Wie entferne ich "Conduit.com"? (logfiles bereits erstellt und gepostet)

virusmussweg

Hallo Leute,
Habe wiedermal Mist an Land gezogen.

Beim herunterladen von "Free Audio Converter" kam "DVDSoft Free Studio" gleich mit und hatte "conduit.com" gleich mit dabei. Jetzt werde ich den Mist nicht mehr los. Im Register habe ich das Teil schon gelöscht. Ist aber immer noch da!

Hier mal die Log files die ich mit OTL erstellt habe:
(so wie ich das sehe habe ich wohl auch immer noch ein Problem mit "snapdo" und mit "wedownload")

OTL Extras logfile created on: 12.01.2014 12:28:10 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\sysadmin\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 2,20 Gb Available Physical Memory | 73,41% Memory free
4,84 Gb Paging File | 3,93 Gb Available in Paging File | 81,32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,50 Gb Total Space | 42,83 Gb Free Space | 57,49% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 232,80 Gb Free Space | 99,96% Space Free | Partition Type: NTFS

Computer Name: GX280 | User Name: sysadmin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNetisabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\Vectorworks2012\Vectorworks2012E.exe" = C:\Programme\Vectorworks2012\Vectorworks2012E.exe:*:Enabled:Vectorworks 2012 Application -- (Nemetschek Vectorworks, Inc.)
"C:\Programme\Vectorworks2012\Renderworks\CineRender.exe" = C:\Programme\Vectorworks2012\Renderworks\CineRender.exe:*:Enabled:CineRender -- (MAXON Computer GmbH)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Programme\Homag Group\LicenseServer\LicenseServer.exe" = C:\Programme\Homag Group\LicenseServer\LicenseServer.exe:*:Enabled:LicenseServer -- (Homag Group)
"D:\fsetup.exe" = D:\fsetup.exe:*:Enabled:AVM FSetup Application


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08208143-777D-4A06-BB54-71BF0AD1BB70}" = IPTInstaller
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CD47142-BA4F-46B0-AA92-2675864928B8}" = Microsoft Security Client
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP640_series" = Canon MP640 series MP Drivers
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1DFFB787-735E-371B-9C43-1321C10B4335}" = Microsoft .NET Framework 2.0 Client Service Pack 2 - Language Pack (DEU)
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{54C085D1-53E9-3768-B1B9-6018671D4882}" = Microsoft .NET Framework 3.0 Client Profile - Language Pack (DEU)
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74E0894F-8F94-448C-B3DA-05252DABC2D9}" = LicenseServer
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E369B27-13E2-41A5-9879-358EE1C8B5AD}" = Broadcom Gigabit Integrated Controller
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.6.0
"{87C2FAFA-E830-E3B1-A50E-876D00939884}" = Vectorworks 2012 Hilfe
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F7172E9B-1145-3768-94E6-8477A73E860F}" = Microsoft .NET Framework 3.5 Client Profile - Language Pack (DEU)
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Driver Genius_is1" = Driver Genius
"eu.computerworks.vectorworks.2012.help.deu.07222458214E034A0B494E83FAD6744C17D2B914.1" = Vectorworks 2012 Hilfe
"Free Audio Converter_is1" = Free Audio Converter version 5.0.32.1230
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 26.0 (x86 de)" = Mozilla Firefox 26.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PlanMaker Viewer" = PlanMaker Viewer
"SearchProtect" = Search Protect
"VLC media player" = VLC media player 2.1.1
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 27.02.2013 13:05:01 | Computer Name = GX280 | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown

Error - 09.03.2013 09:40:21 | Computer Name = GX280 | Source = MsiInstaller | ID = 1013
Description = Product: Adobe Reader 9.2 -- Setup has detected that you already have
a more functional product installed. Setup will now terminate.

Error - 01.04.2013 15:17:38 | Computer Name = GX280 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 2152759308, P2 unspecified, P3 scanfile,
P4 4.2.223.0, P5 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 03.06.2013 14:16:49 | Computer Name = GX280 | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown

[ System Events ]
Error - 03.01.2014 07:26:16 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 05.01.2014 14:10:47 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 06.01.2014 06:12:08 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 07.01.2014 14:41:27 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 09.01.2014 13:05:45 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 10.01.2014 01:56:45 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 10.01.2014 11:47:50 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 10.01.2014 15:23:40 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 10.01.2014 16:01:19 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2

Error - 12.01.2014 04:48:31 | Computer Name = GX280 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "GDTdiInterceptor" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2


< End of report >


OTL logfile created on: 12.01.2014 12:28:10 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\sysadmin\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 2,20 Gb Available Physical Memory | 73,41% Memory free
4,84 Gb Paging File | 3,93 Gb Available in Paging File | 81,32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,50 Gb Total Space | 42,83 Gb Free Space | 57,49% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 232,80 Gb Free Space | 99,96% Space Free | Partition Type: NTFS

Computer Name: GX280 | User Name: sysadmin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014.01.12 12:26:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\sysadmin\Eigene Dateien\Downloads\OTL.exe
PRC - [2014.01.01 09:38:24 | 004,333,856 | ---- | M] (Conduit) -- C:\Programme\SearchProtect\SearchProtect\bin\cltmng.exe
PRC - [2014.01.01 09:38:24 | 002,911,520 | ---- | M] (Conduit) -- C:\Programme\SearchProtect\UI\bin\cltmngui.exe
PRC - [2014.01.01 09:38:24 | 002,301,216 | ---- | M] (Conduit) -- C:\Programme\SearchProtect\Main\bin\CltMngSvc.exe
PRC - [2013.12.09 11:37:21 | 000,440,376 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.12.09 11:37:19 | 000,431,672 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.12.09 11:37:18 | 000,684,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.12.09 11:37:18 | 000,440,376 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.12.05 20:34:42 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\firefox.exe
PRC - [2013.10.23 15:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2013.10.23 14:55:28 | 000,948,440 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2013.04.04 22:06:36 | 000,958,576 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
PRC - [2012.12.07 18:27:50 | 000,167,424 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2012.08.11 16:43:06 | 000,055,184 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2012.05.22 07:38:56 | 000,160,872 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2013.12.09 11:37:21 | 000,394,808 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2013.12.05 20:36:56 | 003,559,024 | ---- | M] () -- C:\mozjs.dll
MOD - [2012.12.07 18:27:50 | 000,167,424 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe
MOD - [2012.02.20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll
MOD - [2012.01.03 14:10:46 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU


========== Services (SafeList) ==========

SRV - [2014.01.01 09:38:24 | 002,301,216 | ---- | M] (Conduit) [Auto | Running] -- C:\Programme\SearchProtect\Main\bin\CltMngSvc.exe -- (CltMngSvc)
SRV - [2013.12.11 17:11:04 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.12.10 22:51:44 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.12.09 11:37:21 | 000,440,376 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.12.09 11:37:19 | 001,011,768 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2013.12.09 11:37:18 | 000,440,376 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.10.23 15:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.12.07 18:27:50 | 000,167,424 | ---- | M] () [Auto | Running] -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012.08.11 16:43:06 | 000,055,184 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\GDTdiIcpt.sys -- (GDTdiInterceptor)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | Boot | Stopped] -- -- (cerc6)
DRV - [2013.12.09 11:37:21 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2013.12.09 11:37:19 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2013.12.09 11:37:18 | 000,135,648 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.12.09 11:37:18 | 000,090,400 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2013.08.25 10:30:48 | 000,013,120 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2012.12.07 18:27:50 | 000,021,248 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2011.10.26 01:25:47 | 000,237,096 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2009.06.10 08:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2004.09.17 09:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=Soft32YB&dpid=Soft32YB&co=DE&userid=f9686328-fd31-0162-f1f3-012392d0e152&searchtype=ds&q={searchTerms}&installDate=12/11/2013
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?publisher=Soft32YB&dpid=Soft32YB&co=DE&userid=f9686328-fd31-0162-f1f3-012392d0e152&searchtype=ds&q={searchTerms}&installDate=12/11/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snapdo.com/?publisher=Soft32YB&dpid=Soft32YB&co=DE&userid=f9686328-fd31-0162-f1f3-012392d0e152&searchtype=ds&q={searchTerms}&installDate=12/11/2013
IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=Soft32YB&dpid=Soft32YB&co=DE&userid=f9686328-fd31-0162-f1f3-012392d0e152&searchtype=ds&q={searchTerms}&installDate=12/11/2013
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP499E10D6-E2AA-4A9B-8F38-6F822038A848&q={searchTerms}&SSPV=
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Wikipedia (de)"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - prefs.js..extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.prev: "Ecosia"
FF - prefs.js..extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.savedPrev: "true"
FF - prefs.js..extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.tb: "Ask Web Search"
FF - prefs.js..extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.prev: "Ecosia"
FF - prefs.js..extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.savedPrev: "true"
FF - prefs.js..extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.tb: "Ask Web Search"
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..browser.startup.homepage: "true"
FF - prefs.js..browser.startup.homepage: "hxxp://home.tb.ask.com/index.jhtml?ptb=F7E3B276-D4AE-4D9F-BD22-C7E671081329&n=77fdcfcb&p2=^HJ^xdm382^S07867^de&si=pconverter"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@VideoDownloadConverter_ScriptHelper.com/Plugin: C:\Programme\VideoDownloadConverter\npVDCPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Temp\7zS40.tmp\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Temp\7zS40.tmp\plugins

[2012.03.02 16:39:26 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Extensions
[2014.01.12 11:35:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions
[2014.01.12 11:35:23 | 000,000,000 | ---D | M] ("weDownload Manager Pro") -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com
[2014.01.10 22:22:26 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\staged
[2014.01.12 11:35:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com\extensionData
[2014.01.12 11:35:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com\extensionData\plugins
[2014.01.12 11:35:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com\extensionData\userCode
[2013.12.21 13:47:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\staged\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com\extensionData
[2013.12.21 13:47:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\staged\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com\extensionData\plugins
[2013.12.21 13:47:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Mozilla\Firefox\Profiles\xuryzp1l.default-1384291478859\extensions\staged\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com\extensionData\userCode
[2013.12.11 17:10:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2014.01.12 11:15:26 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{go ogle:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{googlemniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefi xUrl}{googleageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: hxxp://feed.snapdo.com/?publisher=Soft32YB&dpid=Soft32YB&co=DE&userid=f9686328-fd31-0162-f1f3-012392d0e152&searchtype=hp&installDate=12/11/2013
CHR - Extension: Snap.Do = C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\
CHR - Extension: Google Docs = C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Wallet = C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\

O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (weDownload Manager Pro) - {11111111-1111-1111-1111-110411361128} - C:\Programme\weDownload Manager Pro\weDownload Manager Pro-bho.dll (weDownload)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [MSC] C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1330699459497 (WUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{813C3652-8974-42DC-AACA-E9174C1802C1}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll) - C:\Programme\SearchProtect\SearchProtect\bin\SPVC32Loader.dll (Conduit)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.03.02 15:30:01 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{24ab4dda-6cd9-11e3-91a3-00123f7036da}\Shell - "" = AutoRun
O33 - MountPoints2\{24ab4dda-6cd9-11e3-91a3-00123f7036da}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{24ab4dda-6cd9-11e3-91a3-00123f7036da}\Shell\AutoRun\command - "" = F:\HTC_Sync_Manager_PC.exe
O33 - MountPoints2\{24ab4ddb-6cd9-11e3-91a3-00123f7036da}\Shell - "" = AutoRun
O33 - MountPoints2\{24ab4ddb-6cd9-11e3-91a3-00123f7036da}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{24ab4ddb-6cd9-11e3-91a3-00123f7036da}\Shell\AutoRun\command - "" = F:\HTC_Sync_Manager_PC.exe
O33 - MountPoints2\{b87af3bd-6474-11e1-8f3b-bed67b471672}\Shell\AutoRun\command - "" = E:\TrueCrypt\TrueCrypt.exe /q background /lU /e /m rm /v "TC\TC"
O33 - MountPoints2\{b87af3bd-6474-11e1-8f3b-bed67b471672}\Shell\dismount\command - "" = E:\TrueCrypt\TrueCrypt.exe /q /d
O33 - MountPoints2\{b87af3bd-6474-11e1-8f3b-bed67b471672}\Shell\start\command - "" = E:\TrueCrypt\TrueCrypt.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014.01.12 11:34:23 | 022,370,928 | ---- | C] (Mozilla Foundation) -- C:\xul.dll
[2014.01.12 11:34:23 | 003,449,456 | ---- | C] (Mozilla Foundation) -- C:\gkmedias.dll
[2014.01.12 11:34:23 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\D3DCompiler_43.dll
[2014.01.12 11:34:23 | 001,776,240 | ---- | C] (Mozilla Foundation) -- C:\nss3.dll
[2014.01.12 11:34:23 | 000,770,384 | ---- | C] (Microsoft Corporation) -- C:\msvcr100.dll
[2014.01.12 11:34:23 | 000,647,280 | ---- | C] (Mozilla Foundation) -- C:\libGLESv2.dll
[2014.01.12 11:34:23 | 000,421,200 | ---- | C] (Microsoft Corporation) -- C:\msvcp100.dll
[2014.01.12 11:34:23 | 000,393,840 | ---- | C] (Mozilla Foundation) -- C:\nssckbi.dll
[2014.01.12 11:34:23 | 000,302,192 | ---- | C] (Mozilla Foundation) -- C:\freebl3.dll
[2014.01.12 11:34:23 | 000,276,592 | ---- | C] (Mozilla Foundation) -- C:\updater.exe
[2014.01.12 11:34:23 | 000,275,568 | ---- | C] (Mozilla Corporation) -- C:\firefox.exe
[2014.01.12 11:34:23 | 000,194,552 | ---- | C] (Mozilla Corporation) -- C:\maintenanceservice_installer.exe
[2014.01.12 11:34:23 | 000,170,960 | ---- | C] (Mozilla Corporation) -- C:\webapp-uninstaller.exe
[2014.01.12 11:34:23 | 000,153,712 | ---- | C] (Mozilla Foundation) -- C:\softokn3.dll
[2014.01.12 11:34:23 | 000,130,672 | ---- | C] (Mozilla Foundation) -- C:\mozglue.dll
[2014.01.12 11:34:23 | 000,119,408 | ---- | C] (Mozilla Foundation) -- C:\maintenanceservice.exe
[2014.01.12 11:34:23 | 000,117,360 | ---- | C] (Mozilla Foundation) -- C:\crashreporter.exe
[2014.01.12 11:34:23 | 000,108,144 | ---- | C] (Mozilla Foundation) -- C:\webapprt-stub.exe
[2014.01.12 11:34:23 | 000,092,272 | ---- | C] (Mozilla Foundation) -- C:\nssdbm3.dll
[2014.01.12 11:34:23 | 000,075,376 | ---- | C] (Mozilla Foundation) -- C:\breakpadinjector.dll
[2014.01.12 11:34:23 | 000,053,360 | ---- | C] (Mozilla Foundation) -- C:\libEGL.dll
[2014.01.12 11:34:23 | 000,028,272 | ---- | C] (Mozilla Corporation) -- C:\plugin-hang-ui.exe
[2014.01.12 11:34:23 | 000,020,080 | ---- | C] (Mozilla Foundation) -- C:\AccessibleMarshal.dll
[2014.01.12 11:34:23 | 000,018,544 | ---- | C] (Mozilla Corporation) -- C:\plugin-container.exe
[2014.01.12 11:34:23 | 000,017,008 | ---- | C] (Mozilla Foundation) -- C:\mozalloc.dll
[2014.01.12 11:34:23 | 000,000,000 | ---D | C] -- C:\webapprt
[2014.01.12 11:34:23 | 000,000,000 | ---D | C] -- C:\uninstall
[2014.01.12 11:34:23 | 000,000,000 | ---D | C] -- C:\defaults
[2014.01.12 11:26:52 | 000,000,000 | ---D | C] -- C:\browser
[2014.01.10 22:39:06 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2014.01.10 22:35:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\TuneUp Software
[2014.01.10 22:31:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2014.01.10 22:31:11 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
[2014.01.10 22:31:11 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2014.01.10 22:28:33 | 000,000,000 | ---D | C] -- C:\Programme\SearchProtect
[2014.01.10 22:28:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\SearchProtect
[2014.01.10 22:28:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DVDVideoSoft
[2014.01.10 22:27:38 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\DVDVideoSoft
[2014.01.10 22:27:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\DVDVideoSoft
[2014.01.10 22:27:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\OpenCandy
[2014.01.10 22:27:37 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft
[2014.01.10 22:08:45 | 000,000,000 | ---D | C] -- C:\Programme\ABC Amber Audio Converter
[2014.01.09 23:01:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Desktop\Bandsongs für E-mails
[2014.01.09 22:41:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Desktop\Band
[2014.01.03 13:35:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Desktop\rodelfotos
[2013.12.25 19:45:48 | 000,000,000 | ---D | C] -- C:\Programme\VideoDownloadConverter
[2013.12.25 17:25:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\Avira
[2013.12.25 17:23:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2013.12.25 17:22:47 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013.12.25 17:22:36 | 000,135,648 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2013.12.25 17:22:36 | 000,090,400 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2013.12.25 17:22:36 | 000,037,352 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2013.12.25 17:22:30 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2013.12.24 21:29:59 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll
[2013.12.24 21:26:43 | 000,000,000 | ---D | C] -- C:\Programme\HTC
[2013.12.24 21:26:34 | 001,122,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoInstaller01007.dll
[2013.12.24 21:26:34 | 000,024,576 | ---- | C] (HTC, Corporation) -- C:\WINDOWS\System32\drivers\ANDROIDUSB.sys
[2013.12.24 21:24:53 | 000,000,000 | ---D | C] -- C:\Temp
[2013.12.24 21:22:25 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2013.12.24 21:22:24 | 000,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2013.12.18 23:46:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2013.12.18 22:38:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2013.12.18 20:40:55 | 000,016,048 | ---- | C] (G Data Software) -- C:\WINDOWS\System32\drivers\GdPhyMem.sys
[2013.12.15 16:30:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\WMTools Downloaded Files
[2013.12.15 16:30:21 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\sysadmin\Eigene Dateien\Eigene Videos
[2013.12.15 12:59:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Desktop\100OLYMP
[2013.12.15 11:36:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\AbiSuite
[2013.12.15 11:33:28 | 000,000,000 | ---D | C] -- C:\Programme\AbiWord
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014.01.12 11:51:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014.01.12 11:34:49 | 000,000,406 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2014.01.12 09:58:35 | 000,000,386 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2014.01.12 09:50:08 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014.01.12 09:48:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014.01.10 22:45:02 | 000,000,289 | ---- | M] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\playlist.m3u
[2014.01.10 22:45:01 | 003,202,824 | ---- | M] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0045b.mp3
[2014.01.10 22:44:40 | 003,366,246 | ---- | M] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0044b.mp3
[2014.01.10 22:44:18 | 002,819,973 | ---- | M] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0041b.mp3
[2014.01.10 22:44:00 | 003,242,530 | ---- | M] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0038b.mp3
[2014.01.10 22:28:33 | 000,000,000 | ---- | M] () -- C:\END
[2014.01.10 22:28:32 | 000,001,845 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Free Audio Converter.lnk
[2014.01.10 22:28:32 | 000,000,906 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DVDVideoSoft Free Studio.lnk
[2013.12.25 17:23:11 | 000,001,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2013.12.24 21:30:18 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
[2013.12.24 21:30:17 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2013.12.24 21:30:16 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013.12.21 13:30:20 | 000,142,032 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013.12.18 20:40:55 | 000,016,048 | ---- | M] (G Data Software) -- C:\WINDOWS\System32\drivers\GdPhyMem.sys
[2013.12.15 15:48:44 | 000,000,400 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2013.12.15 15:21:48 | 000,007,914 | ---- | M] () -- C:\Dokumente und Einstellungen\sysadmin\Eigene Dateien\Deutsch Bass Referat.abw
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014.01.12 12:08:03 | 000,000,621 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Messenger.lnk
[2014.01.12 12:08:02 | 000,000,772 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Startmenü\Programme\Windows Media Player.lnk
[2014.01.12 12:07:59 | 000,000,718 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Startmenü\Programme\Outlook Express.lnk
[2014.01.12 12:07:58 | 000,000,783 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Startmenü\Programme\Internet Explorer.lnk
[2014.01.12 11:34:23 | 008,288,801 | ---- | C] () -- C:\omni.ja
[2014.01.12 11:34:23 | 003,559,024 | ---- | C] () -- C:\mozjs.dll
[2014.01.12 11:34:23 | 000,036,692 | ---- | C] () -- C:\removed-files
[2014.01.12 11:34:23 | 000,004,280 | ---- | C] () -- C:\crashreporter.ini
[2014.01.12 11:34:23 | 000,001,928 | ---- | C] () -- C:\precomplete
[2014.01.12 11:34:23 | 000,001,041 | ---- | C] () -- C:\updater.ini
[2014.01.12 11:34:23 | 000,000,899 | ---- | C] () -- C:\softokn3.chk
[2014.01.12 11:34:23 | 000,000,899 | ---- | C] () -- C:\nssdbm3.chk
[2014.01.12 11:34:23 | 000,000,899 | ---- | C] () -- C:\freebl3.chk
[2014.01.12 11:34:23 | 000,000,685 | ---- | C] () -- C:\application.ini
[2014.01.12 11:34:23 | 000,000,140 | ---- | C] () -- C:\platform.ini
[2014.01.12 11:34:23 | 000,000,137 | ---- | C] () -- C:\update-settings.ini
[2014.01.12 11:34:23 | 000,000,099 | ---- | C] () -- C:\dependentlibs.list
[2014.01.10 22:45:02 | 000,000,289 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\playlist.m3u
[2014.01.10 22:44:40 | 003,202,824 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0045b.mp3
[2014.01.10 22:44:18 | 003,366,246 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0044b.mp3
[2014.01.10 22:44:00 | 002,819,973 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0041b.mp3
[2014.01.10 22:43:40 | 003,242,530 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\probe aufnahme mp3_probe aufnahme mp3_TASCAM_0038b.mp3
[2014.01.10 22:28:33 | 000,000,000 | ---- | C] () -- C:\END
[2014.01.10 22:28:32 | 000,001,845 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Free Audio Converter.lnk
[2014.01.10 22:28:32 | 000,000,906 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DVDVideoSoft Free Studio.lnk
[2013.12.25 19:36:17 | 994,701,579 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Desktop\IMG_0961.MOV
[2013.12.25 17:23:11 | 000,001,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2013.12.24 21:30:18 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
[2013.12.24 21:30:17 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2013.12.15 15:21:47 | 000,007,914 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Eigene Dateien\Deutsch Bass Referat.abw
[2013.11.16 17:53:00 | 000,090,272 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.11.15 19:58:04 | 000,007,680 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.10.09 18:48:51 | 000,000,287 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Lokale Einstellungen\Anwendungsdaten\VersionChecker_17.xml
[2012.06.20 08:14:19 | 000,013,120 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2012.06.12 19:34:48 | 000,002,166 | ---- | C] () -- C:\Dokumente und Einstellungen\sysadmin\Anwendungsdaten\wklnhst.dat
[2012.06.12 19:29:42 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012.06.10 10:26:44 | 000,098,344 | ---- | C] () -- C:\WINDOWS\unPMV.exe
[2012.03.02 16:01:53 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.03.02 15:32:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012.03.02 15:26:34 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2012.03.02 15:18:12 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012.03.02 15:16:56 | 000,142,032 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2013.02.25 23:25:03 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2011.12.19 09:53:33 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 13:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >


Danke schonmal und Grüße