Keine Updates bzw. neue Installation möglich

Entericher · 23.07.2015, 14:58

Hallo zusammen,

als Laie und neuer im Forum hoffe ich, ich habe jetzt den richtigen Bereich getroffen. Vielen Dank Alois.

Seit einigen Wochen kann ich weder Programme updaten noch neuinstallieren.
Mein Firefox und auch mein Internet Explorer sind nicht mehr da.
Ich kann nur noch den Explorer ohne Add Ons verwenden.

Wenn ich auf installieren klicke bekomme ich die Meldung ob ich als Administrator oder als Current User installieren möchte. Beides ist identisch.

Nachdem ich eine Variante angeklickt habe tut sich nichts mehr.

Ich verzweifele gerade und hoffe mir kann jemand von Euch helfen.

Schon jetzt vielen Dank
Entericher

Ich habe die OTL Geschichte laufen lassen, hier das Ergebnis.OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.07.2015 15:12:42 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Michael\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,91 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 57,56% Memory free
7,82 Gb Paging File | 5,16 Gb Available in Paging File | 66,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 143,56 Gb Total Space | 50,25 Gb Free Space | 35,00% Space Free | Partition Type: NTFS
Drive E: | 139,78 Gb Total Space | 14,17 Gb Free Space | 10,13% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
PRC - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
PRC - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\d599db4bed83bba71fe4fcc6c136afcb\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\820d67f73bbcc073564c7d90a7a1b4d4\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cea5d9b8e3d6ff3bf3be32cf5fcbcd02\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ad9c2f4737e1e07fa774af31a7d74235\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\86f429e0a23238cf277d464bd0433d86\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eba4ec48e3f7f16864c6d96f510fafd9\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\456d5e9d3a0a37697ab28c150e9ac5b7\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\155679a9c8991cc33f90d6b27bac1977\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\0bddc91cbf37d143f08f6684b2919566\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\610374fef100556da252243e673ac64b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\23bc3936180ff789f44259a211dfc7fc\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll ()
MOD - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (STacSV) -- C:\Programme\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (TurboBoost) -- C:\Programme\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV - (RoxWatch12) -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions)
SRV - (RoxMediaDB12OEM) -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Bluetooth OBEX Service) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AESTFilters) -- C:\Programme\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avnetflt) -- C:\Windows\SysNative\drivers\avnetflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwsw00.sys (Intel Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (intelkmd) -- C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV:64bit: - (wdkmd) -- C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (btmaux) -- C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV:64bit: - (silabser) -- C:\Windows\SysNative\drivers\silabser.sys (Silicon Laboratories)
DRV:64bit: - (silabenm) -- C:\Windows\SysNative\drivers\silabenm.sys (Silicon Laboratories, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (cdrbsdrv) -- C:\Windows\SysWow64\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=hp
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{125C6911-57D7-46C4-9907-430B26C5C007}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.countryCode: "DE"
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"
FF - prefs.js..browser.search.region: "DE"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.internetcologne.de"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20131118
FF - prefs.js..extensions.enabledAddons: %7B5384767E-00D9-40E9-B72F-9CC39D655D6F%7D:1.5.0.6
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.9.22
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:37.0.2
FF - prefs.js..keyword.URL: "hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre1.8.0_40\bin\new_plugin\npjp2.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
[2011.08.07 10:04:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions
[2015.04.23 09:58:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions
[2015.04.23 09:58:12 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2013.11.26 20:24:49 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2015.04.23 09:58:06 | 000,546,981 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2015.04.03 14:07:23 | 000,970,672 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.29 19:42:09 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.12.23 18:19:17 | 000,002,389 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\searchplugins\Web Search.xml
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe (Dell, Inc.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RoxWatchTray] c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001..\Run: [Spybot-S&D Cleaning] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..Trusted Domains: blank ([]about in Lokales Intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 11.40.2)
O16:64bit: - DPF: {CAFEEFAC-0018-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 1.8.0_40)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 1.8.0_40)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{499F0A3D-319F-4DFD-B959-FB4CCB904B4E}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{876B86BE-E977-45B7-AE7A-F7D7C5CC90FD}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (bj.dll) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{1bb7672f-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{1bb7672f-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{1bb76756-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{1bb76756-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{1bb7675f-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{1bb7675f-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{24b33342-6f9a-11e1-863c-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{24b33342-6f9a-11e1-863c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{24b333a1-6f9a-11e1-863c-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{24b333a1-6f9a-11e1-863c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{337f4733-6ec7-11e1-9a9a-001e101f1f81}\Shell - "" = AutoRun
O33 - MountPoints2\{337f4733-6ec7-11e1-9a9a-001e101f1f81}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{57795498-6e03-11e1-97d5-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{57795498-6e03-11e1-97d5-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{577954a6-6e03-11e1-97d5-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{577954a6-6e03-11e1-97d5-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{6959f816-6e01-11e1-99e9-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{6959f816-6e01-11e1-99e9-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{6959f82c-6e01-11e1-99e9-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{6959f82c-6e01-11e1-99e9-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{74bf0d38-5218-11e1-866c-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{74bf0d38-5218-11e1-866c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{99b8c3cb-4e92-11e1-8551-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{99b8c3cb-4e92-11e1-8551-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{99b8c3df-4e92-11e1-8551-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{99b8c3df-4e92-11e1-8551-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{c500ba12-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{c500ba12-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{c500ba24-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{c500ba24-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{c500ba33-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{c500ba33-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{e1b790af-70d8-11e1-9792-001e101f4da1}\Shell - "" = AutoRun
O33 - MountPoints2\{e1b790af-70d8-11e1-9792-001e101f4da1}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{e1b790c2-70d8-11e1-9792-001e101f4da1}\Shell - "" = AutoRun
O33 - MountPoints2\{e1b790c2-70d8-11e1-9792-001e101f4da1}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2015.07.23 15:14:08 | 004,796,740 | ---- | C] (WinZip International LLC ) -- C:\Users\Michael\Desktop\wzmp_10.exe
[2015.07.23 15:11:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
 
========== Files - Modified Within 30 Days ==========
 
[2015.07.23 15:14:12 | 004,796,740 | ---- | M] (WinZip International LLC ) -- C:\Users\Michael\Desktop\wzmp_10.exe
[2015.07.23 15:11:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2015.07.23 14:51:31 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015.07.23 14:51:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015.07.23 14:24:43 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015.07.23 14:24:43 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015.07.23 14:24:01 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015.07.23 14:24:01 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2015.07.23 14:24:01 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015.07.23 14:24:01 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2015.07.23 14:24:01 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015.07.23 14:17:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015.07.23 14:17:24 | 3148,218,368 | -HS- | M] () -- C:\hiberfil.sys
 
========== Files Created - No Company Name ==========
 
[2013.09.16 21:03:06 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.08.24 20:46:14 | 000,016,650 | ---- | C] () -- C:\Users\Michael\AppData\Local\slot1.mm1
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010.07.27 16:59:11 | 014,162,944 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010.07.27 16:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.03.21 10:14:10 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\2monkeys
[2013.07.07 22:21:36 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\8Floor
[2013.07.04 09:01:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar
[2013.05.17 08:06:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar Entertainment
[2012.06.21 22:02:45 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar Stargaze
[2013.05.12 17:28:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AlawarEntertainment
[2013.01.02 17:49:51 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AquaSoft
[2011.08.15 20:45:03 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Artifex Mundi
[2011.10.17 21:25:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Astra Jigsaw Gift
[2012.08.04 21:30:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AtlanticJourney
[2011.09.14 21:37:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Awem
[2012.09.20 12:35:25 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Big Finish
[2013.07.05 15:09:08 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Big Top Games
[2012.07.01 21:02:41 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\bigwig_media
[2013.08.11 11:58:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Blue Tea Games
[2013.05.31 12:56:56 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Boolat Games
[2013.05.15 13:44:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Boomzap
[2012.12.26 19:27:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\calibre
[2011.09.12 14:50:34 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Camel101
[2015.01.11 14:16:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Canneverbe Limited
[2014.10.07 09:44:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Canon
[2011.09.14 20:19:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\casanova
[2013.03.29 17:33:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\casualArts
[2012.09.19 11:53:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\CasualMechanics
[2011.08.22 21:20:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Chirurgie Simulation
[2013.06.01 21:07:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Color Brush
[2011.08.22 21:27:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Daedalic Entertainment
[2014.05.08 11:05:40 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Deep Shadows
[2012.06.26 20:21:50 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\DieselPuppet
[2012.07.20 20:42:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Digital Quarter
[2012.05.20 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\DominiGame Das Geheimnis des verschollenen Tempels
[2011.09.15 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Dragon Altar Games
[2011.08.26 20:23:28 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\driveridentifier
[2015.02.01 16:55:00 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Dropbox
[2012.07.10 21:36:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\EleFun Games
[2013.08.13 09:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Elephant Games
[2011.12.20 17:48:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\elsterformular
[2013.05.09 18:33:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\ERS Game Studios
[2011.08.07 13:23:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Fingertapps
[2011.08.21 20:54:02 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Flood Light Games
[2011.10.10 20:11:35 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Floodlight Games
[2011.09.29 19:58:53 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Friday's games
[2011.09.15 16:50:50 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Frogwares
[2013.05.10 09:35:58 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Funlinker
[2011.09.06 19:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GameHouse
[2013.06.06 22:27:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GameMill Entertainment
[2011.08.21 14:48:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GamersDigital
[2011.09.12 14:50:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GarageGames
[2011.08.13 21:29:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GestaltGames
[2011.09.18 16:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gogii
[2013.06.04 16:57:38 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gogii Games
[2012.09.24 13:27:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gunnar Games
[2012.06.17 18:33:49 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Happy Artist Studio
[2011.09.15 17:00:01 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HdO Adventure
[2013.03.24 22:40:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects Petrodollars
[2012.06.28 20:45:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects Romance
[2013.05.08 19:09:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects XIII
[2011.09.06 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HitPoint Studios
[2012.11.30 17:50:16 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HTC
[2012.11.30 17:50:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2014.03.31 21:31:00 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IcarusGames
[2011.08.26 19:38:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IDT
[2011.12.16 21:44:20 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IN-MEDIAKG
[2013.05.14 18:28:49 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Intenium
[2014.06.03 10:23:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IteraLabs
[2012.07.25 21:21:28 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Jetdogs Studios
[2012.06.20 21:48:01 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\JoyBits
[2012.05.06 13:22:39 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\kingdom
[2011.08.13 20:30:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Lazy Turtle Games
[2011.08.07 09:24:14 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Leadertech
[2013.05.22 19:47:20 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LegacyGames
[2012.05.05 20:06:26 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LegacyInteractive
[2013.05.28 11:16:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LocalLow
[2013.03.25 12:16:06 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MagicIndie
[2014.10.01 17:44:25 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Marmiko IT-Solutions GmbH
[2011.08.13 20:10:08 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Maximize Games
[2012.06.20 21:33:51 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MediaArt
[2011.08.18 20:43:55 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Meridian93
[2011.09.30 23:02:58 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MoMB_Full_Ger
[2011.12.16 21:45:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\mresreg
[2013.04.01 17:58:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MumboJumbo
[2011.08.08 20:40:43 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\My Games
[2013.04.20 13:07:14 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MyPhoneExplorer
[2014.03.31 21:16:38 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MysteriousCaseOfJekyllAndHyde
[2011.10.19 18:56:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Orneon
[2011.11.07 17:30:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Pegasys Inc
[2011.09.25 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\PlayFirst
[2012.06.20 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Rainbow
[2012.03.08 20:41:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Rovio
[2012.09.21 10:43:46 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SecretsOfTheTitanic
[2013.05.08 19:26:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Seven Sails
[2012.06.04 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\ShamanGS
[2013.05.17 19:49:55 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Silverback Games
[2011.08.21 15:16:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Sleepwalker Games
[2013.04.07 13:30:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Specialbit
[2011.09.15 20:18:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SpinTop Games
[2013.05.10 16:33:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SulusGames
[2012.03.16 18:34:26 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Temp
[2014.03.31 21:23:48 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TheLastDays
[2012.06.21 21:36:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TheMissingMonaLisa
[2012.04.25 20:34:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\thriXXX
[2012.07.23 21:09:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TikisLab
[2013.05.31 14:51:46 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TWODESPERADOS
[2013.05.13 09:16:53 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Vast Studios
[2014.03.28 14:23:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\VendelGAMES
[2012.05.26 20:53:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Vogat Interactive
[2011.08.11 19:42:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Windows Live Writer
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2013.11.11 11:43:45 | 103,682,728 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\の楒’
[2013.11.11 09:42:11 | 103,682,728 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\の楒’
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:E690114B
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TempB2748F7
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:72C99D4E
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:BEACE4C8
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:2C86E2AD
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:B3C7433B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4C31986D
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:53F09A92
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:B38BEEEE
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:0441DB7A
 
< End of report >

--- --- ---

schrauber · 23.07.2015, 15:20

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Entericher · 23.07.2015, 15:38

Hallo Schrauber,

vielen Dank.

Ich bekomme sowohl bei der 32 bit wie auch bei der 64 bit folgende Fehlermeldung:

... ist keine zulässige Win32 Anwendung.

Wie gesagt bei beiden

schrauber · 24.07.2015, 06:49

AV PRogramm abschalten

Entericher · 24.07.2015, 09:41

Das bringt leider keine Änderung.
Wenn ich das Programm direkt starte ohne es auf dem Desktop zu speichern bekomme ich folgende Meldung.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F70GNVTQ\FRST64.exe ist keine zulässige Win32 Anwendung.
Die 64 Bit version ist die richtige.
Auch eine Ausnahme im AV Programm bringt nichts.

schrauber · 24.07.2015, 16:33

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
O20:64bit: - HKLM Winlogon: UserInit - (bj.dll) - File not found
:Commands
[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Entericher · 25.07.2015, 15:34

Hallo Schrauber,

hier das Ergebnis

All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:bj.dll deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Michael
->Temp folder emptied: 3180053 bytes
->Temporary Internet Files folder emptied: 737752041 bytes
->Java cache emptied: 13440931 bytes
->FireFox cache emptied: 65882849 bytes
->Flash cache emptied: 56977 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7068 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 1612628 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 784,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 07252015_162625

Files\Folders moved on Reboot...
C:\Users\Michael\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YQCJPW1G\r-csc[1].html moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OG7F3CR6\168937-keine-updates-bzw-neue-installation-moeglich[2].html moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OG7F3CR6\message[1].htm moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N96LHIPM\jload[1] moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N96LHIPM\r-sf[1].html moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\29T9B8FB\ads[2].htm moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

schrauber · 26.07.2015, 13:03

geht jetzt wieder irgendwas?

Entericher · 27.07.2015, 16:27

Nein, leider nicht

schrauber · 28.07.2015, 07:13

Bitte Windows Repair laufen lassen:
Windows reparieren - so geht's - Anleitungen

Entericher · 28.07.2015, 08:11

MMH. Funktioniert nicht.

Wenn ich die Datei als Zip aus Deinem Link lade bekomme ich die Meldung das Archiv ist zerstört.
Wieder in Verbindung zu einem Temp Ordner. Wie schon vorher beschrieben.
Von der Tweaking Seite direkt geladen (ohne Zip) und sowohl nach dem speichern der exe als auch direkt starten ohne speichern bekomme ich die Meldung "Failed to read Lua DLL".

Da scheine ich mir ja was nettes eingefangen zu haben.

schrauber · 28.07.2015, 19:41

Dann schauen wir jetzt mal von Aussen:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Entericher · 29.07.2015, 09:44

Mmh.

Ich hab den Laptop vorkonfiguriert gekauft. ich kann mich nicht erinnern eine Windows CD zu haben.
Gibt es auch eine Möglichkeit ohne Windows CD?

schrauber · 29.07.2015, 15:24

wie oben beschrieben über den Bootmanager

Entericher · 05.08.2015, 12:03

Endlich Zeit gefunden.

Leider jedoch ohne Erfolg.

Auch auf diese Weise kommt die Meldung keine zulässige Win32 Anwendung.

Hab beide Varianten probiert.

24.07.2015, 06:49	#4
schrauber /// the machine /// TB-Ausbilder	Keine Updates bzw. neue Installation möglich AV PRogramm abschalten __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

26.07.2015, 13:03	#8
schrauber /// the machine /// TB-Ausbilder	Keine Updates bzw. neue Installation möglich geht jetzt wieder irgendwas? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

28.07.2015, 07:13	#10
schrauber /// the machine /// TB-Ausbilder	Keine Updates bzw. neue Installation möglich Bitte Windows Repair laufen lassen: Windows reparieren - so geht's - Anleitungen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

29.07.2015, 15:24	#14
schrauber /// the machine /// TB-Ausbilder	Keine Updates bzw. neue Installation möglich wie oben beschrieben über den Bootmanager __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Keine Updates bzw. neue Installation möglich

Plagegeister aller Art und deren Bekämpfung: Keine Updates bzw. neue Installation möglich