Trojaner-Board - recycler e621ca05.exe auf Externer Festplatte

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - recycler e621ca05.exe auf Externer Festplatte (https://www.trojaner-board.de/115010-recycler-e621ca05-exe-externer-festplatte.html)

recycler e621ca05.exe auf Externer Festplatte

Hallo liebes Trojaner-Board-Team,

ich verstehe leider nicht sooo viel von Computern, hoffe aber trotzdem, dass ihr mir weiterhelfen könnt! ;)

Auf meiner externen Festplatte scheint ein Trojaner zu sein, ich habe schon einige Beiträge dazu hier im Board gefunden.

Das Problem ist wie folgt:

Wenn ich die Festplatte an meinen Laptop anschließe und starte, werden FAST ALLE Dateien (mit Außnahme von zwei Ordnern und ein paar Dateien) nur noch als Verknüpfung angezeigt und diese lassen sich dann nicht öffnen.

Wenn ich also auf eine Verknüpfung klicke, erscheint folgende Nachricht: "G:\RECYCLER\e621ca05.exe konnte nicht gefunden werden. Stellen sie sicher, dass sie den Namen richtig eingegeben haben und wiederholen sie den Vorgang."

Ich hoffe, ihr könnt mir helfen, damit ich meine ganzen Daten eventuell retten kann!

Vielen Dank im Voraus,
Laury

Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

Zitat:

"Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
- da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
- also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
Charakteristische Merkmale/Profilinformationen:
- aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
Die Systemprüfung und Bereinigung:
- kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
Innerhalb der Betreuungszeit:
- ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
Die Reihenfolge:
- genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
Ansonsten unsere Forumsregeln:
- Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)

► Ab jetzt sofort gilt, bis zum Ende der Reinigung>:

Zitat:

Hast Du externe Festplatte, USB-Sticks und/oder andere externe Speichermedien? Bitte immer (über die ganze Reinigungszeit!!) anschließen,damit gescannt werden kann.- alle Wechseldatenträger und immer bei gedrückter Shift-Taste am USB-Anschluss des Rechners einstecken! - So verhindest Du die Ausführung der AUTORUN-Funktion -> Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

-> Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten

► Erster Teil des 3-teiligen Verfahren, werden wir dein System auf Viren untersuchen, bzw nach einem anderen Verursacher suchen:
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org

Installieren und per Doppelklick starten.
Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
"Komplett Scan durchführen" wählen (überall Haken setzen)
wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Anleitung

2.
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

3.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:

Download den CCleaner - Installer herunter
Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

Zitat:

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw

gruß
kira

Vielen Dank für den ausführlichen Rat!

Hat ein bisschen gedauert, aber habe ENDLICH alles durchgeführt und poste jetzt in der gleichen Reihenfolge die Logfiles:

Code:

 Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.05.14.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Laura :: LAURA-PC [Administrator]
 

Schutz: Aktiviert
 

15.05.2012 12:12:27

mbam-log-2012-05-15 (12-12-27).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 398168

Laufzeit: 1 Stunde(n), 17 Minute(n), 13 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)

Code:



Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\Users\Laura\Downloads\SoftonicDownloader_fuer_vlc-media-player.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Laura\Downloads\SoftonicDownloader_fuer_tubebox.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Laura\Downloads\SoftonicDownloader_fuer_pc-inspector-smart-recovery.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Laura\Downloads\SoftonicDownloader_fuer_magix-music-maker-mx.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)
 
 

OTL Logfile:
 

        Code:


        
OTL logfile created on: 15.05.2012 20:44:04 - Run 1

OTL by OldTimer - Version 3.2.43.0     Folder = C:\Users\Laura\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 47,99% Memory free

3,86 Gb Paging File | 2,56 Gb Available in Paging File | 66,22% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 293,95 Gb Total Space | 156,10 Gb Free Space | 53,11% Space Free | Partition Type: NTFS

Drive F: | 298,02 Gb Total Space | 122,68 Gb Free Space | 41,16% Space Free | Partition Type: FAT32

 

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Laura\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()

MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()

MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (k57nd60a) Broadcom NetLink (TM) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (BrSerIf) -- C:\Windows\SysNative\drivers\BrSerIf.sys (Brother Industries Ltd.)

DRV:64bit: - (ZSMC301b) -- C:\Windows\SysNative\drivers\usbVM31b.sys (VM)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C2 44 9C 79 3D 56 CC 01  [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{41F7CB0F-79AB-44C0-BC17-D5707C8990CC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcphp?q={searchTerms}&ch_id=osd

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.8&q="

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://homitrlz.in"

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.14 17:16:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.06 07:06:53 | 000,000,000 | ---D | M]

 

[2011.07.12 17:53:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laura\AppData\Roaming\mozilla\Extensions

[2012.05.15 20:29:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions

[2011.09.29 16:07:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.07.27 01:38:02 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.08.19 20:48:20 | 000,002,342 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icq-search.xml

[2011.08.19 21:14:20 | 000,000,950 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icqplugin.xml

[2012.03.12 12:26:45 | 000,001,677 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\startingpage---deutsch.xml

[2011.12.17 19:15:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.07.12 20:35:18 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2012.04.14 17:16:59 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.04.14 17:16:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.04.14 17:16:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.04.14 17:16:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.14 17:16:55 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.14 17:16:55 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.14 17:16:55 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BAD8705-5123-4D3F-A9A1-78866FB97484}: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA60D796-0D88-47F8-AC16-AE36E2FBDE34}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell - "" = AutoRun

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.12 18:07:00 | 000,000,000 | ---D | C] -- C:\Users\Laura\AppData\Roaming\Malwarebytes

[2012.05.12 18:06:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.05.12 18:06:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.05.12 18:06:22 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.05.12 18:06:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.05.11 13:07:08 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Laura\Desktop\dds.com

[2012.05.10 16:54:24 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.05.10 13:58:10 | 001,544,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.05.10 13:58:06 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.05.10 13:58:04 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.05.10 13:58:04 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.05.07 17:41:06 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Sundermeyer

[2012.04.26 17:12:44 | 000,000,000 | ---D | C] -- C:\Users\Laura\Desktop\radiokiss

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.05.15 20:31:52 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.05.15 20:31:52 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.05.15 20:24:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.05.15 20:23:57 | 1555,537,920 | -HS- | M] () -- C:\hiberfil.sys

[2012.05.12 18:06:24 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.11 13:09:27 | 000,000,000 | ---- | M] () -- C:\Users\Laura\defogger_reenable

[2012.05.11 13:07:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Laura\Desktop\dds.com

[2012.05.11 13:06:33 | 000,050,477 | ---- | M] () -- C:\Users\Laura\Desktop\Defogger.exe

[2012.05.11 12:45:23 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.05.11 12:45:23 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.05.11 12:45:23 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.05.11 12:45:23 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.05.11 12:45:23 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.05.10 19:08:45 | 000,458,736 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.01 22:33:34 | 000,046,835 | ---- | M] () -- C:\Users\Public\Documents\Trainingsplan_blanko.pdf

 
 ========== Files Created - No Company Name ==========

 

[2012.05.12 18:06:24 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.11 13:09:27 | 000,000,000 | ---- | C] () -- C:\Users\Laura\defogger_reenable

[2012.05.11 13:06:28 | 000,050,477 | ---- | C] () -- C:\Users\Laura\Desktop\Defogger.exe

[2012.05.01 22:33:33 | 000,046,835 | ---- | C] () -- C:\Users\Public\Documents\Trainingsplan_blanko.pdf

[2011.12.09 23:34:18 | 000,000,532 | ---- | C] () -- C:\Windows\eReg.dat

[2011.10.18 09:02:27 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2011.10.18 09:02:27 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2011.08.24 05:21:36 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
 

< End of report >

 
--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 15.05.2012 20:44:04 - Run 1

OTL by OldTimer - Version 3.2.43.0     Folder = C:\Users\Laura\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 47,99% Memory free

3,86 Gb Paging File | 2,56 Gb Available in Paging File | 66,22% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 293,95 Gb Total Space | 156,10 Gb Free Space | 53,11% Space Free | Partition Type: NTFS

Drive F: | 298,02 Gb Total Space | 122,68 Gb Free Space | 41,16% Space Free | Partition Type: FAT32

 

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1F862838-AE32-47CF-B4ED-059EBCAEF999}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{1FBD4F55-FC84-4529-88E2-8CF63BEECB7A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{256552DA-7F11-43DB-A690-8C4DF3C0C729}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{61AD3D46-EB64-4218-AC29-7398A23C4A7D}" = rport=139 | protocol=6 | dir=out | app=system | 

"{6483ABCA-E11C-47F7-8338-7E0D4762D4F2}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{65BFABB6-8B89-411E-94A9-97DC0488C532}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{6EB8E10C-7EB6-486D-B91C-3FE5499572E1}" = rport=138 | protocol=17 | dir=out | app=system | 

"{704B69E3-B2A2-4786-A37B-7DB76FE96036}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{72D7825D-CB99-47EB-A742-2243ACD0BC1E}" = lport=139 | protocol=6 | dir=in | app=system | 

"{7942A3CA-D80C-4E7F-8216-02A15B59586A}" = rport=445 | protocol=6 | dir=out | app=system | 

"{7DA81C41-66CB-41F7-BC1F-B9F45D01C444}" = lport=138 | protocol=17 | dir=in | app=system | 

"{8ABE3C83-9E3A-4860-894D-212E7080C27A}" = lport=445 | protocol=6 | dir=in | app=system | 

"{951DEE88-ECC8-4358-B921-A601699DE270}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{967E7246-FFA8-4D38-B471-54266EC7A980}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A0F52E19-B80F-4DA0-9C91-80DEB027B99C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{AF2C7C0B-779D-46DC-B268-13D1CDA043E7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{CC17276F-CCD6-4A49-99CC-5047ADBD9599}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{CF2D822B-7FF3-4D6B-A702-21B9DF496A52}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D47F5F92-488D-49AE-861D-010742D36DE9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{F9B31A9A-8627-4BD5-8BDD-C410820DAC45}" = lport=137 | protocol=17 | dir=in | app=system | 

"{FF81C3AE-CF54-4658-BC88-DD88C5640C63}" = rport=10243 | protocol=6 | dir=out | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0C28168D-0049-4F71-8081-1D6609325200}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{0DDBA146-9FC6-45D9-A000-FF62DC42BA5E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{2928AE16-3D74-4DE5-BADF-213416B3ECD1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{34165640-296C-4C74-A304-9D152C83F71E}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{422CF321-9A3B-4835-B508-A9441314A21B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{4F561FDC-36A9-41EE-8107-CA7C5A2BD019}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{5D40123C-6616-4354-9428-6CDFB991F192}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{5ED20B88-D238-4F5C-8649-4E4770DA2317}" = protocol=6 | dir=out | app=system | 

"{61A96BDA-305B-44D2-8ACE-5DA3D981A5F4}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{61AFA832-0495-4629-85E9-41C5B016EFBE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{63882B5C-7BD3-4442-B17E-EDB31AAC4984}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{69D6E152-C1D6-43AA-852B-34C1E47F49E5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{727FECE8-2C9F-483C-82B8-33807233411C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{7305FD5F-2E9F-447F-8726-59AA012FED96}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{7C23BC60-4063-47D0-A09E-808473623499}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{8D89CE9F-1284-4588-A501-5FE109C07768}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{9F3F2814-4995-47DB-AEC3-3D23019F7A61}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{A3C3F169-C4C7-428E-8AB9-C14B7C90BA50}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{C62C7176-17B4-4C47-8049-A74B0FDF6394}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{CD200253-337E-4B35-9E01-E85DB329194E}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{D15A9199-3338-41A2-9588-3EB97658F37B}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{E85659F3-B1B5-41C1-B268-7CB583ACD982}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{F11758D4-F21B-42C7-900D-BC04C58EAD59}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{F25F8542-06BB-4117-82D5-08352F83B709}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{FE88DE3C-9550-4B25-90BB-A6399B0739BF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"TCP Query User{5C7DEE71-1190-4F68-A253-F2D61944DBFF}C:\program files (x86)\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 

"UDP Query User{FB6ED38B-C7CB-4745-B58C-C977D6439D56}C:\program files (x86)\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers

"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support

"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010

"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010

"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller

"{BCF07271-A853-4D3A-B668-4B752174CAA8}" = iTunes

"{F26DE123-C491-4D8C-BC86-FDF604F00226}" = Broadcom Gigabit Integrated Controller

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"08116AAA5079D141DE9F37C0804CDE8B00E3F4AD" = Windows-Treiberpaket - Intel (NETw5s64) net  (05/31/2010 13.2.1.5)

"60F79568B15F277EAF37083939CFCC51ADCD2906" = Windows-Treiberpaket - Intel (NETw5v64) net  (05/31/2010 13.2.1.5)

"Broadcom 802.11 Network Adapter" = Broadcom 802.11 Network Adapter

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser

"{1DF3A435-4AC8-4DBB-A916-F445708EF6DB}" = MAGIX Screenshare

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2

"{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}" = TubeBox!

"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program

"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition

"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe

"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE

"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{735AA36F-9A9E-477B-BC74-9E6AF1A8A6D8}" = MAGIX Music Maker MX Premium Download-Version

"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0

"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime

"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010

"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars

"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0

"{C0CDE373-F031-49D1-A509-3471BD69A7AE}" = MAGIX Speed burnR (MSI)

"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update

"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3

"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0

"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"AVS Update Manager_is1" = AVS Update Manager 1.0

"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4

"AVS4YOU Video Converter 7_is1" = AVS Video Converter 8

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722

"MAGIX_MSI_mm18dlx" = MAGIX Music Maker MX Premium Download-Version

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH

"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)

"Office14.SingleImage" = Microsoft Office Home and Student 2010

"Picasa 3" = Picasa 3

"schobuk_is1" = schobuk 2.0

"Tomb Raider: Legend" = Tomb Raider: Legend 1.2

"VLC media player" = VLC media player 1.1.11

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"FoxTab AVI Converter" = FoxTab AVI Converter

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 15.05.2012 04:03:55 | Computer Name = Laura-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 15.05.2012 04:04:24 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.05.2012 05:46:38 | Computer Name = Laura-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 15.05.2012 05:48:05 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.05.2012 06:04:18 | Computer Name = Laura-PC | Source = Application Hang | ID = 1002

Description = Programm OTL.exe, Version 3.2.43.0 kann nicht mehr unter Windows ausgeführt

 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,

 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: ef0    Startzeit: 

01cd3280f0f4115d    Endzeit: 13    Anwendungspfad: C:\Users\Laura\Downloads\OTL.exe    Berichts-ID:

   

 

Error - 15.05.2012 10:35:35 | Computer Name = Laura-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 15.05.2012 10:37:02 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 15.05.2012 10:43:19 | Computer Name = Laura-PC | Source = Customer Experience Improvement Program | ID = 1008

Description = 

 

Error - 15.05.2012 14:24:24 | Computer Name = Laura-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 15.05.2012 14:25:52 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

[ Media Center Events ]

Error - 12.10.2011 16:34:07 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 22:34:07 - Fehler beim Herstellen der Internetverbindung.  22:34:07 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 16:34:21 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 22:34:12 - Fehler beim Herstellen der Internetverbindung.  22:34:12 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 17:34:42 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 23:34:42 - Fehler beim Herstellen der Internetverbindung.  23:34:42 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 17:34:54 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 23:34:48 - Fehler beim Herstellen der Internetverbindung.  23:34:48 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 18:35:12 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 00:35:12 - Fehler beim Herstellen der Internetverbindung.  00:35:12 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 18:35:22 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 00:35:17 - Fehler beim Herstellen der Internetverbindung.  00:35:17 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 19:35:39 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 01:35:39 - Fehler beim Herstellen der Internetverbindung.  01:35:39 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 19:35:49 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 01:35:44 - Fehler beim Herstellen der Internetverbindung.  01:35:44 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.10.2011 11:17:35 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 17:17:35 - Fehler beim Herstellen der Internetverbindung.  17:17:35 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.10.2011 11:17:58 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 17:17:40 - Fehler beim Herstellen der Internetverbindung.  17:17:40 

-     Serververbindung konnte nicht hergestellt werden..  

 

[ System Events ]

Error - 10.05.2012 13:10:36 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 12.05.2012 14:10:30 | Computer Name = Laura-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 13.05.2012 13:24:08 | Computer Name = Laura-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 13.05.2012 16:51:23 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Media Player-Netzwerkfreigabedienst erreicht.

 

Error - 13.05.2012 16:51:23 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund

 folgenden Fehlers nicht gestartet:   %%1053

 

Error - 14.05.2012 16:57:31 | Computer Name = Laura-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 15.05.2012 05:47:41 | Computer Name = Laura-PC | Source = WMPNetworkSvc | ID = 866300

Description = 

 

Error - 15.05.2012 10:32:20 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst lmhosts erreicht.

 

Error - 15.05.2012 14:25:21 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Media Player-Netzwerkfreigabedienst erreicht.

 

Error - 15.05.2012 14:25:21 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund

 folgenden Fehlers nicht gestartet:   %%1053

 

 

< End of report >

--- --- ---

[/code]

Code:

Adobe Flash Player 10 Plugin        Adobe Systems Incorporated        11.07.2011        6,00MB        10.3.181.34

Adobe Photoshop CS2        Adobe Systems, Inc.        21.09.2011                9.0

Adobe Reader X (10.1.0) - Deutsch        Adobe Systems Incorporated        13.08.2011        118,5MB        10.1.0

Apple Application Support        Apple Inc.        11.07.2011        51,0MB        1.5.2

Apple Mobile Device Support        Apple Inc.        11.07.2011        22,7MB        3.4.1.2

Apple Software Update        Apple Inc.        11.07.2011        2,25MB        2.1.3.127

Atheros Client Installation Program        Atheros        11.07.2011                7.0

Avira AntiVir Personal - Free Antivirus        Avira GmbH        16.02.2012        74,3MB        10.2.0.707

AVS Update Manager 1.0        Online Media Technologies Ltd.        03.09.2011                

AVS Video Converter 8        Online Media Technologies Ltd.        03.09.2011                

AVS4YOU Software Navigator 1.4        Online Media Technologies Ltd.        03.09.2011                

Bonjour        Apple Inc.        11.07.2011        1,75MB        2.0.5.0

Broadcom 802.11 Network Adapter        Broadcom Corporation        12.07.2011                5.100.249.2

Broadcom Gigabit Integrated Controller        Broadcom Corporation        11.07.2011        1,52MB        14.0.2.2

Broadcom Gigabit NetLink Controller        Broadcom Corporation        11.07.2011        0,44MB        14.0.2.3

Canon MP250 series MP Drivers                08.10.2011                

CCleaner        Piriform        14.05.2012                3.18

Cisco EAP-FAST Module        Cisco Systems, Inc.        11.07.2011        1,55MB        2.2.14

Cisco LEAP Module        Cisco Systems, Inc.        11.07.2011        0,63MB        1.0.19

Cisco PEAP Module        Cisco Systems, Inc.        11.07.2011        1,24MB        1.1.6

Die Sims 2                11.10.2011                

Firebird SQL Server - MAGIX Edition        MAGIX AG        26.02.2012        10,1MB        2.1.27.0

FoxTab AVI Converter                04.09.2011                

Free YouTube to MP3 Converter version 3.10.5.722        DVDVideoSoft Limited.        25.07.2011        44,8MB        

Internet-TV für Windows Media Center        Microsoft Corporation        14.01.2012        13,7MB        4.2.2.0

iTunes        Apple Inc.        11.07.2011        145,0MB        10.3.1.55

Java(TM) 6 Update 26        Oracle        08.08.2011        94,9MB        6.0.260

MAGIX Music Maker MX Premium Download-Version        MAGIX AG        26.02.2012                18.0.0.42

MAGIX Screenshare        MAGIX AG        26.02.2012        1,43MB        4.3.6.1987

MAGIX Speed burnR (MSI)        MAGIX AG        26.02.2012        19,7MB        7.0.2.6

Malwarebytes Anti-Malware Version 1.61.0.1400        Malwarebytes Corporation        11.05.2012        18,0MB        1.61.0.1400

Mein CEWE FOTOBUCH                30.01.2012                

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        16.07.2011        38,8MB        4.0.30319

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        16.07.2011        2,94MB        4.0.30319

Microsoft Office Home and Student 2010        Microsoft Corporation        06.02.2012                14.0.6029.1000

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        03.09.2011        0,29MB        8.0.61001

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729        Microsoft Corporation        30.01.2012        0,24MB        9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        23.02.2012        0,22MB        9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        11.07.2011        0,58MB        9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        06.02.2012        0,59MB        9.0.30729.6161

Mozilla Firefox 11.0 (x86 de)        Mozilla        13.04.2012        37,7MB        11.0

MSXML 4.0 SP3 Parser        Microsoft Corporation        23.02.2012        1,48MB        4.30.2100.0

MSXML 4.0 SP3 Parser (KB973685)        Microsoft Corporation        24.02.2012        1,53MB        4.30.2107.0

OpenOffice.org 3.3        OpenOffice.org        18.07.2011        415MB        3.3.9567

Picasa 3        Google, Inc.        27.07.2011                3.8

QuickTime        Apple Inc.        11.07.2011        73,7MB        7.69.80.9

schobuk 2.0                04.09.2011                schobuk 2.0

SimCity 4 Deluxe                08.12.2011                

Skype Toolbars        Skype Technologies S.A.        11.07.2011        8,35MB        5.5.7896

Skype™ 5.3        Skype Technologies S.A.        11.07.2011        16,6MB        5.3.120

Text-To-Speech-Runtime        Magix Development GmbH        23.02.2012        0,25MB        1.0.0.0

Tomb Raider: Legend 1.2                27.11.2011                

TubeBox!        Jens Lorek        04.11.2011        13,1MB        3.4.6

VirtualDJ Home FREE        Atomix Productions        26.02.2012        48,4MB        7.0.5

VLC media player 1.1.11        VideoLAN        23.08.2011                1.1.11

Windows-Treiberpaket - Intel (NETw5s64) net  (05/31/2010 13.2.1.5)        Intel        11.07.2011                05/31/2010 13.2.1.5

Windows-Treiberpaket - Intel (NETw5v64) net  (05/31/2010 13.2.1.5)        Intel        11.07.2011                05/31/2010 13.2.1.5

Hoffe, ich habe es richtig gepostet bzw. dass alles vollständig ist! VIELEN DANK schon mal! :)

Systemreinigung und Prüfung:

1.

Zitat:

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht:

Code:

:OTL

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{41F7CB0F-79AB-44C0-BC17-D5707C8990CC}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searcphp?q={searchTerms}&ch_id=osd

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.8&q="

FF - prefs.js..browser.startup.homepage: "http://homitrlz.in"

FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="

FF - user.js - File not found

[2011.08.19 20:48:20 | 000,002,342 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icq-search.xml

[2012.04.14 17:16:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.04.14 17:16:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.04.14 17:16:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.14 17:16:55 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.14 17:16:55 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell - "" = AutoRun

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
 

:Files

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

2.
Java aktualisieren- über Systemsteuerung-> Nach Update suchen...
oder:
Downloade nun die Offline-Version von Java "Empfohlen Version 6 Update 32 " von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.

3.
Tipps (unabhängig davon ob man den Internet Explorer benutzt oder nicht!):
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Wie kann ich den Cache im Internet Explorer leeren?

4.
reinige dein System mit CCleaner:

"CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

lade Dir SUPERAntiSpyware FREE Edition herunter.
Achte darauf, eventuell angebotene Toolbar nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar (falls nötig), entfernen.
installiere das Programm und update online.
starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

7.
-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

8.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?

Ich habe Schritt 1 jetzt mehrmals probiert, aber es scheint nicht zu funktionieren..
Ich weiß nicht, woran es liegt, ich habe es eingefügt, alles geschlossen und wenn ich dann auf FIX drücke, erscheint folgende Meldung:

"Cannot create file:
C:\Users\Laura\AppData\Roaming\Mozilla\FireFox\Profiles\8e1c4u4r.default\prefs.js"

führe dann das OTL-Fixes im abgesicherten Modus aus:
♦ PC neu starten
♦ Drücke gleich mehrmals die F8-Taste. Am besten mehrmals und schnell nacheinander drücken.
♦ Wähle in der Liste, die nun erscheint, den abgesicherten Modus aus.

dann normal weiter wie gehabt

Okay diesmal hats geklappt - super!

Aber da stand nichts von wegen Neustart, aber eine Textdatei habe ich trotzdem:

OTL Logfile:

Code:

OTL logfile created on: 16.05.2012 15:18:36 - Run 2

OTL by OldTimer - Version 3.2.43.0     Folder = C:\Users\Laura\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 1,11 Gb Available Physical Memory | 57,30% Memory free

3,86 Gb Paging File | 3,06 Gb Available in Paging File | 79,25% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 293,95 Gb Total Space | 159,13 Gb Free Space | 54,14% Space Free | Partition Type: NTFS

Drive E: | 3,66 Gb Total Space | 3,60 Gb Free Space | 98,37% Space Free | Partition Type: FAT32

Drive F: | 298,02 Gb Total Space | 122,68 Gb Free Space | 41,17% Space Free | Partition Type: FAT32

 

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Laura\Desktop\OTL.exe (OldTimer Tools)

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (k57nd60a) Broadcom NetLink (TM) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (BrSerIf) -- C:\Windows\SysNative\drivers\BrSerIf.sys (Brother Industries Ltd.)

DRV:64bit: - (ZSMC301b) -- C:\Windows\SysNative\drivers\usbVM31b.sys (VM)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C2 44 9C 79 3D 56 CC 01  [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.8&q="

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://homitrlz.in"

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.16 11:53:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.06 07:06:53 | 000,000,000 | ---D | M]

 

[2011.07.12 17:53:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laura\AppData\Roaming\mozilla\Extensions

[2012.05.16 11:57:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions

[2011.09.29 16:07:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.07.27 01:38:02 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.08.19 20:48:20 | 000,002,342 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icq-search.xml

[2011.08.19 21:14:20 | 000,000,950 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icqplugin.xml

[2012.03.12 12:26:45 | 000,001,677 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\startingpage---deutsch.xml

[2011.12.17 19:15:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.07.12 20:35:18 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2012.05.16 11:53:41 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.04.14 17:16:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.04.14 17:16:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.04.14 17:16:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.14 17:16:55 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.14 17:16:55 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.14 17:16:55 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BAD8705-5123-4D3F-A9A1-78866FB97484}: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA60D796-0D88-47F8-AC16-AE36E2FBDE34}: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell - "" = AutoRun

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.16 11:53:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2012.05.16 11:53:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.05.16 11:19:48 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.05.15 21:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.05.15 21:14:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.05.15 11:55:50 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\Laura\Desktop\OTL.exe

[2012.05.12 18:07:00 | 000,000,000 | ---D | C] -- C:\Users\Laura\AppData\Roaming\Malwarebytes

[2012.05.12 18:06:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.05.12 18:06:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.05.12 18:06:22 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.05.12 18:06:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.05.11 13:07:08 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Laura\Desktop\dds.com

[2012.05.10 13:58:10 | 001,544,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.05.10 13:58:06 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.05.10 13:58:04 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.05.10 13:58:04 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.05.07 17:41:06 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Sundermeyer

[2012.04.26 17:12:44 | 000,000,000 | ---D | C] -- C:\Users\Laura\Desktop\radiokiss

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.05.16 15:15:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.05.16 15:15:26 | 1555,537,920 | -HS- | M] () -- C:\hiberfil.sys

[2012.05.16 12:40:16 | 000,000,000 | ---- | M] () -- C:\Users\Public\Documents\report_telephone_pdf.php

[2012.05.16 11:37:31 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.05.16 11:37:31 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.05.16 11:03:03 | 000,458,736 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.15 21:14:16 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.05.15 11:55:59 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Laura\Desktop\OTL.exe

[2012.05.14 10:20:10 | 002,581,704 | ---- | M] () -- C:\Users\Laura\Desktop\IMG_1318.JPG

[2012.05.14 10:19:56 | 002,755,390 | ---- | M] () -- C:\Users\Laura\Desktop\IMG_1317.JPG

[2012.05.14 10:19:48 | 002,664,464 | ---- | M] () -- C:\Users\Laura\Desktop\IMG_1316.JPG

[2012.05.12 18:06:24 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.11 13:09:27 | 000,000,000 | ---- | M] () -- C:\Users\Laura\defogger_reenable

[2012.05.11 13:07:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Laura\Desktop\dds.com

[2012.05.11 13:06:33 | 000,050,477 | ---- | M] () -- C:\Users\Laura\Desktop\Defogger.exe

[2012.05.11 12:45:23 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.05.11 12:45:23 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.05.11 12:45:23 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.05.11 12:45:23 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.05.11 12:45:23 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.05.01 22:33:34 | 000,046,835 | ---- | M] () -- C:\Users\Public\Documents\Trainingsplan_blanko.pdf

 
 ========== Files Created - No Company Name ==========

 

[2012.05.16 12:40:15 | 000,000,000 | ---- | C] () -- C:\Users\Public\Documents\report_telephone_pdf.php

[2012.05.16 11:02:49 | 000,458,736 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.15 21:14:16 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.05.14 10:20:11 | 002,581,704 | ---- | C] () -- C:\Users\Laura\Desktop\IMG_1318.JPG

[2012.05.14 10:19:57 | 002,755,390 | ---- | C] () -- C:\Users\Laura\Desktop\IMG_1317.JPG

[2012.05.14 10:19:49 | 002,664,464 | ---- | C] () -- C:\Users\Laura\Desktop\IMG_1316.JPG

[2012.05.12 18:06:24 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.11 13:09:27 | 000,000,000 | ---- | C] () -- C:\Users\Laura\defogger_reenable

[2012.05.11 13:06:28 | 000,050,477 | ---- | C] () -- C:\Users\Laura\Desktop\Defogger.exe

[2012.05.01 22:33:33 | 000,046,835 | ---- | C] () -- C:\Users\Public\Documents\Trainingsplan_blanko.pdf

[2011.12.09 23:34:18 | 000,000,532 | ---- | C] () -- C:\Windows\eReg.dat

[2011.10.18 09:02:27 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2011.10.18 09:02:27 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2011.08.24 05:21:36 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib

 
 ========== Custom Scans ==========

 
 < :OTL >

 
 < IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} >

 
 < IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC >

 
 < IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} >

 
 < IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC >

 
 < IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie >

Invalid Switch: ie

 
 < IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie >

Invalid Switch: ie

 
 < IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com >

Invalid Switch: www.google.com

 
 < IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp >

Invalid Switch: ?ocid=iehp

 
 < IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie >

Invalid Switch: ie

 
 < IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie >

Invalid Switch: ie

 
 < IE - HKCU\..\URLSearchHook:  - No CLSID value found >

 
 < IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} >

 
 < IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC >

 
 < IE - HKCU\..\SearchScopes\{41F7CB0F-79AB-44C0-BC17-D5707C8990CC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 >

 
 < IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd >

 
 < IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcphp?q={searchTerms}&ch_id=osd >

 
 < IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 >

 
 < IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local >

 
 < FF - prefs.js..browser.search.defaultenginename: "ICQ Search" >

 
 < FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.8&q=" >

 
 < FF - prefs.js..browser.startup.homepage: "hxxp://homitrlz.in" >

 
 < FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=" >

 
 < FF - user.js - File not found >

 
 < [2011.08.19 20:48:20 | 000,002,342 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icq-search.xml >

 
 < [2012.04.14 17:16:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml >

 
 < [2012.04.14 17:16:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml >

 
 < [2012.04.14 17:16:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml >

 
 < [2012.04.14 17:16:55 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml >

 
 < [2012.04.14 17:16:55 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml >

 
 < O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 >

 
 < O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 >

 
 < O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 >

 
 < O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 >

 
 < O32 - HKLM CDRom: AutoRun - 1 >

 
 < O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell - "" = AutoRun >

 
 < O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a >

 
 <  >

 
 < :Files >

 
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

 
 < :Commands >

 
 < [purity] >

 
 < [emptytemp] >
 

< End of report >

--- --- ---
[\code]

okay hier das Ergebnis vom spyware-check:

[code]
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/16/2012 at 04:54 PM

Application Version : 5.0.1148

Core Rules Database Version : 8602
Trace Rules Database Version: 6414

Scan type : Complete Scan
Total Scan Time : 01:15:10

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 541
Memory threats detected : 0
Registry items scanned : 64762
Registry threats detected : 0
File items scanned : 93819
File threats detected : 20

Adware.Tracking Cookie
.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
[\code]

okay hier das Ergebnis vom spyware-check:

[code]
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/16/2012 at 04:54 PM

Application Version : 5.0.1148

Core Rules Database Version : 8602
Trace Rules Database Version: 6414

Scan type : Complete Scan
Total Scan Time : 01:15:10

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 541
Memory threats detected : 0
Registry items scanned : 64762
Registry threats detected : 0
File items scanned : 93819
File threats detected : 20

Adware.Tracking Cookie
.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
[\code]

hier das Ergebnis von Antispyware:

[code]
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/16/2012 at 04:54 PM

Application Version : 5.0.1148

Core Rules Database Version : 8602
Trace Rules Database Version: 6414

Scan type : Complete Scan
Total Scan Time : 01:15:10

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 541
Memory threats detected : 0
Registry items scanned : 64762
Registry threats detected : 0
File items scanned : 93819
File threats detected : 20

Adware.Tracking Cookie
.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]
[\code]

hier das Ergebnis von Antispyware:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 05/16/2012 at 04:54 PM
 

Application Version : 5.0.1148
 

Core Rules Database Version : 8602

Trace Rules Database Version: 6414
 

Scan type : Complete Scan

Total Scan Time : 01:15:10
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned : 541

Memory threats detected : 0

Registry items scanned : 64762

Registry threats detected : 0

File items scanned : 93819

File threats detected : 20
 

Adware.Tracking Cookie

.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.doubleclick.net [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.serving-sys.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.questionmarket.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

accounts.google.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

ad.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.quartermedia.de [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.zanox.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.apmebf.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.webmasterplan.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

.imrworldwide.com [ C:\USERS\LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8E1C4U4R.DEFAULT\COOKIES.SQLITE ]

Den letzten Beitrag konnte ich nicht bearbeiten, deshalb sieht der so komisch aus..

Jetzt die letzten zwei Logfiles:

OTL Logfile:

Code:

OTL logfile created on: 16.05.2012 19:33:51 - Run 3

OTL by OldTimer - Version 3.2.43.0     Folder = C:\Users\Laura\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 0,87 Gb Available Physical Memory | 44,94% Memory free

3,86 Gb Paging File | 2,13 Gb Available in Paging File | 55,18% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 293,95 Gb Total Space | 158,13 Gb Free Space | 53,79% Space Free | Partition Type: NTFS

Drive F: | 298,02 Gb Total Space | 122,68 Gb Free Space | 41,17% Space Free | Partition Type: FAT32

Drive G: | 1,88 Gb Total Space | 0,00 Gb Free Space | 0,22% Space Free | Partition Type: FAT

Drive H: | 61,29 Mb Total Space | 56,89 Mb Free Space | 92,84% Space Free | Partition Type: FAT

 

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.05.16 11:53:41 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

PRC - [2012.05.15 11:55:59 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Laura\Desktop\OTL.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.09.30 09:28:08 | 000,546,464 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe

PRC - [2011.06.06 20:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.01.18 02:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

PRC - [2011.01.18 02:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

PRC - [2009.08.27 18:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.05.16 11:53:41 | 001,952,696 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

MOD - [2011.07.19 15:54:44 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll

MOD - [2011.05.26 13:42:00 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.05.16 11:53:41 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)

SRV - [2011.06.06 20:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2010.03.18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2009.08.27 18:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008.08.07 12:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.05.15 05:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)

DRV:64bit: - [2010.05.11 18:11:40 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2006.09.03 00:53:54 | 000,097,280 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIf.sys -- (BrSerIf)

DRV:64bit: - [2006.06.06 13:45:24 | 000,432,512 | ---- | M] (VM) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbVM31b.sys -- (ZSMC301b)

DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)

DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C2 44 9C 79 3D 56 CC 01  [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.8&q="

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://homitrlz.in"

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.16 11:53:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.06 07:06:53 | 000,000,000 | ---D | M]

 

[2011.07.12 17:53:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laura\AppData\Roaming\mozilla\Extensions

[2012.05.16 18:00:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions

[2011.09.29 16:07:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.07.27 01:38:02 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Laura\AppData\Roaming\mozilla\Firefox\Profiles\8e1c4u4r.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.08.19 20:48:20 | 000,002,342 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icq-search.xml

[2011.08.19 21:14:20 | 000,000,950 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\icqplugin.xml

[2012.03.12 12:26:45 | 000,001,677 | ---- | M] () -- C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\8e1c4u4r.default\searchplugins\startingpage---deutsch.xml

[2012.05.16 15:33:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.07.12 20:35:18 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.05.16 15:33:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}

File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2012.05.16 11:53:41 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.04.14 17:16:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.04.14 17:16:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.04.14 17:16:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.14 17:16:55 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.14 17:16:55 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.14 17:16:55 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BAD8705-5123-4D3F-A9A1-78866FB97484}: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA60D796-0D88-47F8-AC16-AE36E2FBDE34}: DhcpNameServer = 81.14.243.9 212.59.54.180 192.168.1.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell - "" = AutoRun

O33 - MountPoints2\{9722137a-e262-11e0-a016-1c7508c5037a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.16 17:33:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.05.16 17:29:58 | 002,346,904 | ---- | C] (ESET) -- C:\Users\Laura\Desktop\ESETSmartInstaller.exe

[2012.05.16 15:38:27 | 000,000,000 | ---D | C] -- C:\Users\Laura\AppData\Roaming\SUPERAntiSpyware.com

[2012.05.16 15:37:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.05.16 15:37:47 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.05.16 15:37:47 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.05.16 15:33:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.05.16 15:33:15 | 000,476,960 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll

[2012.05.16 15:33:15 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.05.16 15:33:15 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.05.16 15:33:15 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.05.16 11:53:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2012.05.16 11:53:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.05.16 11:19:48 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.05.15 21:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.05.15 21:14:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.05.15 11:55:50 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\Laura\Desktop\OTL.exe

[2012.05.12 18:07:00 | 000,000,000 | ---D | C] -- C:\Users\Laura\AppData\Roaming\Malwarebytes

[2012.05.12 18:06:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.05.12 18:06:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.05.12 18:06:22 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.05.12 18:06:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.05.11 13:07:08 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Laura\Desktop\dds.com

[2012.05.10 13:58:10 | 001,544,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.05.10 13:58:06 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.05.10 13:58:04 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.05.10 13:58:04 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.05.07 17:41:06 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Sundermeyer

[2012.04.26 17:12:44 | 000,000,000 | ---D | C] -- C:\Users\Laura\Desktop\radiokiss

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.05.16 17:22:19 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.05.16 17:22:19 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.05.16 17:22:19 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.05.16 17:22:19 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.05.16 17:22:19 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.05.16 16:32:17 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.05.16 16:32:17 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.05.16 15:37:53 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.05.16 15:33:03 | 000,476,960 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll

[2012.05.16 15:33:03 | 000,472,864 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll

[2012.05.16 15:33:03 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.05.16 15:33:03 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.05.16 15:33:03 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.05.16 15:24:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.05.16 15:24:50 | 1555,537,920 | -HS- | M] () -- C:\hiberfil.sys

[2012.05.16 12:40:16 | 000,000,000 | ---- | M] () -- C:\Users\Public\Documents\report_telephone_pdf.php

[2012.05.15 21:14:16 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.05.15 11:55:59 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Laura\Desktop\OTL.exe

[2012.05.14 10:20:10 | 002,581,704 | ---- | M] () -- C:\Users\Laura\Desktop\IMG_1318.JPG

[2012.05.14 10:19:56 | 002,755,390 | ---- | M] () -- C:\Users\Laura\Desktop\IMG_1317.JPG

[2012.05.14 10:19:48 | 002,664,464 | ---- | M] () -- C:\Users\Laura\Desktop\IMG_1316.JPG

[2012.05.12 18:06:24 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.11 13:09:27 | 000,000,000 | ---- | M] () -- C:\Users\Laura\defogger_reenable

[2012.05.11 13:07:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Laura\Desktop\dds.com

[2012.05.11 13:06:33 | 000,050,477 | ---- | M] () -- C:\Users\Laura\Desktop\Defogger.exe

[2012.05.01 22:33:34 | 000,046,835 | ---- | M] () -- C:\Users\Public\Documents\Trainingsplan_blanko.pdf

 
 ========== Files Created - No Company Name ==========

 

[2012.05.16 15:37:53 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.05.16 12:40:15 | 000,000,000 | ---- | C] () -- C:\Users\Public\Documents\report_telephone_pdf.php

[2012.05.15 21:14:16 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.05.14 10:20:11 | 002,581,704 | ---- | C] () -- C:\Users\Laura\Desktop\IMG_1318.JPG

[2012.05.14 10:19:57 | 002,755,390 | ---- | C] () -- C:\Users\Laura\Desktop\IMG_1317.JPG

[2012.05.14 10:19:49 | 002,664,464 | ---- | C] () -- C:\Users\Laura\Desktop\IMG_1316.JPG

[2012.05.12 18:06:24 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.11 13:09:27 | 000,000,000 | ---- | C] () -- C:\Users\Laura\defogger_reenable

[2012.05.11 13:06:28 | 000,050,477 | ---- | C] () -- C:\Users\Laura\Desktop\Defogger.exe

[2012.05.01 22:33:33 | 000,046,835 | ---- | C] () -- C:\Users\Public\Documents\Trainingsplan_blanko.pdf

[2011.12.09 23:34:18 | 000,000,532 | ---- | C] () -- C:\Windows\eReg.dat

[2011.10.18 09:02:27 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2011.10.18 09:02:27 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2011.08.24 05:21:36 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib

 
 ========== LOP Check ==========

 

[2012.03.20 12:24:25 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\Dropbox

[2011.07.27 01:38:22 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\DVDVideoSoft

[2011.07.27 01:38:01 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.11.05 15:55:47 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\Jens Lorek

[2012.04.17 10:51:11 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\MAGIX

[2011.07.19 20:23:12 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\OpenOffice.org

[2011.09.23 00:01:51 | 000,000,000 | ---D | M] -- C:\Users\Laura\AppData\Roaming\Opera

[2012.04.18 09:08:04 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 16.05.2012 19:33:52 - Run 3

OTL by OldTimer - Version 3.2.43.0     Folder = C:\Users\Laura\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 0,87 Gb Available Physical Memory | 44,94% Memory free

3,86 Gb Paging File | 2,13 Gb Available in Paging File | 55,18% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 293,95 Gb Total Space | 158,13 Gb Free Space | 53,79% Space Free | Partition Type: NTFS

Drive F: | 298,02 Gb Total Space | 122,68 Gb Free Space | 41,17% Space Free | Partition Type: FAT32

Drive G: | 1,88 Gb Total Space | 0,00 Gb Free Space | 0,22% Space Free | Partition Type: FAT

Drive H: | 61,29 Mb Total Space | 56,89 Mb Free Space | 92,84% Space Free | Partition Type: FAT

 

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1F862838-AE32-47CF-B4ED-059EBCAEF999}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{1FBD4F55-FC84-4529-88E2-8CF63BEECB7A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{256552DA-7F11-43DB-A690-8C4DF3C0C729}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{61AD3D46-EB64-4218-AC29-7398A23C4A7D}" = rport=139 | protocol=6 | dir=out | app=system | 

"{6483ABCA-E11C-47F7-8338-7E0D4762D4F2}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{65BFABB6-8B89-411E-94A9-97DC0488C532}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{6EB8E10C-7EB6-486D-B91C-3FE5499572E1}" = rport=138 | protocol=17 | dir=out | app=system | 

"{704B69E3-B2A2-4786-A37B-7DB76FE96036}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{72D7825D-CB99-47EB-A742-2243ACD0BC1E}" = lport=139 | protocol=6 | dir=in | app=system | 

"{7942A3CA-D80C-4E7F-8216-02A15B59586A}" = rport=445 | protocol=6 | dir=out | app=system | 

"{7DA81C41-66CB-41F7-BC1F-B9F45D01C444}" = lport=138 | protocol=17 | dir=in | app=system | 

"{8ABE3C83-9E3A-4860-894D-212E7080C27A}" = lport=445 | protocol=6 | dir=in | app=system | 

"{951DEE88-ECC8-4358-B921-A601699DE270}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{967E7246-FFA8-4D38-B471-54266EC7A980}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A0F52E19-B80F-4DA0-9C91-80DEB027B99C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{AF2C7C0B-779D-46DC-B268-13D1CDA043E7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{CC17276F-CCD6-4A49-99CC-5047ADBD9599}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{CF2D822B-7FF3-4D6B-A702-21B9DF496A52}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D47F5F92-488D-49AE-861D-010742D36DE9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{F9B31A9A-8627-4BD5-8BDD-C410820DAC45}" = lport=137 | protocol=17 | dir=in | app=system | 

"{FF81C3AE-CF54-4658-BC88-DD88C5640C63}" = rport=10243 | protocol=6 | dir=out | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0C28168D-0049-4F71-8081-1D6609325200}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{0DDBA146-9FC6-45D9-A000-FF62DC42BA5E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{2928AE16-3D74-4DE5-BADF-213416B3ECD1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{34165640-296C-4C74-A304-9D152C83F71E}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{422CF321-9A3B-4835-B508-A9441314A21B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{4F561FDC-36A9-41EE-8107-CA7C5A2BD019}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{5D40123C-6616-4354-9428-6CDFB991F192}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{5ED20B88-D238-4F5C-8649-4E4770DA2317}" = protocol=6 | dir=out | app=system | 

"{61A96BDA-305B-44D2-8ACE-5DA3D981A5F4}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{61AFA832-0495-4629-85E9-41C5B016EFBE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{63882B5C-7BD3-4442-B17E-EDB31AAC4984}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{69D6E152-C1D6-43AA-852B-34C1E47F49E5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{727FECE8-2C9F-483C-82B8-33807233411C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{7305FD5F-2E9F-447F-8726-59AA012FED96}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{7C23BC60-4063-47D0-A09E-808473623499}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{8D89CE9F-1284-4588-A501-5FE109C07768}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{9F3F2814-4995-47DB-AEC3-3D23019F7A61}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{A3C3F169-C4C7-428E-8AB9-C14B7C90BA50}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{C62C7176-17B4-4C47-8049-A74B0FDF6394}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{CD200253-337E-4B35-9E01-E85DB329194E}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{D15A9199-3338-41A2-9588-3EB97658F37B}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 

"{E85659F3-B1B5-41C1-B268-7CB583ACD982}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{F11758D4-F21B-42C7-900D-BC04C58EAD59}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{F25F8542-06BB-4117-82D5-08352F83B709}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{FE88DE3C-9550-4B25-90BB-A6399B0739BF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"TCP Query User{5C7DEE71-1190-4F68-A253-F2D61944DBFF}C:\program files (x86)\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 

"UDP Query User{FB6ED38B-C7CB-4745-B58C-C977D6439D56}C:\program files (x86)\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers

"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support

"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010

"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010

"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller

"{BCF07271-A853-4D3A-B668-4B752174CAA8}" = iTunes

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{F26DE123-C491-4D8C-BC86-FDF604F00226}" = Broadcom Gigabit Integrated Controller

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"08116AAA5079D141DE9F37C0804CDE8B00E3F4AD" = Windows-Treiberpaket - Intel (NETw5s64) net  (05/31/2010 13.2.1.5)

"60F79568B15F277EAF37083939CFCC51ADCD2906" = Windows-Treiberpaket - Intel (NETw5v64) net  (05/31/2010 13.2.1.5)

"Broadcom 802.11 Network Adapter" = Broadcom 802.11 Network Adapter

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser

"{1DF3A435-4AC8-4DBB-A916-F445708EF6DB}" = MAGIX Screenshare

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2

"{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}" = TubeBox!

"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 32

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program

"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition

"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe

"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE

"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{735AA36F-9A9E-477B-BC74-9E6AF1A8A6D8}" = MAGIX Music Maker MX Premium Download-Version

"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0

"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime

"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010

"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars

"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0

"{C0CDE373-F031-49D1-A509-3471BD69A7AE}" = MAGIX Speed burnR (MSI)

"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update

"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3

"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0

"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2

"AVS Update Manager_is1" = AVS Update Manager 1.0

"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4

"AVS4YOU Video Converter 7_is1" = AVS Video Converter 8

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722

"MAGIX_MSI_mm18dlx" = MAGIX Music Maker MX Premium Download-Version

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH

"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Office14.SingleImage" = Microsoft Office Home and Student 2010

"Picasa 3" = Picasa 3

"schobuk_is1" = schobuk 2.0

"Tomb Raider: Legend" = Tomb Raider: Legend 1.2

"VLC media player" = VLC media player 1.1.11

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"FoxTab AVI Converter" = FoxTab AVI Converter

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 16.05.2012 05:19:50 | Computer Name = Laura-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,

 Zeitstempel: 0x4ec4aa8e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000020a4a

ID

 des fehlerhaften Prozesses: 0x3dc  Startzeit der fehlerhaften Anwendung: 0x01cd3342b48af677

Pfad

 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 495f3fda-9f38-11e1-a0a0-1c7508c5037a

 

Error - 16.05.2012 05:24:21 | Computer Name = Laura-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,

 Zeitstempel: 0x4ec4aa8e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000020a4a

ID

 des fehlerhaften Prozesses: 0x2c8  Startzeit der fehlerhaften Anwendung: 0x01cd3342b405a968

Pfad

 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: eb075630-9f38-11e1-a0a0-1c7508c5037a

 

Error - 16.05.2012 05:30:16 | Computer Name = Laura-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.05.2012 05:31:32 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.05.2012 09:17:18 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.05.2012 09:25:06 | Computer Name = Laura-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.05.2012 09:26:43 | Computer Name = Laura-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 16.05.2012 11:29:59 | Computer Name = Laura-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Laura\Desktop\ESETSmartInstaller.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 16.05.2012 11:32:57 | Computer Name = Laura-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Laura\Desktop\ESETSmartInstaller.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 16.05.2012 11:33:03 | Computer Name = Laura-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Laura\Desktop\ESETSmartInstaller.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

[ Media Center Events ]

Error - 12.10.2011 16:34:07 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 22:34:07 - Fehler beim Herstellen der Internetverbindung.  22:34:07 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 16:34:21 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 22:34:12 - Fehler beim Herstellen der Internetverbindung.  22:34:12 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 17:34:42 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 23:34:42 - Fehler beim Herstellen der Internetverbindung.  23:34:42 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 17:34:54 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 23:34:48 - Fehler beim Herstellen der Internetverbindung.  23:34:48 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 18:35:12 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 00:35:12 - Fehler beim Herstellen der Internetverbindung.  00:35:12 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 18:35:22 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 00:35:17 - Fehler beim Herstellen der Internetverbindung.  00:35:17 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 19:35:39 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 01:35:39 - Fehler beim Herstellen der Internetverbindung.  01:35:39 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.10.2011 19:35:49 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 01:35:44 - Fehler beim Herstellen der Internetverbindung.  01:35:44 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.10.2011 11:17:35 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 17:17:35 - Fehler beim Herstellen der Internetverbindung.  17:17:35 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.10.2011 11:17:58 | Computer Name = Laura-PC | Source = MCUpdate | ID = 0

Description = 17:17:40 - Fehler beim Herstellen der Internetverbindung.  17:17:40 

-     Serververbindung konnte nicht hergestellt werden..  

 

[ System Events ]

Error - 16.05.2012 09:16:45 | Computer Name = Laura-PC | Source = DCOM | ID = 10005

Description = 

 

Error - 16.05.2012 09:16:45 | Computer Name = Laura-PC | Source = DCOM | ID = 10005

Description = 

 

Error - 16.05.2012 09:17:51 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.05.2012 09:17:51 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.05.2012 09:17:51 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.05.2012 09:22:51 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.05.2012 09:22:51 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.05.2012 09:22:51 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.05.2012 09:25:02 | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Avira Upgrade Service" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%2

 

Error - 16.05.2012 12:38:09 | Computer Name = Laura-PC | Source = DCOM | ID = 10010

Description = 

 

 

< End of report >

--- --- ---

SOO ein RIESENGROßES DANKESCHÖN! Es scheint wieder alles zu funktionieren.. Alle Daten sind wieder da - das hätte ich wirklich nie gedacht! Ich freue mich total, denn ich war drauf und dran zu einer Spezialistin zu gehen, was sicherlich viel Geld gekostet hätte..
DANKE!

Aber eine andere Frage:
Kannst du einen guten Viren/Trojaner-Schutz empfehlen, damit ich mir solche Dinger nicht mehr einfange? Ich hatte früher mal Kaspersky, aber jetzt nur noch das kostenfreie Antivir und anscheinend hat das nichts genützt.

Zitat:

Zitat von Laury (Beitrag 829320)

Aber eine andere Frage:
Kannst du einen guten Viren/Trojaner-Schutz empfehlen, damit ich mir solche Dinger nicht mehr einfange? Ich hatte früher mal Kaspersky, aber jetzt nur noch das kostenfreie Antivir und anscheinend hat das nichts genützt.

In unserer "modernen Zeit", die diversen Malwarearten deutlich stärker vertreten, als noch vor ein paar Jahren. Das ist eben seit Jahren kein Geheimnis mehr, die Antivirusprodukte können da nicht ganz mithalten bzw gegen neue Art von Schadprogrammen eigentlich machtlos sind. Die Meinungen gehen auseinander, Kauf oder Free Version.
Aus meiner eigenen Erfahrung heraus kann ich sagen (schließlich darf man davon ausgehen), dass ein Virenscanner einen Malware Befall <Ernstfalls> nicht verhindern kann.
Ein Anti-Viren- und Anti-Spyware-Programm bzw.Spezial-Tool, kann nur vor jenen Viren schützen bzw.entfernen, die es auch kennt. Leider sehr oft Virenprogrammierer sind schneller auf dem Markt mit ihrem Produkt als Antivirenprogrammierer mit dem Gegenmittel.Es ist daher ganz natürlich, dass vom Zeitpunkt des Auftretens eines neuen Virus eine bestimmte Zeit vergeht, bis der Antivirenhersteller ein Gegenmittel in Form von Virendefinitionsfiles bereithält.;)
Außerdem der Angreifer kann sich jeder Zeit erhöhte Rechte verschaffen, Antiviren-, Firewall- und andere Schutzprogramme einfach abschalten...
Also ein Virenscanner allein reicht nicht aus, jeder einzelne Nutzer kann/muss/soll seinen teil dazu beitragen, die Sicherheit von Windows noch einiges zu verbessern.

► die Schritte 6. und 7.?:-> http://www.trojaner-board.de/115010-...tml#post829077

Zitat:

Zitat von Laury (Beitrag 829199)

Okay diesmal hats geklappt - super!

wo ist das OTL-Protokoll?
Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

Zitat:

:\_OTL\Moved Files
In den meisten Fällen wird dies C:\_OTL\Moved Files sein

Okay, also könnte man z.B. mit dem SuperAntiSpyware mal öfters einen Check machen?

Schritt 6+7 habe ich durchgeführt, da waren 20 Dateien betroffen, von einem win32 ähnlichen Wurm oder so. Gabs davon auch ein Protokoll oder Log-File oder so?

aber oben ist doch das OTL-Protokoll?

Ich habe jetzt aber ein anderes Problem und zwar sind jetzt ein paar Ordner (Dokumente und Einstellungen) "verschlossen", wenn ich öffnen will, steht dort "Zugriff verweigert" und andere sind quasi "unsichtbar"..

so eine unzuverlässige Arbeit, man muss nur 100 mal nachfragen!

Zitat:

Zitat von kira (Beitrag 829429)

wo ist das OTL-Protokoll?
Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:
:\_OTL\Moved Files
In den meisten Fällen wird dies C:\_OTL\Moved Files sein

schau nach dem Datum! nachdem:-> http://www.trojaner-board.de/115010-...tml#post829077

Zitat:

Schritt 6+7 habe ich durchgeführt, da waren 20 Dateien betroffen, von einem win32 ähnlichen Wurm oder so. Gabs davon auch ein Protokoll oder Log-File oder so?

von SUPERAntiSpyware oder von Eset Online Scanner? solltest die Scanprotokolle von beide Programme speichern und mir posten!

Zitat:

aber oben ist doch das OTL-Protokoll?

Nein! das ist ein neues OTL-Log! das letzte OTL-Fix-Log sollst mir posten! nämlich ich glaube nicht dass Du richtig wenn überhaupt ausgeführt hast, weil ja hat sich nichts geändert!

Zitat:

Ich habe jetzt aber ein anderes Problem und zwar sind jetzt ein paar Ordner (Dokumente und Einstellungen) "verschlossen", wenn ich öffnen will, steht dort "Zugriff verweigert" und andere sind quasi "unsichtbar"..

was heißt "verschlossen"?
Wie heißen die Ordner?
wie und welche sind unsichtbar?

Ich weiß immer noch nicht, wie ich das Problem beheben kann.. ich sehe bei einigen Ordnern immer noch das Schloss und der ZUgriff wird mir verweigert, aber bei anderen sehe ich es, kann sie aber trotzdem öffnen.. und wie gesagt mache sind hell also quasi unsichtbar.