Ergebnis:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by SYSTEM on 14-07-2013 21:34:21
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [518784 2011-03-29] (Conexant Systems, Inc.)
HKLM\...\Run: [AtherosBtStack] - "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [790176 2011-03-31] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [657056 2011-03-31] (Atheros Commnucations)
HKLM\...\Run: [Apoint] - %ProgramFiles%\Apoint\Apoint.exe [226672 2011-02-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [2757312 2011-02-15] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-26] (Sony Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310128 2013-02-13] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE [452016 2011-01-15] (CANON INC.)
HKU\Markus\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [1509232 2013-02-13] (Samsung)
HKU\Markus\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKU\Markus\...\Run: [Spotify Web Helper] - "C:\Users\Markus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1104384 2013-07-08] (Spotify Ltd)
HKU\Markus\...\Winlogon: [Shell] explorer.exe,C:\Users\Markus\AppData\Roaming\cache.dat [94720 2011-11-17] () <==== ATTENTION 
Startup: C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-01] (Avira Operations GmbH & Co. KG)
S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-03-31] (Atheros)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe [120592 2013-05-22] (McAfee, Inc.)
S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation)
S2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-24] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-14 21:34 - 2013-07-14 21:34 - 00000000 ____D C:\FRST
2013-07-14 19:47 - 2013-07-14 19:50 - 01777839 _____ (Farbar) C:\Users\Julia\Downloads\FRST64.exe
2013-07-14 18:11 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-14 18:11 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-14 18:11 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-14 18:11 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-14 18:11 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-14 18:11 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-14 18:11 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-14 18:11 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-14 18:11 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-14 18:11 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-14 18:11 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-14 18:11 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-14 18:11 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-14 18:11 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-14 18:11 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-14 18:11 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-14 18:11 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-14 18:11 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-14 18:11 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-14 18:11 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-14 18:11 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-14 18:11 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-14 16:38 - 2013-07-14 16:38 - 00602112 _____ (OldTimer Tools) C:\Users\Julia\Downloads\OTL.exe
2013-07-14 16:32 - 2013-07-14 16:32 - 00002060 _____ C:\Users\Julia\Desktop\Entfernen des Avira DE-Cleaners.lnk
2013-07-14 16:32 - 2013-07-14 16:32 - 00001989 _____ C:\Users\Julia\Desktop\Avira DE-Cleaner.lnk
2013-07-14 16:23 - 2013-07-14 16:23 - 00883840 _____ C:\Users\Julia\Downloads\Avira-DE-Cleaner.exe
2013-07-14 15:09 - 2013-07-14 15:09 - 00000036 _____ C:\Users\Julia\AppData\Local\housecall.guid.cache
2013-07-14 15:07 - 2013-07-14 15:09 - 02405664 _____ (Trend Micro Inc.) C:\Users\Julia\Downloads\HousecallLauncher64.exe
2013-07-14 14:41 - 2013-05-14 17:51 - 00027648 _____ C:\Users\Julia\Desktop\AH-Spielplan2013.xls
2013-07-14 14:35 - 2013-07-14 15:04 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-14 14:29 - 2013-07-14 14:41 - 09833328 _____ (SurfRight B.V.) C:\Users\Julia\Downloads\hitmanpro_x64.exe
2013-07-14 13:22 - 2013-07-14 20:31 - 00000728 _____ C:\Windows\setupact.log
2013-07-14 13:22 - 2013-07-14 13:22 - 00000000 _____ C:\Windows\setuperr.log
2013-07-12 23:14 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-12 23:14 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-12 23:14 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-12 23:14 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-12 23:12 - 2013-07-12 23:29 - 05576224 _____ C:\Users\Markus\Downloads\Kunibert.vip.18042013.zip
2013-07-12 22:59 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-12 22:50 - 2013-07-14 18:03 - 00000004 _____ C:\Users\Markus\AppData\Roaming\cache.ini
2013-07-12 22:50 - 2013-07-12 22:50 - 00000000 ____D C:\Users\Markus\AppData\Roaming\ArcSoft
2013-07-12 22:50 - 2013-07-12 22:50 - 00000000 ____D C:\Users\Markus\AppData\Local\ArcSoft
2013-07-12 22:50 - 2013-07-12 22:50 - 00000000 ____D C:\Users\Markus\AppData\Local\{41E3F7FD-9864-4682-9614-1B60369A41F4}
2013-07-12 22:44 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-12 22:44 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-11 22:07 - 2013-07-11 22:07 - 00000000 ____D C:\Users\Markus\AppData\Local\{EE6C0A85-C124-4F47-BB37-31622450D854}
2013-07-10 20:52 - 2013-07-10 20:52 - 00000000 ____D C:\Users\Julia\AppData\Local\{1AD071DE-AA5F-43AB-8997-734DDB61B6D6}
2013-07-08 22:11 - 2013-07-08 22:11 - 00000000 ____D C:\Users\Markus\AppData\Local\{7CF159A5-92A8-4109-BFEA-B38E0F091F9B}
2013-07-06 10:57 - 2013-07-06 10:57 - 00000000 ____D C:\Users\Julia\AppData\Local\{240EE7F6-F145-4DC4-813F-004DEDB1E68B}
2013-07-03 17:36 - 2013-07-03 17:36 - 00000000 ____D C:\Users\Julia\AppData\Local\{7F74270E-5795-4857-9931-036298025570}
2013-07-03 15:30 - 2013-07-03 17:20 - 00000000 ____D C:\Users\Julia\Desktop\Scan
2013-07-01 21:22 - 2013-07-01 21:22 - 00000000 ____D C:\Users\Julia\AppData\Local\{FCC9A203-0465-4F13-8E9F-DF828FE2AEB7}
2013-06-29 09:46 - 2013-06-29 09:47 - 00000000 ____D C:\Users\Julia\AppData\Local\{3E5BFCD2-A243-4B59-97EB-8D3239CE0296}
2013-06-28 20:15 - 2013-06-28 20:15 - 00000000 ____D C:\Users\Julia\AppData\Local\{0A9DF85A-5F29-48A6-9F59-7AED5359C83F}
2013-06-27 10:26 - 2013-06-27 10:26 - 00000000 ____D C:\Users\Markus\AppData\Local\{79099159-CFBC-40E0-81A4-984631BB5582}
2013-06-26 17:20 - 2013-06-26 17:20 - 00000000 ____D C:\Users\Julia\AppData\Local\{24254659-7DF1-4286-98C0-1DEC37D536AB}
2013-06-25 13:24 - 2013-06-25 13:24 - 00000000 ____D C:\Users\Julia\AppData\Local\{0B555822-9DFE-4A20-AC46-D25D517F2F73}
2013-06-23 10:35 - 2013-06-23 10:35 - 00000000 ____D C:\Users\Julia\AppData\Local\{58770586-01B4-479E-8374-6A2C9DD72287}
2013-06-21 18:07 - 2013-06-21 18:08 - 00000000 ____D C:\Users\Markus\AppData\Local\{5ACA1917-A46C-4F9D-83B4-C9578BA0F984}
2013-06-17 14:20 - 2013-06-17 14:20 - 00000000 ____D C:\Users\Julia\AppData\Local\{974E9041-0D7E-4D11-B58E-BC68FFF24433}
2013-06-16 19:46 - 2013-06-16 19:46 - 00000000 ____D C:\Users\Julia\AppData\Local\{FD44B8FE-9D1F-42F4-AC18-FEE0ABBB495B}
2013-06-14 22:41 - 2013-06-14 22:41 - 00000000 ____D C:\Users\Julia\AppData\Local\{0E933EDE-D73F-43C9-9F18-0CB78745C2C1}

==================== One Month Modified Files and Folders =======

2013-07-14 21:34 - 2013-07-14 21:34 - 00000000 ____D C:\FRST
2013-07-14 20:32 - 2011-09-08 17:05 - 00000432 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-07-14 20:31 - 2013-07-14 13:22 - 00000728 _____ C:\Windows\setupact.log
2013-07-14 20:31 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-14 20:30 - 2011-09-08 16:17 - 01664144 _____ C:\Windows\WindowsUpdate.log
2013-07-14 19:51 - 2012-09-03 18:25 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-14 19:50 - 2013-07-14 19:47 - 01777839 _____ (Farbar) C:\Users\Julia\Downloads\FRST64.exe
2013-07-14 19:46 - 2011-04-21 07:42 - 00697082 _____ C:\Windows\System32\perfh007.dat
2013-07-14 19:46 - 2011-04-21 07:42 - 00148346 _____ C:\Windows\System32\perfc007.dat
2013-07-14 19:46 - 2009-07-14 06:13 - 01613340 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-14 19:41 - 2009-07-14 05:45 - 00020720 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-14 19:41 - 2009-07-14 05:45 - 00020720 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-14 18:18 - 2011-02-10 23:48 - 00000000 ____D C:\Windows\Panther
2013-07-14 18:03 - 2013-07-12 22:50 - 00000004 _____ C:\Users\Markus\AppData\Roaming\cache.ini
2013-07-14 17:51 - 2013-03-20 22:10 - 00000684 _____ C:\Users\Markus\Handy Mods.lnk
2013-07-14 17:01 - 2011-09-09 10:18 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-07-14 17:00 - 2013-03-20 16:53 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-14 17:00 - 2013-03-20 16:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-14 16:38 - 2013-07-14 16:38 - 00602112 _____ (OldTimer Tools) C:\Users\Julia\Downloads\OTL.exe
2013-07-14 16:32 - 2013-07-14 16:32 - 00002060 _____ C:\Users\Julia\Desktop\Entfernen des Avira DE-Cleaners.lnk
2013-07-14 16:32 - 2013-07-14 16:32 - 00001989 _____ C:\Users\Julia\Desktop\Avira DE-Cleaner.lnk
2013-07-14 16:23 - 2013-07-14 16:23 - 00883840 _____ C:\Users\Julia\Downloads\Avira-DE-Cleaner.exe
2013-07-14 15:09 - 2013-07-14 15:09 - 00000036 _____ C:\Users\Julia\AppData\Local\housecall.guid.cache
2013-07-14 15:09 - 2013-07-14 15:07 - 02405664 _____ (Trend Micro Inc.) C:\Users\Julia\Downloads\HousecallLauncher64.exe
2013-07-14 15:04 - 2013-07-14 14:35 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-14 14:41 - 2013-07-14 14:29 - 09833328 _____ (SurfRight B.V.) C:\Users\Julia\Downloads\hitmanpro_x64.exe
2013-07-14 14:03 - 2009-07-14 05:45 - 00324552 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-14 14:00 - 2011-03-15 03:36 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-14 14:00 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-14 14:00 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-14 13:25 - 2011-09-08 17:27 - 00003918 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{13EB83E7-3DCE-4237-B01D-24B0E71B5EFA}
2013-07-14 13:22 - 2013-07-14 13:22 - 00000000 _____ C:\Windows\setuperr.log
2013-07-12 23:49 - 2012-04-30 20:54 - 00000000 ___RD C:\Users\Markus\Dropbox
2013-07-12 23:49 - 2012-04-30 20:51 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Dropbox
2013-07-12 23:29 - 2013-07-12 23:12 - 05576224 _____ C:\Users\Markus\Downloads\Kunibert.vip.18042013.zip
2013-07-12 22:50 - 2013-07-12 22:50 - 00000000 ____D C:\Users\Markus\AppData\Roaming\ArcSoft
2013-07-12 22:50 - 2013-07-12 22:50 - 00000000 ____D C:\Users\Markus\AppData\Local\ArcSoft
2013-07-12 22:50 - 2013-07-12 22:50 - 00000000 ____D C:\Users\Markus\AppData\Local\{41E3F7FD-9864-4682-9614-1B60369A41F4}
2013-07-12 22:50 - 2011-04-20 22:32 - 00000000 ____D C:\ProgramData\ArcSoft
2013-07-12 22:38 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF
2013-07-11 22:33 - 2011-09-09 10:42 - 00000000 ____D C:\Users\Markus\AppData\Local\CrashDumps
2013-07-11 22:32 - 2012-06-03 13:01 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Spotify
2013-07-11 22:32 - 2012-06-03 13:01 - 00000000 ____D C:\Users\Markus\AppData\Local\Spotify
2013-07-11 22:07 - 2013-07-11 22:07 - 00000000 ____D C:\Users\Markus\AppData\Local\{EE6C0A85-C124-4F47-BB37-31622450D854}
2013-07-10 20:52 - 2013-07-10 20:52 - 00000000 ____D C:\Users\Julia\AppData\Local\{1AD071DE-AA5F-43AB-8997-734DDB61B6D6}
2013-07-08 22:11 - 2013-07-08 22:11 - 00000000 ____D C:\Users\Markus\AppData\Local\{7CF159A5-92A8-4109-BFEA-B38E0F091F9B}
2013-07-06 11:49 - 2011-09-08 16:24 - 00000000 ____D C:\Users\Julia\AppData\Local\VirtualStore
2013-07-06 10:57 - 2013-07-06 10:57 - 00000000 ____D C:\Users\Julia\AppData\Local\{240EE7F6-F145-4DC4-813F-004DEDB1E68B}
2013-07-03 17:36 - 2013-07-03 17:36 - 00000000 ____D C:\Users\Julia\AppData\Local\{7F74270E-5795-4857-9931-036298025570}
2013-07-03 17:20 - 2013-07-03 15:30 - 00000000 ____D C:\Users\Julia\Desktop\Scan
2013-07-01 21:22 - 2013-07-01 21:22 - 00000000 ____D C:\Users\Julia\AppData\Local\{FCC9A203-0465-4F13-8E9F-DF828FE2AEB7}
2013-06-29 09:47 - 2013-06-29 09:46 - 00000000 ____D C:\Users\Julia\AppData\Local\{3E5BFCD2-A243-4B59-97EB-8D3239CE0296}
2013-06-28 20:15 - 2013-06-28 20:15 - 00000000 ____D C:\Users\Julia\AppData\Local\{0A9DF85A-5F29-48A6-9F59-7AED5359C83F}
2013-06-28 10:12 - 2012-11-24 13:05 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Scribus
2013-06-28 10:01 - 2011-11-29 19:26 - 00000000 ____D C:\Users\Markus\Desktop\Markus Dateien
2013-06-27 10:26 - 2013-06-27 10:26 - 00000000 ____D C:\Users\Markus\AppData\Local\{79099159-CFBC-40E0-81A4-984631BB5582}
2013-06-27 06:03 - 2011-04-20 22:03 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-06-26 17:20 - 2013-06-26 17:20 - 00000000 ____D C:\Users\Julia\AppData\Local\{24254659-7DF1-4286-98C0-1DEC37D536AB}
2013-06-26 17:09 - 2013-01-30 21:19 - 00000000 ____D C:\Program Files\McAfee
2013-06-25 13:24 - 2013-06-25 13:24 - 00000000 ____D C:\Users\Julia\AppData\Local\{0B555822-9DFE-4A20-AC46-D25D517F2F73}
2013-06-23 10:35 - 2013-06-23 10:35 - 00000000 ____D C:\Users\Julia\AppData\Local\{58770586-01B4-479E-8374-6A2C9DD72287}
2013-06-21 18:10 - 2012-10-21 13:35 - 00160768 ___SH C:\Users\Markus\Desktop\Thumbs.db
2013-06-21 18:08 - 2013-06-21 18:07 - 00000000 ____D C:\Users\Markus\AppData\Local\{5ACA1917-A46C-4F9D-83B4-C9578BA0F984}
2013-06-17 14:20 - 2013-06-17 14:20 - 00000000 ____D C:\Users\Julia\AppData\Local\{974E9041-0D7E-4D11-B58E-BC68FFF24433}
2013-06-16 19:46 - 2013-06-16 19:46 - 00000000 ____D C:\Users\Julia\AppData\Local\{FD44B8FE-9D1F-42F4-AC18-FEE0ABBB495B}
2013-06-14 22:41 - 2013-06-14 22:41 - 00000000 ____D C:\Users\Julia\AppData\Local\{0E933EDE-D73F-43C9-9F18-0CB78745C2C1}

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-10 13:38:02
Restore point made on: 2013-06-14 20:38:07
Restore point made on: 2013-06-17 13:22:48
Restore point made on: 2013-06-21 17:50:29
Restore point made on: 2013-06-25 13:28:32
Restore point made on: 2013-07-03 15:22:03
Restore point made on: 2013-07-09 13:58:50
Restore point made on: 2013-07-12 22:56:51
Restore point made on: 2013-07-12 22:59:16
Restore point made on: 2013-07-12 23:28:42
Restore point made on: 2013-07-14 13:27:31
Restore point made on: 2013-07-14 13:41:31
Restore point made on: 2013-07-14 17:00:09
Restore point made on: 2013-07-14 18:04:15

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4043.86 MB
Available physical RAM: 3401.18 MB
Total Pagefile: 4042.01 MB
Available Pagefile: 3394.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:448.64 GB) (Free:325.39 GB) NTFS (Disk=0 Partition=3)
Drive e: (Recovery) (Fixed) (Total:17.02 GB) (Free:1.1 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:1.88 GB) (Free:1.78 GB) FAT (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 55A4F08D)
Partition 1: (Not Active) - (Size=17 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=449 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 6E652072)
Partition 1: (Not Active) - (Size=811 GB) - (Type=6E)
Partition 2: (Not Active) - (Size=468 GB) - (Type=FF)
Partition 3: (Not Active) - (Size=80 GB) - (Type=74)
Partition 4: (Not Active) - (Size=-379947843584) - (Type=00)


LastRegBack: 2013-05-15 17:31

==================== End Of Log ============================
         

Hallo und

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKU\Markus\...\Winlogon: [Shell] explorer.exe,C:\Users\Markus\AppData\Roaming\cache.dat [94720 2011-11-17] () <==== ATTENTION
C:\Users\Markus\AppData\Roaming\cache.dat
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-07-2013
Ran by SYSTEM at 2013-07-15 18:49:31 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

HKU\Markus\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Markus\AppData\Roaming\cache.dat => Moved successfully.

==== End of Fixlog ====
         

Und?
Funktionieren beide Benutzer jetzt normal?

Sorry. Ja auch mein Account lädt wieder normal.Das Einzige was immer noch festzustellen ist, die
teilweise sehr langsame Internetverbindung.Das war kurz vor der Infektion schon so.
Spotify Streams waren z.B. vor einer Woche über Wlan kein Problem. Jetzt hakt es alle paar Sekunden.
Kann das auch an dem oder anderen Trojanern liegen? Das nervt ganz schön. Ist aber auch auf
Android Tablet und Handy so. Auch kleine Programme aus dem Store brauchen teilweise Minuten.Und das
bei einer nominell 3000 Dsl Verbindung.
Viele Grüße
Markus

Rootkitscan mit GMER

Bitte lade dir GMER herunter: (Dateiname zufällig)

• Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
• Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:

  WARNING !!!
  GMER has found system modification, which might have been caused by ROOTKIT activity.
  Do you want to fully scan your system ?
  

  Unbedingt auf "No" klicken.
• Entferne rechts den Haken bei: IAT/EAT und Show All
• Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
• Starte den Scan mit "Scan".
• Mache nichts am Computer während der Scan läuft.
• Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Tauchen Probleme auf?

• Probiere alternativ den abgesicherten Modus.
• Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.

Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Hallo Cosinus,

Scans haben beide funktioniert. Anbei die Logs. Das Internet ist aber immer noch langsam.
Kommt dann wohl eher von der Fritz Box?!

Gmer:

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-18 19:37:44
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0006 465,76GB
Running: 4t3nvlpt.exe; Driver: C:\Users\Markus\AppData\Local\Temp\pxldypow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                     0000000076961465 2 bytes [96, 76]
.text   C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    00000000769614bb 2 bytes [96, 76]
.text   ...                                                                                                                                     * 2
.text   C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe[2992] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69    0000000076961465 2 bytes [96, 76]
.text   C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe[2992] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155   00000000769614bb 2 bytes [96, 76]
.text   ...                                                                                                                                     * 2
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[6248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076961465 2 bytes [96, 76]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[6248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000769614bb 2 bytes [96, 76]
.text   ...                                                                                                                                     * 2
.text   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                     0000000076961465 2 bytes [96, 76]
.text   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    00000000769614bb 2 bytes [96, 76]
.text   ...                                                                                                                                     * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [3536:2768]                                                                                             000007fef0779688

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004eacbcdc                                                             
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004ec38c7e                                                             
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004eacbcdc (not active ControlSet)                                         
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004ec38c7e (not active ControlSet)                                         

---- EOF - GMER 2.1 ----
         

MBAR:

Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org

Database version: v2013.07.18.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Markus :: JUMA [administrator]

18.07.2013 20:05:59
mbar-log-2013-07-18 (20-05-59).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 280596
Time elapsed: 39 minute(s), 22 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
c:\Users\Markus\AppData\Local\Temp\hdfswo (Trojan.FakeAlert.RRE) -> Delete on reboot.

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

2. Durchlauf ohne Fund

Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org

Database version: v2013.07.18.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Markus :: JUMA [administrator]

18.07.2013 21:55:02
mbar-log-2013-07-18 (21-55-02).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 280054
Time elapsed: 39 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

Viele Grüße
Markus

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo,

hier der Log ComboFix.

ComboFix 13-07-18.04 - Markus 19.07.2013   0:10.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4044.2114 [GMT 2:00]
ausgeführt von:: c:\users\Markus\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\System32\MASetupCleaner.exe
c:\windows\SysWow64\System32\muzapp.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-06-18 bis 2013-07-18  ))))))))))))))))))))))))))))))
.
.
2013-07-18 22:22 . 2013-07-18 22:22	--------	d-----w-	c:\users\Julia\AppData\Local\temp
2013-07-18 22:22 . 2013-07-18 22:22	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-07-18 21:21 . 2013-07-18 21:21	--------	dc----w-	c:\users\Markus\AppData\Local\MigWiz
2013-07-18 20:34 . 2013-07-18 20:34	76232	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F33596DA-0EB1-46E4-BF7C-B6D0F0BA4A90}\offreg.dll
2013-07-18 20:01 . 2013-07-18 20:02	--------	d-----w-	c:\users\Markus\AppData\Local\Axialis
2013-07-18 19:54 . 2013-07-18 20:39	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-07-18 17:58 . 2013-07-18 17:58	--------	d-----w-	c:\programdata\Malwarebytes
2013-07-18 17:43 . 2013-07-02 08:34	9460976	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F33596DA-0EB1-46E4-BF7C-B6D0F0BA4A90}\mpengine.dll
2013-07-14 20:34 . 2013-07-14 20:34	--------	d-----w-	C:\FRST
2013-07-14 13:35 . 2013-07-14 14:04	--------	d-----w-	c:\programdata\HitmanPro
2013-07-12 22:54 . 2013-05-27 05:50	1011712	----a-w-	c:\program files\Windows Defender\MpSvc.dll
2013-07-12 22:54 . 2013-05-27 05:50	571904	----a-w-	c:\program files\Windows Defender\MpClient.dll
2013-07-12 22:54 . 2013-05-27 04:57	392704	----a-w-	c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-12 22:54 . 2013-05-27 05:50	314880	----a-w-	c:\program files\Windows Defender\MpCommu.dll
2013-07-12 22:54 . 2013-05-27 04:57	4608	----a-w-	c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-12 22:54 . 2013-05-27 04:57	54784	----a-w-	c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-12 22:54 . 2013-05-27 03:15	9216	----a-w-	c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-12 22:14 . 2013-06-04 06:00	624128	----a-w-	c:\windows\system32\qedit.dll
2013-07-12 22:14 . 2013-06-04 04:53	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2013-07-12 22:14 . 2013-05-06 06:03	1887744	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-12 22:14 . 2013-05-06 04:56	1620480	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
2013-07-12 21:59 . 2013-06-05 03:34	3153920	----a-w-	c:\windows\system32\win32k.sys
2013-07-12 21:58 . 2013-04-10 05:48	1732608	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2013-07-12 21:58 . 2013-04-10 05:46	1367040	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-12 21:58 . 2013-04-10 05:46	1402880	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2013-07-12 21:58 . 2013-04-10 05:46	1393152	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2013-07-12 21:58 . 2013-04-10 05:03	936448	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-12 21:50 . 2013-07-12 21:50	--------	d-----w-	c:\users\Markus\AppData\Local\ArcSoft
2013-07-12 21:50 . 2013-07-12 21:50	--------	d-----w-	c:\users\Markus\AppData\Roaming\ArcSoft
2013-07-12 21:44 . 2013-04-09 23:34	1247744	----a-w-	c:\windows\SysWow64\DWrite.dll
2013-07-12 21:44 . 2013-04-02 22:51	1643520	----a-w-	c:\windows\system32\DWrite.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-14 16:01 . 2011-09-09 09:18	78185248	----a-w-	c:\windows\system32\MRT.exe
2013-06-12 19:51 . 2012-04-11 09:44	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 19:51 . 2011-09-13 20:07	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-17 14:30 . 2012-02-10 19:29	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-13 05:51 . 2013-06-12 19:48	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 19:48	1464320	----a-w-	c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 19:48	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 19:48	52224	----a-w-	c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 19:48	1160192	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 19:48	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 19:48	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 19:48	1192448	----a-w-	c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 19:48	903168	----a-w-	c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 19:48	43008	----a-w-	c:\windows\SysWow64\certenc.dll
2013-05-10 05:49 . 2013-06-12 19:48	30720	----a-w-	c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 19:48	24576	----a-w-	c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-12 19:54	1910632	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-05-02 00:06 . 2010-11-21 03:27	278800	------w-	c:\windows\system32\MpSigStub.exe
2013-04-26 05:51 . 2013-06-12 19:49	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-04-26 04:55 . 2013-06-12 19:48	492544	----a-w-	c:\windows\SysWow64\win32spl.dll
2013-04-25 23:30 . 2013-06-12 19:48	1505280	----a-w-	c:\windows\SysWow64\d3d11.dll
2013-04-21 17:50 . 2013-04-21 17:50	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	129272	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	129272	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	129272	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-02-13 1509232]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-02-13 844144]
"Spotify Web Helper"="c:\users\Markus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-07-08 1104384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-13 283160]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-02-15 2757312]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-02-13 310128]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-08-04 1612920]
"IJNetworkScannerSelectorEX"="c:\program files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
.
c:\users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 VBTUSB;VBTUSB.Sys VAIO Bluetooth Driver over USB device;c:\windows\system32\Drivers\VBTUSB.sys;c:\windows\SYSNATIVE\Drivers\VBTUSB.sys [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 SplashtopRemoteService;Splashtop® Remote Service;c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe;c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [x]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 19:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	162552	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	162552	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	162552	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32	162552	----a-w-	c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-03-29 518784]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-31 790176]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-31 657056]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-29 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-29 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-29 418328]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 497648]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-14 2779024]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: Free YouTube Download - c:\users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-19  00:29:23
ComboFix-quarantined-files.txt  2013-07-18 22:29
.
Vor Suchlauf: 15 Verzeichnis(se), 352.147.431.424 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 352.926.650.368 Bytes frei
.
- - End Of File - - 6816BF7F6B642542E9ABAB765F48A390
D41D8CD98F00B204E9800998ECF8427E
         

Herzliche Grüße
Markus

JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Im Anschluss:

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Danach eine Kontrolle mit OTL bitte:

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles in CODE-Tags hier in den Thread.

Hallo Cosinus,

Arbeiten wurden wie aufgetragen erledigt. Aufgrund der Hitze aber erst nach Sonnenuntergang ;-)

Hier die Logs :

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.1.7 (07.20.2013:1)
OS: Windows 7 Home Premium x64
Ran by Markus on 20.07.2013 at 21:33:00,94
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\secman.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\{4d076ab4-7562-427a-b5d2-bd96e19dee56}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{66eef543-a9ac-4a9d-aa3c-1ed148ac8eee}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{826d7151-8d99-434b-8540-082b8c2ae556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{66eef543-a9ac-4a9d-aa3c-1ed148ac8eee}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\splashtop"
Successfully deleted: [Folder] "C:\Users\Markus\AppData\Roaming\dvdvideosoftiehelpers"
Successfully deleted: [Folder] "C:\Users\Markus\AppData\Roaming\opencandy"
Successfully deleted: [Folder] "C:\Users\Markus\AppData\Roaming\pdfforge"
Successfully deleted: [Folder] "C:\Users\Markus\appdata\local\opencandy"
Successfully deleted: [Folder] "C:\Users\Markus\appdata\local\splashtop"
Failed to delete: [Folder] "C:\Program Files (x86)\splashtop"
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{000CE00C-F0D9-4079-BA89-EF4E96AA1E37}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{008954C9-5472-4B05-8D0B-609E05F83450}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{02499BC2-5B4A-47DF-B8D5-EE42DF1D7421}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{02DD121D-EB07-4812-B8C8-A3ED67A2D49F}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{0896CC4D-AB42-4698-BB30-1D8FAA4E5CD6}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{0C8638D3-0C2F-407D-98FD-7F83858415D2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{0C8D8A89-DA39-482E-A20B-7DF473EF3B39}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{0D55D655-6794-47AB-84F9-4779380B6B62}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{0EB0BCF1-163B-4DAA-845B-62F195EC1E2A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{0FBA1999-967D-48D6-BCA0-801325CCFDF3}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{102F8D77-0E61-44AF-BC7F-7AAAA91AAC5B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{1220F3F4-F99F-468A-804A-BAC0B92EDDAE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{16947A2A-1E23-4A29-8CA4-0B167DDCD6F7}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{170A3914-C117-4278-ABAF-D3B7C1EE689C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{17CAFD94-4A49-476B-95C9-F26ACC84204E}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{18DCA731-2C5A-4F5C-9923-471C103127C0}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{1C28A4E4-F2BF-4E02-82F1-EF60950932A5}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{1D4BC276-7303-42D1-B4DE-2B6BFC047F0E}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{1E6CBC86-C650-40F8-9B7D-754F5F9C4C82}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{201394BF-F80F-442B-BC9D-C34E1E4B5945}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{206220FA-BBC0-47E9-82FA-0699EBB7D15C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{217C597F-21D9-447B-90F2-A38D93FB86FD}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{239CC8F2-90DA-4671-B48E-7C933E98D5C0}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{260A4BE7-A6B7-4D52-9FF7-7A0CDF0B0DEB}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{28CE13E6-7E62-4726-9E8E-D8F645AFC6AB}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{2AA396EE-229C-496C-8144-27E5BDEFDCBF}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{2C0C41B1-A660-42B0-B3FD-A133306D54A8}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{2DDE1388-0C27-4A49-8DA1-433EFBD9A673}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{2F2A6E37-4CE1-423B-A615-EB8E0DCAB886}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{3004D3AF-EEE3-43E0-AA70-8B0F114B5FEE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{399742AF-6168-4A5E-95C9-4B3F2AEDC2CB}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{39E00104-61A5-4A04-BA64-E9FAB43E0FB1}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{3DA35C7B-A28C-488E-AFA1-F366A0B816A9}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{4007204E-56F5-4539-A86F-0929F920E509}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{4097CA36-158C-4713-807C-00F18F253379}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{41E3F7FD-9864-4682-9614-1B60369A41F4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{42B524FE-BCCE-4875-AF36-557B8A3F86FA}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{470284F0-C89D-47BF-9E6A-57AB234EC204}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{478AD10E-D6F1-4F9D-90AB-AF9D27EAD9DC}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{47EC795B-EFEE-4376-8BEC-EFD9F8103FE2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{48618E21-2365-436A-902C-847B01BEB523}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{4B57FDA9-3605-42A9-A8BE-6CCA7DD9C1B4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{4D506D5E-E62D-4653-9EF3-64A5E2F98992}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{535F3832-21BD-4586-A9B3-A0CC7C794E4E}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{53AE69CD-F4FD-48B4-B7C6-3B7E831093A9}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{53CE3B38-10C9-43B7-B02F-15E452FCAFC4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{53F73ED8-2794-4BE6-8F65-A0814D834528}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5434BAB3-0949-4895-94BA-9961D9C7A182}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{54FDDBD2-2DC5-44EC-A04C-EB2D16EB94C4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{56377F0C-EF1B-4A3D-975C-B51FBE8620A2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5684679C-3176-4409-A8AC-37B1DEF2956D}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{56D998F6-E3BC-4D32-98F7-331E0F9C8DE3}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{578C4D94-3142-4A49-8D27-05AA64D78DAF}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5825618B-91A0-4465-A503-6627B3990AEC}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{58996F0A-B653-43EF-8DBC-6307BA23307F}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{58B49A39-35AA-4801-92FB-CC2B31833A0E}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{593114C7-3D4E-4272-AA82-DDF4F992867F}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{59A2B240-5383-4F53-982A-C248E2D3D01F}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5ACA1917-A46C-4F9D-83B4-C9578BA0F984}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5AFD7864-D0E1-46AD-B8F9-C36F5534D9EB}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5B798A17-4F6E-4703-B4A1-99CD66EEE32B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{5ED12CC7-8B71-40BC-B2EE-6A7AEFFF05AE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{631689FA-86F0-4AA7-B8F0-C7A3259FD7CE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{63D6F450-AAEA-4F0F-8ACA-DC7DECA4C6C3}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{65901BC1-9106-4098-B054-85FA6473FEDB}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{667D7553-B5AA-438F-A7E9-BA384EAF2BE3}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{681161AD-15D3-4B9E-AECB-E69807FB0E6D}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{6F2BEEBC-524F-4815-897C-DBCD61EFD1EE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{75DA619D-6C58-4A38-8CD2-2A525649FD3B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{77FA61B0-2203-43B1-B95F-1F3AB452EE92}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{79099159-CFBC-40E0-81A4-984631BB5582}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{79CE0A9A-57C9-4A70-8C87-F6FD598F7022}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{79D00557-C21E-4B1C-B73A-732297FCD0F5}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{7C88E401-B96F-4A26-9BF1-D08BF0FF3006}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{7CF159A5-92A8-4109-BFEA-B38E0F091F9B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{7D8AE3B7-EDA1-430B-AD9A-A57AF501C275}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{7DC4C43C-853D-49D7-A6EF-1BFAE2E410F1}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{80514843-9038-4269-8A34-02266F0695F4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{80B0DAB3-0233-4E15-A623-2EB86C369F05}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{80EFF0D8-1D27-4703-A451-D97B64D9C347}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{813EAFD5-6926-4000-9EB4-1587A8FCB22C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{83E2ECDF-4248-4853-BCB1-4F5B39A42CA5}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{88F5EE08-5FA0-4447-B506-9DB764034E6E}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{891E4728-8C9E-4905-9851-83564990D9A6}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{8964FF57-CC33-47A0-9BEB-584C5DA3C0CE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{8D7991D8-02D4-46CA-B9B9-A4E87891A6A2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{8DF21E3B-D271-44F9-9D9E-01179AF78663}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{8F7BCEB1-36F9-4BC1-B263-AC1C56BFC2A8}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{9167E20B-10F8-48E0-91D1-90401DC2781A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{930EB7D4-4CA4-4DD2-9831-9789C410158B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{94219DC6-0F7D-4FCF-912F-5A1EDAE5A7DB}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{9550A62F-279E-411A-894F-49291A64E80D}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{96F19288-65EF-4AD0-8423-650EB46DDAF1}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{981DFD2F-FA09-444F-8D65-5D14CA63CB5B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{98242CFE-ADD1-48D4-A534-2532A146032C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{9B6B185A-8B77-463C-B109-9F3C0C4D3E51}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{9BEB565C-03DB-4C5B-84D1-3A8113BF2C49}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{A0843254-790A-4B38-AEA3-83169A069D1F}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{A20576A1-8EEF-4759-8901-388B98DC662C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{A59BA3A1-4754-4159-B8EE-C837C1430182}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{A623650F-1B28-44BB-A4FE-91D83EDC6F46}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{A916E54C-AB5C-4B1A-8E2F-9FF6D3000058}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{A9FA50BB-29F6-4A86-8682-0FFF6416D049}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{AAF53F48-C5F5-44B2-AA66-C4024C7557B0}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{AD170E29-2DC7-43C1-9664-9CC5C952443B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{AE14D258-3E4B-46B6-80A2-326597CD1FBA}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{AF062E34-036C-4323-8C51-98D612AC7950}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B27DD67D-2EA5-417A-89BE-AAD7FAC02AC7}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B33D26D8-9890-4D6B-A47E-BF0402A6F51A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B3587B83-3A4E-4C53-99B5-DE0A86A91141}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B634BDEA-437F-4396-9D19-BFDC66A47CD3}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B675D677-B1F8-4E4A-ABB5-2BDC285DB894}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B8019A47-FDE6-4860-A061-3269FC8CEE38}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B89122F4-C8A1-4671-9738-C7917DCC9467}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B8FE75CF-50F7-4878-BD62-3840232D8285}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{B9907F2B-0796-4914-8341-529DD3071C5B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BAA7D164-100B-4902-A8CD-93BEAC2A2503}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BAD05E1D-6FED-486C-8338-AD5448DDC8EC}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BBD7A22B-2C99-452D-8728-23D7B75ED32D}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BD762F43-4494-4DFB-BE81-A4DEDD7EAE79}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BD860070-8711-46AB-995D-22E51EC0126B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BDA68971-C792-49A0-A13A-518BBA3701E7}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BEE17BD0-7348-44E4-8E3E-94B9EB0BABB2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{BFF3C0D0-1434-4050-AFD2-0A1A203E20EF}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C01C0177-051B-41C8-BA60-A51287B686B3}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C0CFE64E-8411-4938-A8C3-3BE33F65518B}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C1A92747-3C39-4D11-BBB2-E424D90C5BE8}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C229A351-623D-492E-A749-B20005A19A6A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C23214AC-AE34-4C8E-B5B3-238FA56D8B56}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C6020498-7393-4CA1-B866-A3E73EADC626}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C701C7D0-E7DC-4D41-935B-01C158D318E1}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{C8033FD7-90E8-40FD-87CD-8FB2AE75339A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{CCD45CDE-8BD0-42B3-975E-0B040034A143}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{CDC56F05-7538-415F-BF68-DAA6D3227E1F}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{D12FC1C0-B7B0-46AD-8758-6DDAB5A224E0}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{D1E5A190-BB52-4AA1-A67B-0275B07B655A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{D236DFD3-237A-4F1C-B5E6-A397FD3CA5AE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{D48BEBAC-8DBD-4F44-9AD8-086B81DB1A40}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DA36FFAB-059C-4EFE-8B5C-503D801EAAB2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DA3988DE-1FD2-49D3-840B-CF6FC7F972DE}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DCE4A8AF-E331-4BC4-B1EF-4B2B42F620B4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DDB5F2DC-F28C-4A39-88A2-D127A0998810}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DE26A17E-2AA7-4AA6-8FEB-CA710705FA5A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DE56D933-82E8-4B46-9C37-D741A847678D}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DE775755-097F-49F8-8A3E-95C8EF8761D9}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DFB523B2-9D5A-4679-B8C8-0718613E104D}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DFCC9EC5-7746-416F-B11C-16049F141289}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{DFFCB06F-9BDA-43F1-B842-2898BDA04A87}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E0EE7521-DA89-421F-8C99-C8E8F5D53812}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E28855E0-1B28-4774-A527-F4A3F2E88DCA}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E33A9CCF-14C8-48CD-A284-D34979CDF776}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E6003F99-2875-459D-871F-AA42CDC7C7A2}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E693D1F0-FE2A-419F-AC84-2EFF38375B4A}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E6E10E51-4195-4F75-80E9-BCAE8E6C5BA9}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E8F0AB36-E86C-45AA-8F6B-A6C009E713AF}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{E981625D-665E-47D4-838A-4C3782AD668C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{EAB8F638-F5DF-43A9-A6B0-3C1C9038D730}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{EDDDC931-00C2-4EA4-A0FC-17AA1BAD31D0}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{EE6C0A85-C124-4F47-BB37-31622450D854}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{EFB59C12-A5C0-4893-AF50-CF92A07EBD0C}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{F4E1709C-A94A-4B8D-B7F8-E92CCB223DD4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{F9B47AE2-B711-4969-989D-371E54CE9026}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{FA0CAA08-18F0-42CA-949D-A3E41E9C34D4}
Successfully deleted: [Empty Folder] C:\Users\Markus\appdata\local\{FCA95B08-9FE1-4F83-9334-3FFE6026C1EE}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.07.2013 at 21:39:43,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

ADW

# AdwCleaner v2.306 - Datei am 20/07/2013 um 21:55:02 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Markus - JUMA
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Markus\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Die Registrierungsdatenbank ist sauber.

*************************

AdwCleaner[S1].txt - [881 octets] - [20/07/2013 21:55:02]

########## EOF - C:\AdwCleaner[S1].txt - [940 octets] ##########
         

OTL

OTL txt

OTL logfile created on: 20.07.2013 22:05:10 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Markus\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,95 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 60,72% Memory free
7,90 Gb Paging File | 6,04 Gb Available in Paging File | 76,51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 448,64 Gb Total Space | 328,52 Gb Free Space | 73,23% Space Free | Partition Type: NTFS
 
Computer Name: JUMA | User Name: Markus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Markus\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Markus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
PRC - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
PRC - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Programme\Sony\VAIO Care\listener.exe (Sony of America Corporation)
PRC - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
PRC - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\e937e3331234e8da935e71172e46ba17\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\34002b75cd0faab68bf8079299c1aa46\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c8ea295fd4dce110b32c3c4f0e3807b2\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\178644ab40108f3becd8b91049a254c3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\bfa7a95284aec941f4b03bae0debe07c\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c25666b99761bc42322bae2e59968df8\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (SampleCollector) -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (McAfee SiteAdvisor Service) -- c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe (McAfee, Inc.)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SSUService) -- C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
SRV - (SplashtopRemoteService) -- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.)
SRV - (VUAgent) -- C:\Programme\Sony\VAIO Update\VUAgent.exe (Sony Corporation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (IconMan_R) -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (VcmIAlzMgr) -- C:\Programme\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (VAIO Event Service) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (VSNService) -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV - (uCamMonitor) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (SOHCImp) -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (VcmXmlIfHelper) -- C:\Programme\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV - (VcmINSMgr) -- C:\Programme\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV - (VCService) -- C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (SpfService) -- C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV - (VCFw) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (PMBDeviceInfoProvider) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (AdobeActiveFileMonitor9.0) -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (RSPCIESTOR) -- C:\Windows\SysNative\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros)
DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros)
DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros)
DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros)
DRV:64bit: - (btath_avdt) -- C:\Windows\SysNative\drivers\btath_avdt.sys (Atheros)
DRV:64bit: - (ATHDFU) -- C:\Windows\SysNative\drivers\AthDfu.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros)
DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VBTUSB) -- C:\Windows\SysNative\drivers\VBTUSB.sys (Sony Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (SFEP) -- C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (e1yexpress) -- C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (FsUsbExDisk) -- C:\Windows\SysWOW64\FsUsbExDisk.Sys ()
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes\{36223D5C-F972-4D2A-991A-B87BF0BD6F0D}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes\{68EF156E-16E0-4105-AE28-C05CD5FBED89}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-21/4?satitle={searchTerms}
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes\{915C00FC-3183-478A-8DE5-ACEA02485D2F}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2013.06.27 07:03:02 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2013.07.19 00:27:16 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003..\Run: [Spotify Web Helper] C:\Users\Markus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2687C675-97D1-4EC0-AFB5-53DFC4FF3B66}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7CB938F2-7400-48A7-8010-03EA6E22EC79}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.20 21:56:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Splashtop
[2013.07.20 21:32:57 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.07.20 21:28:38 | 000,559,511 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Markus\Desktop\JRT.exe
[2013.07.19 00:30:51 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.07.19 00:29:25 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.07.19 00:07:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.07.19 00:07:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.07.19 00:07:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.07.19 00:07:40 | 000,000,000 | ---D | C] -- C:\ComboFix
[2013.07.19 00:07:36 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.07.19 00:06:59 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.07.18 23:54:10 | 005,091,168 | R--- | C] (Swearware) -- C:\Users\Markus\Desktop\ComboFix.exe
[2013.07.18 23:21:48 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Local\MigWiz
[2013.07.18 22:01:45 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Local\Axialis
[2013.07.18 21:54:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013.07.18 19:58:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.07.18 19:56:42 | 000,000,000 | ---D | C] -- C:\Users\Markus\Desktop\mbar
[2013.07.14 22:34:15 | 000,000,000 | ---D | C] -- C:\FRST
[2013.07.14 19:11:34 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.07.14 19:11:34 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.07.14 19:11:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.07.14 19:11:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.07.14 19:11:33 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.07.14 19:11:33 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.07.14 19:11:33 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.07.14 19:11:33 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.07.14 19:11:33 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.07.14 19:11:32 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.07.14 19:11:32 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.07.14 19:11:31 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.07.14 19:11:31 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.07.14 19:11:31 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.07.14 19:11:30 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.07.14 15:35:09 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013.07.13 00:14:51 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll
[2013.07.13 00:14:51 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll
[2013.07.13 00:14:49 | 001,887,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
[2013.07.13 00:14:48 | 001,620,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
[2013.07.12 23:50:53 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Local\ArcSoft
[2013.07.12 23:50:45 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Roaming\ArcSoft
[2013.07.12 23:44:12 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.20 22:04:13 | 000,020,720 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.20 22:04:13 | 000,020,720 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.20 22:01:22 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.07.20 22:01:22 | 000,697,082 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.07.20 22:01:22 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.07.20 22:01:22 | 000,148,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.07.20 22:01:22 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.07.20 21:57:15 | 000,000,431 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2013.07.20 21:56:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.20 21:56:22 | 3180,220,416 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.20 21:53:56 | 000,666,633 | ---- | M] () -- C:\Users\Markus\Desktop\adwcleaner.exe
[2013.07.20 21:51:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.07.20 21:31:15 | 000,559,511 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Markus\Desktop\JRT.exe
[2013.07.19 00:27:16 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.07.19 00:06:50 | 005,091,168 | R--- | M] (Swearware) -- C:\Users\Markus\Desktop\ComboFix.exe
[2013.07.18 20:58:19 | 000,003,288 | ---- | M] () -- C:\bootsqm.dat
[2013.07.18 19:24:25 | 000,377,856 | ---- | M] () -- C:\Users\Markus\Desktop\4t3nvlpt.exe
[2013.07.14 19:03:50 | 000,000,004 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\cache.ini
[2013.07.14 18:51:07 | 000,000,684 | ---- | M] () -- C:\Users\Markus\Handy Mods.lnk
[2013.07.14 15:03:46 | 000,324,552 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.07.13 00:29:25 | 005,576,224 | ---- | M] () -- C:\Users\Markus\Desktop\Kunibert.vip.18042013.zip
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.07.20 21:45:36 | 000,666,633 | ---- | C] () -- C:\Users\Markus\Desktop\adwcleaner.exe
[2013.07.19 00:07:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.07.19 00:07:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.07.19 00:07:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.07.19 00:07:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.07.19 00:07:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.07.18 20:58:19 | 000,003,288 | ---- | C] () -- C:\bootsqm.dat
[2013.07.18 19:23:37 | 000,377,856 | ---- | C] () -- C:\Users\Markus\Desktop\4t3nvlpt.exe
[2013.07.13 00:12:31 | 005,576,224 | ---- | C] () -- C:\Users\Markus\Desktop\Kunibert.vip.18042013.zip
[2013.07.12 23:50:42 | 000,000,004 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\cache.ini
[2013.03.20 23:10:46 | 000,000,684 | ---- | C] () -- C:\Users\Markus\Handy Mods.lnk
[2013.03.02 15:29:13 | 000,110,592 | ---- | C] () -- C:\Windows\SysWow64\FsUsbExDevice.Dll
[2013.03.02 15:29:13 | 000,037,344 | ---- | C] () -- C:\Windows\SysWow64\FsUsbExDisk.Sys
[2013.01.06 11:40:49 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2012.02.23 00:16:53 | 000,000,017 | ---- | C] () -- C:\Users\Markus\AppData\Local\resmon.resmoncfg
[2011.10.14 00:44:17 | 000,050,176 | ---- | C] () -- C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.05.07 17:50:35 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Canon
[2012.06.27 12:57:35 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DVDVideoSoft
[2012.08.18 18:06:37 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\IrfanView
[2011.09.16 23:44:00 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\MAGIX
[2011.11.14 17:44:34 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\OpenOffice.org
[2011.10.14 13:25:27 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Samsung
[2012.11.30 00:34:49 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Scribus
[2013.04.27 11:31:40 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\SoftGrid Client
[2011.11.18 20:23:22 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TP
[2011.11.03 15:31:44 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Windows Live Writer
[2013.06.12 20:42:03 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Canon
[2013.07.15 22:40:56 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Dropbox
[2012.02.18 15:35:45 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DVDVideoSoft
[2011.12.13 01:39:05 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\IrfanView
[2011.09.16 23:41:34 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\MAGIX
[2011.10.08 00:08:42 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\OpenOffice.org
[2013.03.02 13:29:50 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Samsung
[2013.06.28 11:12:44 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Scribus
[2013.05.27 18:33:07 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\SoftGrid Client
[2013.07.18 23:10:08 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Spotify
[2011.10.06 22:08:36 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Windows Live Writer
 
========== Purity Check ==========
 
 

< End of report >
         

Extra txt

OTL Extras logfile created on: 20.07.2013 22:05:10 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Markus\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,95 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 60,72% Memory free
7,90 Gb Paging File | 6,04 Gb Available in Paging File | 76,51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 448,64 Gb Total Space | 328,52 Gb Free Space | 73,23% Space Free | Partition Type: NTFS
 
Computer Name: JUMA | User Name: Markus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{24E1C4FC-BFA6-435C-83E2-03835A5A4945}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{2EEAAE20-0887-4E3E-9ECB-4F6CFCDBD55D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{32377704-159A-4FEC-B749-16236B5AD490}" = lport=137 | protocol=17 | dir=in | app=system | 
"{4095F8EB-6E7F-495D-9F1F-8467321A16BD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{42163407-A867-45CC-A92F-B7A7E8AF1507}" = lport=139 | protocol=6 | dir=in | app=system | 
"{42696640-0B01-4669-9404-EF2CA5D85584}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{581DC84C-05A8-45DB-8A87-E053BC8DA7CE}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{5BA20133-D8FD-40DD-85A4-8708F85332F7}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{5BE9C7A6-5375-44FD-BBF6-B9F36DA284E9}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{63EFE8B9-2D4E-4F54-B452-4E4FFF95044D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{7122CC43-314E-4472-9075-75B5DC6213B3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{72C0F2EF-39C8-48D2-8B1C-1E8433097DAC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{737B7569-5B3E-44EE-973F-FCD606468F5A}" = lport=445 | protocol=6 | dir=in | app=system | 
"{83E294A5-6616-4A0B-ABE6-1C04DD365B40}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8CA91853-8281-4440-9D0A-11CE34D946F2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8F329F4A-6A5D-4900-85BA-18582F22285C}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{9F70554B-2257-4A60-B79D-83096DB91F81}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A7E9A4B2-A071-47C4-9A6D-38420214B6F2}" = rport=138 | protocol=17 | dir=out | app=system | 
"{B2697F3C-25F8-42AF-A1F6-3D72A6EED8B5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B7BAFD35-9190-40F2-818D-45CFAC26AB87}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{BC481BFA-32F1-42AD-9F59-FDA7BF922BDF}" = rport=445 | protocol=6 | dir=out | app=system | 
"{C1509C65-CBA1-4E50-B2F3-32452699F6C7}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{D8C08B3E-AF9C-4C2D-9836-FA5C99BE6592}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DC35E2F8-2146-4566-8DC8-38B0D094820C}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{E480FF03-ACBD-415A-B38E-E3ABBDC168E2}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{E55F1C34-5606-4745-B2C0-DC4DF03BE96D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{E805430B-1A45-4408-BE55-B626EF234CC9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{ED9582BD-69A5-4C6E-B998-B49496177AE7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F1BDEF3D-52C0-414C-A011-F3A734690F89}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{F2F1B574-A6F3-4902-801E-C64C2AE8A2F2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F3DE2F2D-2765-4175-8B64-2F75F6442C2F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F8C2CB9B-E6D8-4332-A06D-1D1EE6179141}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FC6D8C6A-816D-47EE-AD72-4092344D3141}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{FF7579A5-DFE9-464D-B349-AA77A5E8CB20}" = lport=138 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02A91A98-723A-453B-ABF0-85442CDAD422}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{0C397E1E-5F98-4572-AFA7-07D692CB6CDC}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{1AE80839-5416-4E96-A3D9-85E2778F3E25}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{21120D20-4C57-4D13-9C49-4BF19429A477}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{22EA5D2D-2DD1-46BA-97E2-70D8BF13E1D3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{27982A76-EA2A-4A99-83F5-305950B20400}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{2884E3F6-6636-42E2-8003-EE42640BB9F8}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{2C16BF9A-4BD0-4609-B059-6C00A6870224}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{2D34D4F9-B391-4E71-B62C-32F3EF8809DF}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{32F1CC02-A011-4829-86AB-F8742FE1309A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{457CFF38-C085-49A1-967B-4AA783FB5FB5}" = dir=in | app=c:\program files (x86)\splashtop\splashtop remote\server\dataproxy.exe | 
"{462DB145-E3DE-416B-B9D3-934D2997BAF9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{51B81D71-C019-4C52-933C-4C9CD46777E0}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{5ECCA2AD-6116-46DB-A0F7-91025314EAF9}" = dir=in | app=c:\program files (x86)\splashtop\splashtop remote\server\srfeature.exe | 
"{60566AC2-F592-4542-AF88-1E259D4FC7E9}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{62344C60-9F00-4B18-AAC1-27B753D9E062}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{73BBE3D0-0221-43B4-833A-9391AD86EC8D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7DE264EA-21E1-462A-A033-9DB216BC8DD7}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{812BB5E6-EB7D-4237-A37D-3FA5BDADF625}" = dir=in | app=c:\program files (x86)\splashtop\splashtop remote\server\srserver.exe | 
"{8EAEE616-58B0-42F0-B703-5223171A35E5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{97C52524-60AF-4B70-89F0-4CFAEEDEC85C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A172ED1D-8713-4F89-A235-0F5FC2166873}" = protocol=17 | dir=in | app=c:\users\markus\appdata\roaming\dropbox\bin\dropbox.exe | 
"{A3413165-11C8-409C-BFBC-B46474DF7090}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{A4F6701B-7C43-412F-84E4-B796EAED3950}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{ACD4D233-EA20-4CD7-977B-CF9152A4B391}" = protocol=6 | dir=in | app=c:\users\markus\appdata\roaming\dropbox\bin\dropbox.exe | 
"{ADCBC731-7714-4D9F-8F54-413AF7F99498}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{AE9B55B0-096A-40D9-86CA-7A2B68D422E2}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{B326DEFB-75BF-4276-AA8F-A20F351B034C}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{B517EEAF-5AF7-4974-AAB4-F1E31E5A24DB}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{B64E5C9B-B0CF-4A6C-8970-3811E4582382}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{B75DE459-8521-44C8-B0D0-D89E29C256A9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{BCD192EE-9978-478F-964A-C45A48915B6E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{BF504808-F903-4934-BD61-C5C0A65EB95B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{C2CD62D2-02BA-4F21-A646-68ECA67E51F6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D537C9EB-1677-4323-81CA-1153FE0FBCB2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{DFE8D2CB-3F1E-4717-B8C8-B79030AC24AE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{E2BAF157-44ED-4276-88ED-43B64602FBFA}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{ED4D8DB5-29B0-4E44-8F21-711A1C7E7F11}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{F38C99F2-460E-45AC-9295-13410B727370}" = protocol=6 | dir=out | app=system | 
"{F44A0EE4-7D3D-41C4-8F32-EFF48D3282CB}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{FB7D1100-FBEE-4FD5-A7F7-F9838BE922C2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{2D0A5A81-0033-47CB-A535-A64019A5E585}C:\users\markus\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\markus\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{A1706D0B-D910-49B2-AA80-56859902DA75}C:\users\markus\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\markus\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{ACC2E7AE-6832-4FD9-B18E-5EEB0470AB99}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{C0A3CB9D-A979-4439-9FBC-B00482970C5A}C:\users\markus\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\markus\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{23286533-7621-4022-AE25-8D52F52E8B51}C:\users\markus\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\markus\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{544C1094-797D-48DD-9A8B-719917056336}C:\users\markus\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\markus\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{E5887488-CC81-4FB2-88B6-86A821F8355A}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{E731CC85-8256-43FF-A03A-0472E932BFC4}C:\users\markus\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\markus\appdata\roaming\dropbox\bin\dropbox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{115B60D5-BBDB-490E-AF2E-064D37A3CE01}" = Media Gallery
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5300_series" = Canon MG5300 series MP Drivers
"{133D3F07-D558-46CE-80E8-F4D75DBBAD63}" = PMB VAIO Edition Plug-in
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{1685AE50-97ED-485B-80F6-145071EE14B0}" = Windows Live Remote Service Resources
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{22AB5CFD-B3DB-414E-9F99-4D024CCF1DA6}" = Windows Live Remote Client Resources
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources
"{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java(TM) 6 Update 22 (64-bit)
"{2C1A6191-9804-4FDC-AB01-6F9183C91A13}" = Windows Live Remote Client Resources
"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources
"{312395BC-7CC2-434C-A660-30250276A926}" = SSLx64
"{34384A2A-2CA2-4446-AB0E-1F360BA2AAC5}" = Windows Live Remote Service Resources
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{3921492E-82D2-4180-8124-E347AD2F2DB4}" = Windows Live Remote Client Resources
"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4C2E49C0-9276-4324-841D-774CCCE5DB48}" = Windows Live Remote Client Resources
"{4EFA8109-732B-4026-9F0C-B70ECF3F9293}" = Windows Live Remote Service Resources
"{4F31AC31-0A28-4F5A-8416-513972DA1F79}" = Sony Corporation
"{5141AA6E-5FAC-4473-BFFB-BEE69DDC7F2B}" = Windows Live Remote Service Resources
"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources
"{57F2BD1C-14A3-4785-8E48-2075B96EB2DF}" = Windows Live Remote Service Resources
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5F44A3A1-5D24-4708-8776-66B42B174C64}" = Windows Live Remote Client Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{61407251-7F7D-4303-810D-226A04D5CFF3}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6B7DE186-374B-4873-AEC1-7464DA337DD6}" = VU5x64
"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{75C95C84-264F-4CC7-8A7E-346444E6C7C1}" = VAIO Improvement Validation
"{7AEC844D-448A-455E-A34E-E1032196BBCD}" = Windows Live Remote Service Resources
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9E9C960F-7F47-46D5-A95D-950B354DE2B8}" = Windows Live Remote Service Resources
"{9F672527-2BE4-47AB-B061-C057BDE30B30}" = Windows Live Remote Client Resources
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A060182D-CDBE-4AD6-B9B4-860B435D6CBD}" = Windows Live Remote Client Resources
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources
"{D55EAC07-7207-44BD-B524-0F063F327743}" = VIx64
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{ED421F97-E1C3-4E78-9F54-A53888215D58}" = Windows Live Remote Client Resources
"{F1DC5C16-9B1F-467B-85E3-CB48C27AC50D}" = VESx64
"{F2611404-06BF-4E67-A5B7-8DB2FFC1CBF6}" = VSNx64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"WinRAR archiver" = WinRAR 4.01 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{046885A1-B4AE-4459-A0D1-8C93706698D6}" = 
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger
"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common
"{07441A52-E208-478A-92B7-5C337CA8C131}" = VAIO - Remote Play mit PlayStation®3
"{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}" = VAIO Smart Network
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{08D7BC86-7358-464C-8AD0-0D84B5F0A0C9}" = Remote Keyboard
"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack
"{09B7C7EB-3140-4B5E-842F-9C79A7137139}" = Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack
"{0C975FCC-A06E-4CB6-8F54-A9B52CF37781}" = Windows Liven sähköposti
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail
"{110668B7-54C6-47C9-BAC4-1CE77F156AF5}" = Windows Live Mesh
"{11417707-1F72-4279-95A3-01E0B898BBF5}" = Windows Live Mesh
"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer
"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar
"{133D9D67-D475-4407-AC3C-D558087B2453}" = Windows Live Movie Maker
"{13EC74A6-4707-4D26-B9B9-E173403F3B08}" = Quick Web Access
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17835B63-8308-427F-8CF5-D76E0D5FE457}" = Windows Live Essentials
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A72337E-D126-4BAF-AC89-E6122DB71866}" = Windows Liven valokuvavalikoima
"{1B0545C4-620F-4661-A369-C4D113F24932}" = Windows Live Writer Resources
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DA6D447-C54D-4833-84D4-3EA31CAECE9B}" = Windows Live UX Platform Language Pack
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{22008CF9-2B54-4022-AFD8-3B7D42C89E6B}" = PMB VAIO Edition Plug-in
"{220C7F8C-929D-4F71-9DC7-F7A6823B38E4}" = Windows Live UX Platform Language Pack
"{2303F9E7-6293-4A85-BC21-CA226FAD5CE4}" = Windows Live Mail
"{241E7104-937A-4366-AD57-8FDDDB003939}" = Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi
"{24DF33E0-F924-4D0D-9B96-11F28F0D602D}" = Windows Live UX Platform Language Pack
"{25175695-4B20-4298-9F34-C2C57CD277B3}" = Elements STI Installer
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{25CD4B12-8CC5-433E-B723-C9CB41FA8C5A}" = Windows Live Writer
"{260E3D78-94E6-47EC-8E29-46301572BB1E}" = Control ActiveX Windows Live Mesh pentru conexiuni la distanță
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources
"{28B9D2D8-4304-483F-AD71-51890A063A74}" = Windows Live Photo Common
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2BA5FD10-653F-4CAF-9CCD-F685082A1DC1}" = Windows Live Writer
"{2C8FBAB0-4564-47B8-AC4B-9C7401B94BF2}" = Основи Windows Live
"{2D3E034E-F76B-410A-A169-55755D2637BB}" = Windows Live Mesh
"{2DCD52EE-1AE1-4128-9819-A79F7D09B6B3}" = MAGIX Foto Designer 7
"{2E50E321-4747-4EB5-9ECB-BBC6C3AC0F31}" = Windows Live Writer Resources
"{2EFEAD58-3311-4B2B-9D8A-8D663581D109}" = Splashtop Streamer
"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{339F9B4D-00CB-4C1C-BED8-EC86A9AB602A}" = PMB VAIO Edition Guide
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}" = VAIO Care
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{376D59B1-42D9-4FA2-B6CC-E346B6BE14F5}" = ActiveX-kontroll för fjärranslutningar för Windows Live Mesh
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39F95B0B-A0B7-4FA7-BB6C-197DA2546468}" = Windows Live Mesh
"{3A26D9BD-0F73-432D-B522-2BA18138F7EF}" = VAIO Improvement
"{3A94F54D-A8A4-4B82-B346-92B4D56A2708}" = VESx86
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{4264C020-850B-4F08-ACBE-98205D9C336C}" = Windows Live Writer
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{443B561F-DE1B-4DEF-ADD9-484B684653C7}" = Windows Live Messenger
"{4444F27C-B1A8-464E-9486-4C37BAB39A09}" = Фотогалерия на Windows Live
"{45191C61-3D04-4D03-B78A-592DF13264CC}" = Windows Live Messenger
"{458F399F-62AC-4747-99F5-499BBF073D29}" = Windows Live Writer Resources
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A04DB63-8F81-4EF4-9D09-61A2057EF419}" = Windows Live Essentials
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4B744C85-DBB1-4038-B989-4721EB22C582}" = Windows Live Messenger
"{4C378B16-46B7-4DA1-A2CE-2EE676F74680}" = Windows Live UX Platform Language Pack
"{4CF6F287-5121-483C-A5A2-07BDE19D8B4E}" = Windows Live Meshin etäyhteyksien ActiveX-komponentti
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack
"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources
"{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}" = VAIO Sample Contents
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{57220148-3B2B-412A-A2E0-82B9DF423696}" = Windows Live Mesh ActiveX-objekt til fjernforbindelser
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5C2F5C1B-9732-4F81-8FBF-6711627DC508}" = Windows Live Fotogalleri
"{5D2E7BD7-4B6F-4086-BA8A-E88484750624}" = Windows Live Writer Resources
"{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}" = VAIO-Support für Übertragungen
"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack
"{5FA51AAF-23FE-42F4-A724-D79F85F41D4B}" = Remote Play with PlayStation 3
"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker
"{61438020-DDD4-42FA-99A2-50225441980A}" = ArcSoft Magic-i Visual Effects 2
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{63C43435-F428-42BA-8E7B-5848749D9262}" = SSLx86
"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker
"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live
"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials
"{64B2D6B3-71AC-45A7-A6A1-2E07ABF58341}" = Windows Live Movie Maker
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"{6756D5CA-3E31-4308-9BF0-79DFD1AF196E}" = Елемент керування Windows Live Mesh ActiveX для віддалених підключень
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69CAC24D-B1DC-4B97-A1BE-FE21843108FE}" = Windows Live Writer Resources
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6A67578E-095B-4661-88F7-0B199CEC3371}" = Windows Live Messenger
"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh
"{6AC57EEF-2733-4DE6-81BB-E78ACB964C22}" = Windows Live Photo Common
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}" = Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{6EF2BE2C-3121-48B7-B7A6-C56046B3A588}" = Windows Live Movie Maker
"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common
"{70991E0A-1108-437E-BA7D-085702C670C0}" = 
"{70EED410-697B-4193-A2CB-2F790F82B420}" = VAIO Data Restore Tool
"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer
"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár
"{734104DE-C2BF-412F-BB97-FCCE1EC94229}" = Windows Live Writer Resources
"{7373E17D-18E0-44A7-AC3A-6A3BFB85D3B3}" = Windows Live Movie Maker
"{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}" = VAIO - Remote-Tastatur 
"{73D8886A-D416-4687-B609-0D3836BA410C}" = VAIO Event Service
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{78906B56-0E81-42A7-AC25-F54C946E1538}" = Windows Live Photo Common
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live
"{7ADFA72D-2A9F-4DEC-80A5-2FAA27E23F0F}" = Windows Live Photo Common
"{7AF8E500-B349-4A77-8265-9854E9A47925}" = Windows Live Movie Maker
"{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect
"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources
"{7D0DE76C-874E-4BDE-A204-F4240160693E}" = Windows Live Photo Common
"{7D916FA5-DAE9-4A25-B089-655C70EAF607}" = Atheros WiFi Driver Installation
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{80651674-74AA-4155-AF2D-1339E628D187}" = Windows Live Movie Maker
"{80E8C65A-8F70-4585-88A2-ABC54BABD576}" = Windows Live Mesh
"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials
"{82803FF3-563F-414F-A403-8D4C167D4120}" = Windows Live Mail
"{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" = 
"{8356CB97-A48F-44CB-837A-A12838DC4669}" = PMB VAIO Edition Plug-in
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common
"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common
"{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" = 
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{885F1BCD-C344-4758-85BD-09640CF449A5}" = Windows Live Photo Gallery
"{8909CFA8-97BF-4077-AC0F-6925243FFE08}" = Windows Liven asennustyökalu
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8CF5D47D-27B7-49D6-A14F-10550B92749D}" = Windows Live UX Platform Language Pack
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{91BD94FE-ADCA-49CC-BE96-97D4BBC36FAF}" = Windows Live Mesh
"{92280FD3-A119-41E6-A740-A62DBA4DFB53}" = Windows Live UX Platform Language Pack
"{924B4D82-1B97-48EB-8F1E-55C4353C22DB}" = Windows Live Mail
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live Fotogaléria
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B088046-8A01-4355-99DD-8530C022F682}" = VCCx86
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D12A8B5-9D41-4465-BF11-70719EB0CD02}" = VU5x86
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}" = VAIO Update
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A3389C72-1782-4BB4-BBAA-33345DE52E3F}" = Windows Live Messenger
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A7056D45-C63A-4FE4-A69D-FB54EF9B21BB}" = Windows Live Messenger
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7C30414-2382-4086-B0D6-01A88ABA21C3}" = VAIO Gate
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{AB78C965-5C67-409B-8433-D7B5BDB12073}" = Windows Live Writer Resources
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.7) MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AD001A69-88CC-4766-B2DB-3C1DFAB9AC72}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}" = Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych
"{B0AD205F-60D0-4084-AFB8-34D9A706D9A8}" = Windows Live Essentials
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B3BA4D1C-23EF-4859-9C11-1B2CCB7FADBB}" = ActiveX контрола на Windows Live Mesh за отдалечени връзки
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B6190387-0036-4BEB-8D74-A0AFC5F14706}" = Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená připojení
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{B7546697-2A80-4256-A24B-1C33163F535B}" = VAIO Gate Default
"{B8991D99-88FD-41F2-8C32-DB70278D5C30}" = VWSTx86
"{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}" = Элемент управления Windows Live Mesh ActiveX для удаленных подключений
"{BD0C3887-64E6-41D8-9A38-BC6F34369352}" = Windows Live Messenger
"{BD4EBDB5-EB14-4120-BB04-BE0A26C7FB3E}" = Windows Live Photo Common
"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh
"{BFC47A0B-D487-4DF0-889E-D6D392DF31E0}" = Windows Live Messenger
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C08D5964-C42F-48EE-A893-2396F9562A7C}" = Windows Live Mesh
"{C115A674-A398-49E5-9C6E-C0A541D3EA10}" = Фотоколекція Windows Live
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{C1940CF0-E2DD-11E0-BB25-B8AC6F97B88E}" = Google Earth
"{C1C9D199-B4DD-4895-92DD-9A726A2FE341}" = Windows Live Writer
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C2FD7DB5-FE30-49B6-8A2F-C5652E053C31}" = Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C454280F-3C3E-4929-B60E-9E6CED5717E7}" = Windows Live Mail
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}" = VAIO-Handbuch
"{C72E35E5-C5C6-4328-AD9A-BBCCC816A2E6}" = VAIO Hardware Diagnostics
"{C793AD32-2BB8-4CC4-ABD3-A1469C21593C}" = ArcSoft WebCam Companion 4
"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live
"{CB66242D-12B1-4494-82D2-6F53A7E024A3}" = Galerie foto Windows Live
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger
"{CD442136-9115-4236-9C14-278F6A9DCB3F}" = Windows Live Movie Maker
"{CD7CB1E6-267A-408F-877D-B532AD2C882E}" = Windows Live Photo Common
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery
"{D07B1FDA-876B-4914-9E9A-309732B6D44F}" = Windows Live Mail
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D17C2A58-E0EA-4DD7-A2D6-C448FD25B6F6}" = VIx86
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2D23D08-D10E-43D6-883C-78E0B2AC9CC6}" = VU5x86
"{D31169F2-CD71-4337-B783-3E53F29F4CAD}" = Windows Live Mail
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D531F5A4-18F6-4130-B9A4-9179D6E349FC}" = VAIO Care
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA29F644-2420-4448-8128-1331BE588999}" = Windows Live Writer
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker
"{DCAB6BA7-6533-44BF-9235-E5BF33B7431C}" = Windows Live Writer
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer
"{E9AD2143-26D5-4201-BED1-19DCC03B407D}" = Windows Live Messenger
"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources
"{EB9955F8-467C-47FC-90F8-12CD5DF684C3}" = Adobe Premiere Elements 9
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F0F9505B-3ACF-4158-9311-D0285136AA00}" = Windows Live Essentials
"{F28C98E9-BAC1-41FF-81F2-8885925CCB48}" = Windows Live Writer
"{F2979AAA-FDD7-4CB3-93BC-5C24D965D679}" = Windows Live Messenger
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F35DC85A-E96B-496B-ABE7-F04192824856}" = Windows Live Messenger
"{F4BEA6C1-AAC3-4810-AAEA-588E26E0F237}" = Windows Live UX Platform Language Pack
"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις
"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail
"{FA870BF1-44A1-4B7D-93E1-C101369AF0C1}" = VAIO - Media Gallery
"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker
"{FB79FDB7-4DE1-453D-99FE-9A880F57380E}" = Windows Live Fotogalerie
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE62C88B-425B-4BDE-8B70-CD5AE3B83176}" = Windows Live Essentials
"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"{FFFA0584-8E3D-4195-8283-CCA3AD73C746}" = Windows Live Messenger
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"Avira AntiVir Desktop" = Avira Free Antivirus
"Canon MG5300 series Benutzerregistrierung" = Canon MG5300 series Benutzerregistrierung
"Canon MG5300 series On-screen Manual" = Canon MG5300 series On-screen Manual
"Canon_IJ_Network_Scanner_Selector_EX" = Canon IJ Network Scanner Selector EX
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"Free DVD Video Burner_is1" = Free DVD Video Burner version 3.1.3.1228
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 5.0.4.1228
"Free YouTube Download_is1" = Free YouTube Download version 3.0.16.923
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.11.923
"InstallShield_{22008CF9-2B54-4022-AFD8-3B7D42C89E6B}" = VAIO - PMB VAIO Edition Plug-in
"InstallShield_{2EFEAD58-3311-4B2B-9D8A-8D663581D109}" = Splashtop Streamer
"InstallShield_{339F9B4D-00CB-4C1C-BED8-EC86A9AB602A}" = VAIO - PMB VAIO Edition Guide
"InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect
"IrfanView" = IrfanView (remove only)
"MAGIX_MSI_FotoDesigner7_silver" = MAGIX Foto Designer 7
"MP Navigator EX 5.0" = Canon MP Navigator EX 5.0
"PremElem90" = Adobe Premiere Elements 9
"Scribus 1.4.1" = Scribus 1.4.1
"splashtop" = Quick Web Access
"Splashtop Software Updater" = Splashtop Software Updater
"VAIO Help and Support" = 
"VAIO Hero Screensaver - Summer 2011 Screensaver" = VAIO Hero Screensaver - Summer 2011 Screensaver
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3791562049-3988482224-1737227893-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"MyFreeCodec" = MyFreeCodec
"Spotify" = Spotify
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.07.2013 15:58:12 | Computer Name = JuMa | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 20.07.2013 15:57:19 | Computer Name = JuMa | Source = ipnathlp | ID = 31004
Description = 
 
 
< End of report >
         

Viele Grüße
Markus

Fixen mit OTL

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

:OTL
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes\{36223D5C-F972-4D2A-991A-B87BF0BD6F0D}: "URL" = http://services.zinio.com/search?s={searchTerms}&rf=sonyslices
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes\{68EF156E-16E0-4105-AE28-C05CD5FBED89}: "URL" = http://rover.ebay.com/rover/1/707-37276-16609-21/4?satitle={searchTerms}
IE - HKU\S-1-5-21-3791562049-3988482224-1737227893-1003\..\SearchScopes\{915C00FC-3183-478A-8DE5-ACEA02485D2F}: "URL" = http://de.shopping.com/?linkin_id=8056363
[2013.07.13 00:12:31 | 005,576,224 | ---- | C] () -- C:\Users\Markus\Desktop\Kunibert.vip.18042013.zip
[2013.07.12 23:50:42 | 000,000,004 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\cache.ini
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
         

• Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
• Schließe bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
  ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
  Kopiere nun den Inhalt hier in Deinen Thread

Hallo Cosinus,

ist erledigt....

All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-3791562049-3988482224-1737227893-1003\Software\Microsoft\Internet Explorer\SearchScopes\{36223D5C-F972-4D2A-991A-B87BF0BD6F0D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36223D5C-F972-4D2A-991A-B87BF0BD6F0D}\ not found.
Registry key HKEY_USERS\S-1-5-21-3791562049-3988482224-1737227893-1003\Software\Microsoft\Internet Explorer\SearchScopes\{68EF156E-16E0-4105-AE28-C05CD5FBED89}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68EF156E-16E0-4105-AE28-C05CD5FBED89}\ not found.
Registry key HKEY_USERS\S-1-5-21-3791562049-3988482224-1737227893-1003\Software\Microsoft\Internet Explorer\SearchScopes\{915C00FC-3183-478A-8DE5-ACEA02485D2F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{915C00FC-3183-478A-8DE5-ACEA02485D2F}\ not found.
C:\Users\Markus\Desktop\Kunibert.vip.18042013.zip moved successfully.
C:\Users\Markus\AppData\Roaming\cache.ini moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Markus\Desktop\cmd.bat deleted successfully.
C:\Users\Markus\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56502 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Julia
->Temp folder emptied: 1058 bytes
->Temporary Internet Files folder emptied: 778594285 bytes
->Flash cache emptied: 72417 bytes
 
User: Markus
->Temp folder emptied: 1369110 bytes
->Temporary Internet Files folder emptied: 352028 bytes
->Java cache emptied: 642987 bytes
->Flash cache emptied: 57008 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 528342 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 441361 bytes
RecycleBin emptied: 217848984 bytes
 
Total Files Cleaned = 954,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.69.0 log created on 07222013_221910

Files\Folders moved on Reboot...
C:\Users\Markus\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Markus\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Schwitzige Grüße

Markus

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Vollscan mit Malwarebytes Anti-Malware (MBAM) (falls du vor kurzem erst einen Vollscan gemacht hast, reicht auch ein Quickscan (spart Zeit), das dann mir bitte auch mitteilen)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hier die Logs. Beim ersten Scan war noch etwas gefundenen worden.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.24.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Markus :: JUMA [Administrator]

24.07.2013 20:40:56
mbam-log-2013-07-24 (20-40-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 442032
Laufzeit: 1 Stunde(n), 8 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\FRST\Quarantine\cache.dat (Trojan.FakeAlert.RRE) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e5769e371d20b647b0851701032a214f
# engine=14521
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-24 10:31:03
# local_time=2013-07-25 12:31:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 98 89414 240128353 82195 0
# compatibility_mode=5893 16776573 100 94 89575 126334913 0 0
# scanned=222325
# found=0
# cleaned=0
# scan_time=4909
         

Gruß
Markus