| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Keine Updates bzw. neue Installation möglichWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.07.2015, 14:58
| #1 |
 |  Keine Updates bzw. neue Installation möglich Hallo zusammen, als Laie und neuer im Forum hoffe ich, ich habe jetzt den richtigen Bereich getroffen. Vielen Dank Alois. Seit einigen Wochen kann ich weder Programme updaten noch neuinstallieren. Mein Firefox und auch mein Internet Explorer sind nicht mehr da. Ich kann nur noch den Explorer ohne Add Ons verwenden. Wenn ich auf installieren klicke bekomme ich die Meldung ob ich als Administrator oder als Current User installieren möchte. Beides ist identisch. Nachdem ich eine Variante angeklickt habe tut sich nichts mehr. Ich verzweifele gerade und hoffe mir kann jemand von Euch helfen. Schon jetzt vielen Dank Entericher Ich habe die OTL Geschichte laufen lassen, hier das Ergebnis.OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.07.2015 15:12:42 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Michael\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,91 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 57,56% Memory free 7,82 Gb Paging File | 5,16 Gb Available in Paging File | 66,01% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 143,56 Gb Total Space | 50,25 Gb Free Space | 35,00% Space Free | Partition Type: NTFS Drive E: | 139,78 Gb Total Space | 14,17 Gb Free Space | 10,13% Space Free | Partition Type: NTFS Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () PRC - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe () PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe () PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) PRC - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe () PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS) PRC - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe () PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl () MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl () MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl () MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl () MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll () MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\d599db4bed83bba71fe4fcc6c136afcb\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\820d67f73bbcc073564c7d90a7a1b4d4\IAStorCommon.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cea5d9b8e3d6ff3bf3be32cf5fcbcd02\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ad9c2f4737e1e07fa774af31a7d74235\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\86f429e0a23238cf277d464bd0433d86\System.Data.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eba4ec48e3f7f16864c6d96f510fafd9\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\456d5e9d3a0a37697ab28c150e9ac5b7\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\155679a9c8991cc33f90d6b27bac1977\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\0bddc91cbf37d143f08f6684b2919566\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\610374fef100556da252243e673ac64b\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\23bc3936180ff789f44259a211dfc7fc\mscorlib.ni.dll () MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe () MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll () MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf () MOD - c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll () MOD - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe () MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () ========== Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe () SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (STacSV) -- C:\Programme\IDT\WDM\stacsv64.exe (IDT, Inc.) SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe () SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) SRV - (TurboBoost) -- C:\Programme\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV - (RoxWatch12) -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions) SRV - (RoxMediaDB12OEM) -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (Bluetooth OBEX Service) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) SRV - (Bluetooth Media Service) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation) SRV - (Bluetooth Device Monitor) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (AESTFilters) -- C:\Programme\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avnetflt) -- C:\Windows\SysNative\drivers\avnetflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwsw00.sys (Intel Corporation) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (intelkmd) -- C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation) DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV:64bit: - (wdkmd) -- C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation) DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (btmaux) -- C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation) DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation) DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.) DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation) DRV:64bit: - (silabser) -- C:\Windows\SysNative\drivers\silabser.sys (Silicon Laboratories) DRV:64bit: - (silabenm) -- C:\Windows\SysNative\drivers\silabenm.sys (Silicon Laboratories, Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation) DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV - (cdrbsdrv) -- C:\Windows\SysWow64\drivers\CDRBSDRV.SYS (B.H.A Corporation) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=hp IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{125C6911-57D7-46C4-9907-430B26C5C007}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.countryCode: "DE" FF - prefs.js..browser.search.isUS: false FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12" FF - prefs.js..browser.search.region: "DE" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "www.internetcologne.de" FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20131118 FF - prefs.js..extensions.enabledAddons: %7B5384767E-00D9-40E9-B72F-9CC39D655D6F%7D:1.5.0.6 FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.9.22 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:37.0.2 FF - prefs.js..keyword.URL: "hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre1.8.0_40\bin\new_plugin\npjp2.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) [2011.08.07 10:04:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions [2015.04.23 09:58:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions [2015.04.23 09:58:12 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013.11.26 20:24:49 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015.04.23 09:58:06 | 000,546,981 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015.04.03 14:07:23 | 000,970,672 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.10.29 19:42:09 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012.12.23 18:19:17 | 000,002,389 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\searchplugins\Web Search.xml [2015.05.05 20:12:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation) O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe () O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.) O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.) O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe (Dell, Inc.) O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd) O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe () O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [RoxWatchTray] c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions) O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001..\Run: [Spybot-S&D Cleaning] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.) O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell) O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..Trusted Domains: blank ([]about in Lokales Intranet) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 11.40.2) O16:64bit: - DPF: {CAFEEFAC-0018-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 1.8.0_40) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 1.8.0_40) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{499F0A3D-319F-4DFD-B959-FB4CCB904B4E}: DhcpNameServer = 192.168.42.129 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{876B86BE-E977-45B7-AE7A-F7D7C5CC90FD}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (bj.dll) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{1bb7672f-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{1bb7672f-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{1bb76756-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{1bb76756-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{1bb7675f-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{1bb7675f-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{24b33342-6f9a-11e1-863c-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{24b33342-6f9a-11e1-863c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{24b333a1-6f9a-11e1-863c-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{24b333a1-6f9a-11e1-863c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{337f4733-6ec7-11e1-9a9a-001e101f1f81}\Shell - "" = AutoRun O33 - MountPoints2\{337f4733-6ec7-11e1-9a9a-001e101f1f81}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{57795498-6e03-11e1-97d5-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{57795498-6e03-11e1-97d5-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{577954a6-6e03-11e1-97d5-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{577954a6-6e03-11e1-97d5-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{6959f816-6e01-11e1-99e9-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{6959f816-6e01-11e1-99e9-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{6959f82c-6e01-11e1-99e9-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{6959f82c-6e01-11e1-99e9-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{74bf0d38-5218-11e1-866c-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{74bf0d38-5218-11e1-866c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{99b8c3cb-4e92-11e1-8551-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{99b8c3cb-4e92-11e1-8551-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{99b8c3df-4e92-11e1-8551-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{99b8c3df-4e92-11e1-8551-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{c500ba12-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{c500ba12-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{c500ba24-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{c500ba24-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{c500ba33-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun O33 - MountPoints2\{c500ba33-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{e1b790af-70d8-11e1-9792-001e101f4da1}\Shell - "" = AutoRun O33 - MountPoints2\{e1b790af-70d8-11e1-9792-001e101f4da1}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{e1b790c2-70d8-11e1-9792-001e101f4da1}\Shell - "" = AutoRun O33 - MountPoints2\{e1b790c2-70d8-11e1-9792-001e101f4da1}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2015.07.23 15:14:08 | 004,796,740 | ---- | C] (WinZip International LLC ) -- C:\Users\Michael\Desktop\wzmp_10.exe [2015.07.23 15:11:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe ========== Files - Modified Within 30 Days ========== [2015.07.23 15:14:12 | 004,796,740 | ---- | M] (WinZip International LLC ) -- C:\Users\Michael\Desktop\wzmp_10.exe [2015.07.23 15:11:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe [2015.07.23 14:51:31 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2015.07.23 14:51:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2015.07.23 14:24:43 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2015.07.23 14:24:43 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2015.07.23 14:24:01 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2015.07.23 14:24:01 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2015.07.23 14:24:01 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2015.07.23 14:24:01 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2015.07.23 14:24:01 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2015.07.23 14:17:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2015.07.23 14:17:24 | 3148,218,368 | -HS- | M] () -- C:\hiberfil.sys ========== Files Created - No Company Name ========== [2013.09.16 21:03:06 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.08.24 20:46:14 | 000,016,650 | ---- | C] () -- C:\Users\Michael\AppData\Local\slot1.mm1 ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2010.07.27 16:59:11 | 014,162,944 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2010.07.27 16:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.03.21 10:14:10 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\2monkeys [2013.07.07 22:21:36 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\8Floor [2013.07.04 09:01:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar [2013.05.17 08:06:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar Entertainment [2012.06.21 22:02:45 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar Stargaze [2013.05.12 17:28:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AlawarEntertainment [2013.01.02 17:49:51 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AquaSoft [2011.08.15 20:45:03 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Artifex Mundi [2011.10.17 21:25:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Astra Jigsaw Gift [2012.08.04 21:30:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AtlanticJourney [2011.09.14 21:37:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Awem [2012.09.20 12:35:25 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Big Finish [2013.07.05 15:09:08 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Big Top Games [2012.07.01 21:02:41 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\bigwig_media [2013.08.11 11:58:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Blue Tea Games [2013.05.31 12:56:56 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Boolat Games [2013.05.15 13:44:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Boomzap [2012.12.26 19:27:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\calibre [2011.09.12 14:50:34 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Camel101 [2015.01.11 14:16:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Canneverbe Limited [2014.10.07 09:44:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Canon [2011.09.14 20:19:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\casanova [2013.03.29 17:33:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\casualArts [2012.09.19 11:53:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\CasualMechanics [2011.08.22 21:20:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Chirurgie Simulation [2013.06.01 21:07:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Color Brush [2011.08.22 21:27:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Daedalic Entertainment [2014.05.08 11:05:40 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Deep Shadows [2012.06.26 20:21:50 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\DieselPuppet [2012.07.20 20:42:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Digital Quarter [2012.05.20 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\DominiGame Das Geheimnis des verschollenen Tempels [2011.09.15 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Dragon Altar Games [2011.08.26 20:23:28 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\driveridentifier [2015.02.01 16:55:00 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Dropbox [2012.07.10 21:36:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\EleFun Games [2013.08.13 09:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Elephant Games [2011.12.20 17:48:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\elsterformular [2013.05.09 18:33:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\ERS Game Studios [2011.08.07 13:23:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Fingertapps [2011.08.21 20:54:02 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Flood Light Games [2011.10.10 20:11:35 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Floodlight Games [2011.09.29 19:58:53 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Friday's games [2011.09.15 16:50:50 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Frogwares [2013.05.10 09:35:58 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Funlinker [2011.09.06 19:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GameHouse [2013.06.06 22:27:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GameMill Entertainment [2011.08.21 14:48:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GamersDigital [2011.09.12 14:50:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GarageGames [2011.08.13 21:29:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GestaltGames [2011.09.18 16:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gogii [2013.06.04 16:57:38 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gogii Games [2012.09.24 13:27:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gunnar Games [2012.06.17 18:33:49 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Happy Artist Studio [2011.09.15 17:00:01 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HdO Adventure [2013.03.24 22:40:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects Petrodollars [2012.06.28 20:45:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects Romance [2013.05.08 19:09:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects XIII [2011.09.06 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HitPoint Studios [2012.11.30 17:50:16 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HTC [2012.11.30 17:50:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2014.03.31 21:31:00 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IcarusGames [2011.08.26 19:38:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IDT [2011.12.16 21:44:20 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IN-MEDIAKG [2013.05.14 18:28:49 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Intenium [2014.06.03 10:23:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IteraLabs [2012.07.25 21:21:28 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Jetdogs Studios [2012.06.20 21:48:01 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\JoyBits [2012.05.06 13:22:39 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\kingdom [2011.08.13 20:30:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Lazy Turtle Games [2011.08.07 09:24:14 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Leadertech [2013.05.22 19:47:20 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LegacyGames [2012.05.05 20:06:26 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LegacyInteractive [2013.05.28 11:16:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LocalLow [2013.03.25 12:16:06 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MagicIndie [2014.10.01 17:44:25 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Marmiko IT-Solutions GmbH [2011.08.13 20:10:08 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Maximize Games [2012.06.20 21:33:51 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MediaArt [2011.08.18 20:43:55 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Meridian93 [2011.09.30 23:02:58 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MoMB_Full_Ger [2011.12.16 21:45:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\mresreg [2013.04.01 17:58:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MumboJumbo [2011.08.08 20:40:43 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\My Games [2013.04.20 13:07:14 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MyPhoneExplorer [2014.03.31 21:16:38 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MysteriousCaseOfJekyllAndHyde [2011.10.19 18:56:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Orneon [2011.11.07 17:30:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Pegasys Inc [2011.09.25 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\PlayFirst [2012.06.20 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Rainbow [2012.03.08 20:41:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Rovio [2012.09.21 10:43:46 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SecretsOfTheTitanic [2013.05.08 19:26:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Seven Sails [2012.06.04 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\ShamanGS [2013.05.17 19:49:55 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Silverback Games [2011.08.21 15:16:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Sleepwalker Games [2013.04.07 13:30:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Specialbit [2011.09.15 20:18:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SpinTop Games [2013.05.10 16:33:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SulusGames [2012.03.16 18:34:26 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Temp [2014.03.31 21:23:48 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TheLastDays [2012.06.21 21:36:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TheMissingMonaLisa [2012.04.25 20:34:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\thriXXX [2012.07.23 21:09:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TikisLab [2013.05.31 14:51:46 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TWODESPERADOS [2013.05.13 09:16:53 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Vast Studios [2014.03.28 14:23:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\VendelGAMES [2012.05.26 20:53:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Vogat Interactive [2011.08.11 19:42:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Windows Live Writer ========== Purity Check ========== ========== Files - Unicode (All) ========== [2013.11.11 11:43:45 | 103,682,728 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\の楒’ [2013.11.11 09:42:11 | 103,682,728 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\の楒’ ========== Alternate Data Streams ========== @Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:E690114B @Alternate Data Stream - 138 bytes -> C:\ProgramData\TempB2748F7 @Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:72C99D4E @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:BEACE4C8 @Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:2C86E2AD @Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:B3C7433B @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4C31986D @Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:53F09A92 @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:B38BEEEE @Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:0441DB7A < End of report > |
|
23.07.2015, 15:20
| #2 |
| /// the machine /// TB-Ausbilder    | Keine Updates bzw. neue Installation möglich hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
23.07.2015, 15:38
| #3 |
| | Keine Updates bzw. neue Installation möglich Hallo Schrauber,
__________________vielen Dank. Ich bekomme sowohl bei der 32 bit wie auch bei der 64 bit folgende Fehlermeldung: ... ist keine zulässige Win32 Anwendung. Wie gesagt bei beiden |
|
24.07.2015, 06:49
| #4 |
| /// the machine /// TB-Ausbilder | Keine Updates bzw. neue Installation möglich AV PRogramm abschalten 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.07.2015, 09:41
| #5 |
| | Keine Updates bzw. neue Installation möglich Das bringt leider keine Änderung. Wenn ich das Programm direkt starte ohne es auf dem Desktop zu speichern bekomme ich folgende Meldung. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F70GNVTQ\FRST64.exe ist keine zulässige Win32 Anwendung. Die 64 Bit version ist die richtige. Auch eine Ausnahme im AV Programm bringt nichts. |
|
24.07.2015, 16:33
| #6 |
| /// the machine /// TB-Ausbilder | Keine Updates bzw. neue Installation möglichFixen mit OTL
Code:
ATTFilter :OTL
O20:64bit: - HKLM Winlogon: UserInit - (bj.dll) - File not found
:Commands
[emptytemp]
__________________ --> Keine Updates bzw. neue Installation möglich |
|
25.07.2015, 15:34
| #7 |
| | Keine Updates bzw. neue Installation möglich Hallo Schrauber, hier das Ergebnis All processes killed ========== OTL ========== 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:bj.dll deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 56466 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Michael ->Temp folder emptied: 3180053 bytes ->Temporary Internet Files folder emptied: 737752041 bytes ->Java cache emptied: 13440931 bytes ->FireFox cache emptied: 65882849 bytes ->Flash cache emptied: 56977 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 7068 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 1612628 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 784,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 07252015_162625 Files\Folders moved on Reboot... C:\Users\Michael\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YQCJPW1G\r-csc[1].html moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OG7F3CR6\168937-keine-updates-bzw-neue-installation-moeglich[2].html moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OG7F3CR6\message[1].htm moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N96LHIPM\jload[1] moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N96LHIPM\r-sf[1].html moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\29T9B8FB\ads[2].htm moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... |
|
26.07.2015, 13:03
| #8 |
| /// the machine /// TB-Ausbilder | Keine Updates bzw. neue Installation möglich geht jetzt wieder irgendwas?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.07.2015, 16:27
| #9 |
| | Keine Updates bzw. neue Installation möglich Nein, leider nicht |
|
28.07.2015, 07:13
| #10 |
| /// the machine /// TB-Ausbilder | Keine Updates bzw. neue Installation möglich Bitte Windows Repair laufen lassen: Windows reparieren - so geht's - Anleitungen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.07.2015, 08:11
| #11 |
| | Keine Updates bzw. neue Installation möglich MMH. Funktioniert nicht. Wenn ich die Datei als Zip aus Deinem Link lade bekomme ich die Meldung das Archiv ist zerstört. Wieder in Verbindung zu einem Temp Ordner. Wie schon vorher beschrieben. Von der Tweaking Seite direkt geladen (ohne Zip) und sowohl nach dem speichern der exe als auch direkt starten ohne speichern bekomme ich die Meldung "Failed to read Lua DLL". Da scheine ich mir ja was nettes eingefangen zu haben. |
|
28.07.2015, 19:41
| #12 |
| /// the machine /// TB-Ausbilder | Keine Updates bzw. neue Installation möglich Dann schauen wir jetzt mal von Aussen: Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8) Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.07.2015, 09:44
| #13 |
| | Keine Updates bzw. neue Installation möglich Mmh. Ich hab den Laptop vorkonfiguriert gekauft. ich kann mich nicht erinnern eine Windows CD zu haben. Gibt es auch eine Möglichkeit ohne Windows CD? |
|
29.07.2015, 15:24
| #14 |
| /// the machine /// TB-Ausbilder | Keine Updates bzw. neue Installation möglich wie oben beschrieben über den Bootmanager
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.08.2015, 12:03
| #15 |
| | Keine Updates bzw. neue Installation möglich Endlich Zeit gefunden. Leider jedoch ohne Erfolg. Auch auf diese Weise kommt die Meldung keine zulässige Win32 Anwendung. Hab beide Varianten probiert. |
|
| Themen zu Keine Updates bzw. neue Installation möglich |
| .dll, adobe, antivir, autorun, avg, avira, bho, bonjour, explorer, firefox, format, google, helper, home, installation, internet, internet explorer, logfile, monitor, realtek, scan, senden, updates, usb, windows |
Textbox. 
Linear-Darstellung
