Trojaner-Board - nach Download bei serienjunkies.org PC friert ein

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - nach Download bei serienjunkies.org PC friert ein (https://www.trojaner-board.de/127306-download-serienjunkies-org-pc-friert.html)

nach Download bei serienjunkies.org PC friert ein

Hallo Board Leute,

folgender Sachverhalt:
neulich habe ich mir bei serienjunkies.org eine Staffel einer Serie runtergeladen und seitdem spinnt der PC ein wenig, er friert ein.
Einmal dachte ich wegen Überlastung, aber nach einem Neustart und gleicher Programmausführung wieder eingefrohren.
Heute halt gerade das gleiche, aber gleich nach dem hochfahren war alles dicht. Nur die Maus konnte ich noch bewegen und die Icons auf dem Desktop hervorheben aber nicht öffnen. Taskleiste dicht, Tastatur geht nicht.
Neustart mit Resettaste am PC - Beim hochfahren erscheint ein screen mit "Windows Fehlermeldung" wo ich dann zur Auswahl habe das ich im "abgesicherten Modus" hochfahren kann. Normal hochgefahren und wenig später wieder alles tot. Nach diesem Neustart lief er dann ganz normal.?
Auf einer anderen Partition liegt Windows XP wo das gleiche Problem vorliegt, wenn ich damit hochfahre.
Mögen die beiden sich nicht, sind ja auf verschiedenen Partitionen.
Oder ist durch die downloads doch noch was reingekommen? :stirn:
beste grüße

Hi,

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

%windir%\installer\*. /5

%localappdata%\*. /5

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

erstmal OTL.txt:

Code:

OTL logfile created on: 24.11.2012 18:13:15 - Run 2

OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Tobano\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,75 Gb Total Physical Memory | 6,42 Gb Available Physical Memory | 82,85% Memory free

15,50 Gb Paging File | 13,98 Gb Available in Paging File | 90,22% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 115,82 Gb Total Space | 36,93 Gb Free Space | 31,88% Space Free | Partition Type: NTFS

Drive D: | 931,51 Gb Total Space | 510,45 Gb Free Space | 54,80% Space Free | Partition Type: NTFS

Drive E: | 2,93 Gb Total Space | 0,36 Gb Free Space | 12,44% Space Free | Partition Type: FAT32

Unable to calculate disk information.

Drive H: | 114,03 Gb Total Space | 105,73 Gb Free Space | 92,72% Space Free | Partition Type: NTFS

 

Computer Name: | User Name: Tobano | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_110_ActiveX.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Software Antivirus\AVIRA\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Users\Tobano\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (PSI_SVC_2) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)

SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.)

DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)

DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)

DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)

DRV:64bit: - (epmntdrv) -- C:\Windows\SysNative\epmntdrv.sys ()

DRV:64bit: - (EuGdiDrv) -- C:\Windows\SysNative\EuGdiDrv.sys ()

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (npf) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)

DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.)

DRV - (epmntdrv) -- C:\Windows\SysWOW64\epmntdrv.sys ()

DRV - (EuGdiDrv) -- C:\Windows\SysWOW64\EuGdiDrv.sys ()

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}

IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}

IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\..\SearchScopes\{873607B3-27D9-4788-9DFE-21C44E2D4E2E}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SPLBR2&pc=SPLH

IE - HKCU\..\SearchScopes\{9BC79249-C48D-4ea6-9EA7-25A41BE6853A}: "URL" = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A4067623346&ie=UTF-8&q={searchTerms}&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4067623346

IE - HKCU\..\SearchScopes\{C8F89879-24F9-43f7-BCF7-2216B7EE180F}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=STDVM

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll File not found

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll File not found

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\Software Video DVD\VLC Media Player\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

[2012.04.25 18:08:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found

O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)

O4 - HKCU..\Run: [Uhteuw] C:\Users\Tobano\AppData\Roaming\Epvay\cide.exe File not found

O8:64bit: - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8:64bit: - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8:64bit: - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)

O16 - DPF: {DB28CF23-0083-40B5-BF63-69925D672385} hxxp://www.nero.com/doc/NeroVersionChecker.cab (CNeroSerialChecker Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A4D6516-D118-469E-B755-CE34A2D82223}: DhcpNameServer = 192.168.1.1

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (systempropertiesperformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

 

MsConfig:64bit - StartUpFolder: C:^Users^Tobano^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tintenwarnungen überwachen - HP Photosmart 5510 series.lnk - C:\Windows\SysNative\RunDll32.exe - (Microsoft Corporation)

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: BCU - hkey= - key= - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)

MsConfig:64bit - StartUpReg: Corel File Shell Monitor - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: emsisoft anti-malware - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)

MsConfig:64bit - StartUpReg: LexwareInfoService - hkey= - key= - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)

MsConfig:64bit - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)

MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

MsConfig:64bit - StartUpReg: StartCCC - hkey= - key= - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: TrayServer - hkey= - key= - C:\Program Files (x86)\MAGIX\Video_deluxe_17\TrayServer.exe (MAGIX AG)

MsConfig:64bit - StartUpReg: Uhteuw - hkey= - key= -  File not found

MsConfig:64bit - State: "startup" - Reg Error: Key error.

MsConfig:64bit - State: "services" - Reg Error: Key error.

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.11.21 20:30:38 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2012.11.20 20:45:20 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Desktop\mbar-1.01.0.1009

[2012.11.13 22:36:05 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Documents\Hamburg Energie

[2012.11.13 19:17:36 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2012.11.12 18:27:29 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2012.11.11 19:38:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2012.11.08 14:12:05 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\Ytliri

[2012.11.08 14:12:05 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\Ydis

[2012.11.08 14:12:05 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\Epvay

[2012.10.28 17:05:25 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Documents\ZPS14

[2012.10.28 17:05:25 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\Zoner

[2012.10.28 17:05:25 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Local\Zoner

[2012.10.28 17:05:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Zoner

[2012.10.28 17:05:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zoner Photo Studio 14

[2012.10.28 17:03:24 | 000,000,000 | ---D | C] -- C:\Downloads

[2012.10.28 15:57:59 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\PTGui

[2012.10.28 15:57:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PTGui

[2012.10.28 12:30:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smoky City Design

[2012.10.28 12:29:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Software für Photograohy

[2012.10.28 12:22:46 | 000,000,000 | ---D | C] -- C:\Setup

[2012.10.27 19:59:47 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\PanoramaStudio2Pro

[2012.10.27 19:59:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PanoramaStudio 2 Pro

[2012.10.27 19:59:09 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Neuer Ordner

[2012.10.27 17:00:24 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Local\ElevatedDiagnostics

[2012.05.24 17:24:42 | 000,465,264 | ---- | C] (Corel) -- C:\Program Files (x86)\Common Files\AppFramework.dll

[2012.05.24 17:24:42 | 000,332,144 | ---- | C] (Corel) -- C:\Program Files (x86)\Common Files\MediaOrganizer.dll

[2012.05.24 17:24:42 | 000,033,136 | ---- | C] (Corel-V1E) -- C:\Program Files (x86)\Common Files\FlickrProvider.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.11.24 18:14:22 | 000,015,760 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.11.24 18:14:22 | 000,015,760 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.11.24 18:11:03 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.11.24 18:11:03 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.11.24 18:11:03 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.11.24 18:11:03 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.11.24 18:11:03 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.11.24 18:06:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.11.24 18:06:03 | 1945,608,191 | -HS- | M] () -- C:\hiberfil.sys

[2012.11.23 22:19:42 | 000,108,008 | ---- | M] () -- C:\Windows\SysNative\WindowsAccessBridge-64.dll

[2012.11.23 22:19:41 | 000,916,456 | ---- | M] () -- C:\Windows\SysNative\deployJava1.dll

[2012.11.21 20:30:25 | 000,001,140 | ---- | M] () -- C:\Users\Tobano\Desktop\Windows Update Troubleshooting Info.lnk

[2012.11.21 19:38:18 | 000,410,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.11.20 20:44:50 | 012,961,620 | ---- | M] () -- C:\Users\Tobano\Desktop\mbar-1.01.0.1009.zip

[2012.11.12 22:19:39 | 000,255,950 | ---- | M] () -- C:\Users\Tobano\Scan_Exmatrikulationsbescheinigung_Klapp.pdf

[2012.11.12 10:42:49 | 000,001,469 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.11.09 22:26:25 | 000,007,619 | ---- | M] () -- C:\Users\Tobano\AppData\Local\Resmon.ResmonCfg

[2012.11.09 22:25:41 | 000,000,952 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys

[2012.10.29 16:41:07 | 000,001,220 | ---- | M] () -- C:\Users\Public\Desktop\CloneDVD2.lnk

[2012.10.29 16:40:38 | 000,001,180 | ---- | M] () -- C:\Users\Public\Desktop\AnyDVD.lnk

[2012.10.28 17:05:20 | 000,002,210 | ---- | M] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.10.28 15:57:30 | 000,001,100 | ---- | M] () -- C:\Users\Public\Desktop\PTGui.lnk

[2012.10.27 19:59:45 | 000,001,349 | ---- | M] () -- C:\Users\Public\Desktop\PanoramaStudio 2 Pro.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.11.23 22:19:46 | 000,108,008 | ---- | C] () -- C:\Windows\SysNative\WindowsAccessBridge-64.dll

[2012.11.21 20:30:25 | 000,001,140 | ---- | C] () -- C:\Users\Tobano\Desktop\Windows Update Troubleshooting Info.lnk

[2012.11.21 19:43:04 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf

[2012.11.20 20:44:50 | 012,961,620 | ---- | C] () -- C:\Users\Tobano\Desktop\mbar-1.01.0.1009.zip

[2012.11.17 14:03:46 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf

[2012.11.12 22:19:39 | 000,255,950 | ---- | C] () -- C:\Users\Tobano\Scan_Exmatrikulationsbescheinigung_Klapp.pdf

[2012.11.09 22:26:25 | 000,007,619 | ---- | C] () -- C:\Users\Tobano\AppData\Local\Resmon.ResmonCfg

[2012.10.28 17:05:20 | 000,002,210 | ---- | C] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.10.28 15:57:30 | 000,001,100 | ---- | C] () -- C:\Users\Public\Desktop\PTGui.lnk

[2012.10.27 19:59:45 | 000,001,349 | ---- | C] () -- C:\Users\Public\Desktop\PanoramaStudio 2 Pro.lnk

[2012.10.18 17:47:17 | 005,454,636 | ---- | C] () -- C:\Users\Tobano\Handbuch_pk_Alice_Modem_WLAN_1121.pdf

[2012.05.24 17:24:42 | 000,402,800 | ---- | C] () -- C:\Program Files (x86)\Common Files\facebook.dll

[2012.05.24 17:24:42 | 000,148,177 | ---- | C] () -- C:\Program Files (x86)\Common Files\BookViewer.xap

[2012.05.24 17:24:42 | 000,130,416 | ---- | C] () -- C:\Program Files (x86)\Common Files\PluginCommon.dll

[2012.05.22 21:15:50 | 000,000,952 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2012.05.07 13:24:59 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit.INI

[2012.04.17 20:47:44 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2012.04.12 14:35:56 | 000,000,083 | -HS- | C] () -- C:\ProgramData\.zreglib

[2012.04.12 12:59:21 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe

[2012.04.12 12:59:21 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll

[2012.04.12 12:59:20 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe

[2012.04.12 12:59:20 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys

[2012.04.12 12:59:20 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys

[2012.04.12 12:24:55 | 000,000,262 | ---- | C] () -- C:\Windows\ULEAD32.INI

[2012.04.05 20:31:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2012.04.05 20:27:09 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.02.11 22:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll

 
 ========== LOP Check ==========

 

[2012.06.11 11:31:48 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Ashampoo

[2012.04.12 11:32:22 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Canon

[2012.11.17 14:06:52 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Epvay

[2012.04.27 15:20:56 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\FileZilla

[2012.08.03 12:14:59 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\GrabPro

[2012.05.31 14:08:07 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Lexware

[2012.05.16 20:20:23 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\MAGIX

[2012.08.03 12:14:56 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\OpenCandy

[2012.05.24 17:14:09 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\OpenOffice.org

[2012.10.28 17:04:16 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Orbit

[2012.10.27 20:26:40 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\PanoramaStudio2Pro

[2012.04.25 18:35:23 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\ProgSense

[2012.10.28 16:49:20 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\PTGui

[2012.04.12 13:20:21 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Ulead Systems

[2012.11.08 14:12:05 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Ydis

[2012.11.17 14:05:36 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Ytliri

[2012.10.28 17:05:25 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Roaming\Zoner

[2012.09.13 21:55:29 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2012.11.08 14:12:24 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2012.06.25 16:21:04 | 000,000,000 | ---D | M] -- C:\$WINDOWS.~BT

[2012.04.05 18:16:32 | 000,000,000 | ---D | M] -- C:\ATI

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2012.04.05 17:54:29 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2012.10.28 17:03:24 | 000,000,000 | ---D | M] -- C:\Downloads

[2012.09.06 20:28:48 | 000,000,000 | ---D | M] -- C:\NST

[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.11.11 19:46:55 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.11.20 17:55:39 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2012.10.28 17:05:25 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2012.04.05 17:54:29 | 000,000,000 | -HSD | M] -- C:\Programme

[2012.04.05 17:54:30 | 000,000,000 | -HSD | M] -- C:\Recovery

[2012.11.12 18:27:29 | 000,000,000 | -HSD | M] -- C:\RECYCLER

[2012.11.06 22:30:13 | 000,000,000 | ---D | M] -- C:\Setup

[2012.11.24 18:14:27 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012.04.05 17:54:35 | 000,000,000 | R--D | M] -- C:\Users

[2012.11.21 20:30:38 | 000,000,000 | ---D | M] -- C:\Windows

[2012.08.02 10:20:10 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < %windir%\installer\*. /5 >

[2012.11.23 22:19:41 | 000,000,000 | ---D | M] -- C:\Windows\installer\{26A24AE4-039D-4CA4-87B4-2F86417009FF}

 
 < %localappdata%\*. /5 >

[2012.11.19 22:54:57 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Local\Corel

[2012.11.24 17:00:42 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Local\Diagnostics

[2012.11.24 18:12:49 | 000,000,000 | ---D | M] -- C:\Users\Tobano\AppData\Local\Temp

 
 <           >
 

< End of report >

die Extra.txt habe ich jetzt nicht gefunden, wo finde ich sie denn?

jetzt aswMBR:

Code:

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software

Run date: 2012-11-24 19:10:44

-----------------------------

19:10:44.297    OS Version: Windows x64 6.1.7601 Service Pack 1

19:10:44.297    Number of processors: 4 586 0x503

19:10:44.298    ComputerName: MESLIEN-INK  UserName: Tobano

19:10:45.191    Initialize success

19:10:55.539    AVAST engine defs: 12112400

19:11:03.044    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

19:11:03.049    Disk 0 Vendor: ST3250823AS 3.03 Size: 238475MB BusType: 3

19:11:03.056    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-2

19:11:03.062    Disk 1 Vendor: ST31000528AS CC38 Size: 953869MB BusType: 3

19:11:03.081    Disk 0 MBR read successfully

19:11:03.084    Disk 0 MBR scan

19:11:03.090    Disk 0 Windows XP default MBR code

19:11:03.102    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

19:11:03.117    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       118598 MB offset 206848

19:11:03.124    Disk 0 Partition - 00     0F Extended LBA            119773 MB offset 243095580

19:11:03.146    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       116769 MB offset 243095643

19:11:03.154    Disk 0 Partition - 00     05     Extended              3004 MB offset 482239170

19:11:03.179    Disk 0 Partition 4 00     0B        FAT32 MSWIN4.1     3004 MB offset 482239233

19:11:03.262    Disk 0 scanning C:\Windows\system32\drivers

19:11:17.533    Service scanning

19:11:41.492    Modules scanning

19:11:41.515    Disk 0 trace - called modules:

19:11:41.550    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys 

19:11:41.556    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80076ba060]

19:11:41.563    3 CLASSPNP.SYS[fffff880019a043f] -> nt!IofCallDriver -> [0xfffffa80075dc9b0]

19:11:41.569    5 ACPI.sys[fffff88000f087a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80076af060]

19:11:44.094    AVAST engine scan C:\Windows

19:11:46.977    AVAST engine scan C:\Windows\system32

19:16:10.461    AVAST engine scan C:\Windows\system32\drivers

19:16:24.373    AVAST engine scan C:\Users\Tobano

19:25:48.279    AVAST engine scan C:\ProgramData

19:30:09.734    Scan finished successfully

19:32:13.131    Disk 0 MBR has been saved successfully to "C:\Users\Tobano\Desktop\MBR.dat"

19:32:13.136    The log file has been saved successfully to "C:\Users\Tobano\Desktop\aswMBR.txt"

Nicht schlimm, die erstellen wir nachher neu. deinstalliere mal Antivir, is ne Adware-Schleuder, und installiere Avast.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die Endbenutzer-Lizenz.
Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls etwas schief geht.
Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es eine Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

ein kurzes Hinzufügen von nem Screen von mir.
Dieses Error kam die letzten Tage 3x vor !!
Kann damit leider nichts anfangen... :crazy:

ADW Cleaner:

Code:

# AdwCleaner v1.801 - Logfile created 11/25/2012 at 16:39:28

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Tobano - MESLIEN-INK

# Boot Mode : Normal

# Running from : C:\Users\Tobano\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Users\Tobano\AppData\Roaming\OpenCandy

Folder Deleted : C:\Program Files (x86)\Software
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

[x64] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

*************************
 

AdwCleaner[R5].txt - [1561 octets] - [25/11/2012 16:33:57]

AdwCleaner[S1].txt - [1313 octets] - [25/11/2012 16:39:28]
 

########## EOF - C:\AdwCleaner[S1].txt - [1441 octets] ##########

Achtung Hinweis:

Nach dem Neustart von ADW war es wieder soweit.
Der Log.txt kam noch und dann war er wieder eingefrohren :glaskugel2:
RESET!

Problem mit COMBO:
Keine txt unter C dafür der Ordner Qoobox !! Kann der wieder weg?
Während des durchlaufes kam eine Warnmeldung, darin hies es "Continue with next file" , das ganze 12 mal (konnte wohl was nicht lesen / finden). Letzte Meldung "OK" und alles schloss sich bis auf das ADW log. Neustart.

Combofix vom Desktop löschen, nur das, und neu laden, dann wieder laufen lassen.

sagt dir mein Screen was..... oder bist Du nur für Trojaner Scans zuständig.

Bin zuletzt diese Sache durchgelaufen -->>

http://www.trojaner-board.de/121001-...ntfernt-2.html

:sword2:

Ich möchte erstmal Malware ausschliessen wegen der Fehlermeldung, also bitte Combofix laufen lassen. Wenn das durch ist kümmern wir uns um Deinen Screen :)

So, während des arbeitens mit PaintShop Photo, PC wieder abgeschmiert.
Habe dann mit dem Befehl msconfig die Systemkonfiguiration aufgerufen und habe im Reiter Systemstart folgendes entdeckt:

[Uhteuw] C:\Users\Tobano\AppData\Roaming\Epvay\cide.exe :pfui::pfui::pfui:

Ist das ein Bösling oder wie. Bei Google finde ich auch nur englisches darüber.
Ich glaub das diese exe die Ursache ist..... oder

Wenn ich jetzt das Zielverzeichniss öffne, ist der Ordner "...\Epvay" leer !!!!

Ich poste die Anleitung zu Combofix ja auch nicht aus Spass....

Code:

ComboFix 12-11-26.02 - Tobano 04.12.2012  20:44:14.2.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.7935.6361 [GMT 1:00]

ausgeführt von:: c:\users\Tobano\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Vorheriger Suchlauf -------

.

c:\users\Tobano\AppData\Roaming\Ydis

c:\users\Tobano\AppData\Roaming\Ydis\unek.yku

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\wpcap.dll

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NPF

-------\Service_npf

-------\Legacy_NPF

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-11-04 bis 2012-12-04  ))))))))))))))))))))))))))))))

.

.

2012-12-04 19:49 . 2012-12-04 19:49        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-12-04 18:25 . 2012-11-19 00:01        9125352        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D6576AEF-C023-4B16-92DA-0663C942753D}\mpengine.dll

2012-12-03 20:52 . 2012-12-03 20:52        --------        d-----w-        c:\users\Tobano\AppData\Roaming\Haufe

2012-12-03 20:52 . 2012-12-03 20:52        --------        d-----w-        c:\users\Tobano\AppData\Local\Haufe

2012-12-03 20:27 . 2012-12-03 21:07        --------        d-----w-        c:\programdata\BTrieve

2012-12-03 20:27 . 2012-12-03 20:27        --------        d-----w-        c:\program files (x86)\Lexware

2012-12-02 18:22 . 2012-12-02 18:22        --------        d-----w-        c:\users\Tobano\Neuer Ordner (2)

2012-11-26 16:16 . 2012-11-26 16:16        --------        d-----w-        c:\program files (x86)\Common Files\Java

2012-11-26 16:16 . 2012-11-26 16:15        821736        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2012-11-26 16:16 . 2012-11-26 16:15        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-11-23 21:19 . 2012-11-23 21:19        108008        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll

2012-11-21 18:42 . 2012-07-26 07:46        2560        ----a-w-        c:\windows\system32\drivers\de-DE\wdf01000.sys.mui

2012-11-21 18:42 . 2012-07-26 04:55        785512        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys

2012-11-21 18:42 . 2012-07-26 04:55        54376        ----a-w-        c:\windows\system32\drivers\WdfLdr.sys

2012-11-21 18:42 . 2012-07-26 02:36        9728        ----a-w-        c:\windows\system32\Wdfres.dll

2012-11-17 13:03 . 2012-07-26 02:26        87040        ----a-w-        c:\windows\system32\drivers\WUDFPf.sys

2012-11-17 13:03 . 2012-07-26 02:26        198656        ----a-w-        c:\windows\system32\drivers\WUDFRd.sys

2012-11-17 13:03 . 2012-07-26 03:08        229888        ----a-w-        c:\windows\system32\WUDFHost.exe

2012-11-17 13:03 . 2012-07-26 03:08        84992        ----a-w-        c:\windows\system32\WUDFSvc.dll

2012-11-17 13:03 . 2012-07-26 03:08        744448        ----a-w-        c:\windows\system32\WUDFx.dll

2012-11-17 13:03 . 2012-07-26 03:08        45056        ----a-w-        c:\windows\system32\WUDFCoinstaller.dll

2012-11-17 13:03 . 2012-07-26 03:08        194048        ----a-w-        c:\windows\system32\WUDFPlatform.dll

2012-11-11 18:38 . 2012-11-11 18:46        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight

2012-11-11 18:36 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll

2012-11-11 18:36 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll

2012-11-11 18:36 . 2012-08-24 18:13        154480        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2012-11-11 18:36 . 2012-08-24 18:09        458712        ----a-w-        c:\windows\system32\drivers\cng.sys

2012-11-11 18:36 . 2012-08-24 18:05        340992        ----a-w-        c:\windows\system32\schannel.dll

2012-11-11 18:36 . 2012-08-24 18:04        307200        ----a-w-        c:\windows\system32\ncrypt.dll

2012-11-11 18:36 . 2012-08-24 18:03        1448448        ----a-w-        c:\windows\system32\lsasrv.dll

2012-11-11 18:36 . 2012-08-24 16:57        247808        ----a-w-        c:\windows\SysWow64\schannel.dll

2012-11-11 18:36 . 2012-08-24 16:57        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2012-11-11 18:36 . 2012-08-24 16:57        220160        ----a-w-        c:\windows\SysWow64\ncrypt.dll

2012-11-11 18:36 . 2012-08-24 16:53        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2012-11-08 13:12 . 2012-11-17 13:06        --------        d-----w-        c:\users\Tobano\AppData\Roaming\Epvay

2012-11-08 13:12 . 2012-11-17 13:05        --------        d-----w-        c:\users\Tobano\AppData\Roaming\Ytliri

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-23 21:19 . 2012-07-17 17:01        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-11-23 21:19 . 2012-04-25 15:41        916456        ----a-w-        c:\windows\system32\deployJava1.dll

2012-11-23 21:14 . 2012-04-05 20:35        73656        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-23 21:14 . 2012-04-05 20:35        697272        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-17 13:04 . 2012-04-10 15:35        66395536        ----a-w-        c:\windows\system32\MRT.exe

2012-11-09 21:25 . 2012-05-22 20:15        952        --sha-w-        c:\programdata\KGyGaAvL.sys

2012-10-16 08:38 . 2012-11-27 19:29        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-27 19:29        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-27 19:29        561664        ----a-w-        c:\windows\apppatch\AcLayers.dll

2012-10-09 20:06 . 2012-10-09 20:06        893552        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2012-10-09 20:05 . 2012-10-09 20:05        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

2012-09-29 18:54 . 2012-04-12 14:13        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-09-14 19:19 . 2012-10-10 19:18        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-09-14 18:28 . 2012-10-10 19:18        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2011-08-23 16:42 . 2012-05-24 16:24        332144        ----a-w-        c:\program files (x86)\Common Files\MediaOrganizer.dll

2011-08-23 16:35 . 2012-05-24 16:24        33136        ----a-w-        c:\program files (x86)\Common Files\FlickrProvider.dll

2011-08-23 16:35 . 2012-05-24 16:24        402800        ----a-w-        c:\program files (x86)\Common Files\facebook.dll

2011-08-23 16:35 . 2012-05-24 16:24        130416        ----a-w-        c:\program files (x86)\Common Files\PluginCommon.dll

2011-08-23 16:34 . 2012-05-24 16:24        465264        ----a-w-        c:\program files (x86)\Common Files\AppFramework.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Software Antivirus\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 FreemakeVideoCapture;FreemakeVideoCapture;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-07-30 102240]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]

R3 FXDrv32;FXDrv32;F:\FXDrv64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-07-30 203104]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R4 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-11-23 219368]

R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-02-11 202752]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Software Antivirus\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-22 347680]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-06-20 13:05        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

.

--------- X64 Entries -----------

.

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.web.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202

TCP: DhcpNameServer = 192.168.1.1

DPF: {DB28CF23-0083-40B5-BF63-69925D672385} - hxxp://www.nero.com/doc/NeroVersionChecker.cab

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-EASEUS Partition Master Home Edition_is1 - c:\program files (x86)\Software fürn PC\EASEUS Partition Master 9.1.1 Home Edition\unins000.exe

AddRemove-EVEREST Home Edition_is1 - c:\program files (x86)\Software fürn PC\Everest\EVEREST Home Edition\unins000.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Software Antivirus\Avira\AntiVir Desktop\avguard.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-12-04  20:56:03 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-12-04 19:56

.

Vor Suchlauf: 12 Verzeichnis(se), 40.531.677.184 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 40.167.608.320 Bytes frei

.

- - End Of File - - 0DC80B48372B86FAE24B2648E763E2B2

Supi, dann jetzt noch die Reste raus.

Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:

Folder:: c:\users\Tobano\AppData\Roaming\Epvay c:\users\Tobano\AppData\Roaming\Ytliri

Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Und ein frisches OTL log bitte.

Code:

ComboFix 12-12-10.01 - Tobano 10.12.2012  19:51:47.3.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.7935.6447 [GMT 1:00]

ausgeführt von:: c:\users\Tobano\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Tobano\Desktop\CFScript.txt

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Tobano\AppData\Roaming\Epvay

c:\users\Tobano\AppData\Roaming\Ytliri

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-11-10 bis 2012-12-10  ))))))))))))))))))))))))))))))

.

.

2012-12-10 18:56 . 2012-12-10 18:56        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-12-10 18:48 . 2012-12-10 18:48        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2AD653DC-988A-4204-97DF-727EE714F366}\offreg.dll

2012-12-07 15:01 . 2012-11-19 00:01        9125352        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2AD653DC-988A-4204-97DF-727EE714F366}\mpengine.dll

2012-12-03 20:52 . 2012-12-03 20:52        --------        d-----w-        c:\users\Tobano\AppData\Roaming\Haufe

2012-12-03 20:52 . 2012-12-03 20:52        --------        d-----w-        c:\users\Tobano\AppData\Local\Haufe

2012-12-03 20:27 . 2012-12-03 21:07        --------        d-----w-        c:\programdata\BTrieve

2012-12-03 20:27 . 2012-12-03 20:27        --------        d-----w-        c:\program files (x86)\Lexware

2012-12-02 18:22 . 2012-12-02 18:22        --------        d-----w-        c:\users\Tobano\Neuer Ordner (2)

2012-11-26 16:16 . 2012-11-26 16:16        --------        d-----w-        c:\program files (x86)\Common Files\Java

2012-11-26 16:16 . 2012-11-26 16:15        821736        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2012-11-26 16:16 . 2012-11-26 16:15        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-11-23 21:19 . 2012-11-23 21:19        108008        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll

2012-11-21 18:42 . 2012-07-26 07:46        2560        ----a-w-        c:\windows\system32\drivers\de-DE\wdf01000.sys.mui

2012-11-21 18:42 . 2012-07-26 04:55        785512        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys

2012-11-21 18:42 . 2012-07-26 04:55        54376        ----a-w-        c:\windows\system32\drivers\WdfLdr.sys

2012-11-21 18:42 . 2012-07-26 02:36        9728        ----a-w-        c:\windows\system32\Wdfres.dll

2012-11-17 13:03 . 2012-07-26 02:26        87040        ----a-w-        c:\windows\system32\drivers\WUDFPf.sys

2012-11-17 13:03 . 2012-07-26 02:26        198656        ----a-w-        c:\windows\system32\drivers\WUDFRd.sys

2012-11-17 13:03 . 2012-07-26 03:08        229888        ----a-w-        c:\windows\system32\WUDFHost.exe

2012-11-17 13:03 . 2012-07-26 03:08        84992        ----a-w-        c:\windows\system32\WUDFSvc.dll

2012-11-17 13:03 . 2012-07-26 03:08        744448        ----a-w-        c:\windows\system32\WUDFx.dll

2012-11-17 13:03 . 2012-07-26 03:08        45056        ----a-w-        c:\windows\system32\WUDFCoinstaller.dll

2012-11-17 13:03 . 2012-07-26 03:08        194048        ----a-w-        c:\windows\system32\WUDFPlatform.dll

2012-11-11 18:38 . 2012-11-11 18:46        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight

2012-11-11 18:36 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll

2012-11-11 18:36 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll

2012-11-11 18:36 . 2012-08-24 18:13        154480        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2012-11-11 18:36 . 2012-08-24 18:09        458712        ----a-w-        c:\windows\system32\drivers\cng.sys

2012-11-11 18:36 . 2012-08-24 18:05        340992        ----a-w-        c:\windows\system32\schannel.dll

2012-11-11 18:36 . 2012-08-24 18:04        307200        ----a-w-        c:\windows\system32\ncrypt.dll

2012-11-11 18:36 . 2012-08-24 18:03        1448448        ----a-w-        c:\windows\system32\lsasrv.dll

2012-11-11 18:36 . 2012-08-24 16:57        247808        ----a-w-        c:\windows\SysWow64\schannel.dll

2012-11-11 18:36 . 2012-08-24 16:57        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2012-11-11 18:36 . 2012-08-24 16:57        220160        ----a-w-        c:\windows\SysWow64\ncrypt.dll

2012-11-11 18:36 . 2012-08-24 16:53        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-23 21:19 . 2012-07-17 17:01        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-11-23 21:19 . 2012-04-25 15:41        916456        ----a-w-        c:\windows\system32\deployJava1.dll

2012-11-23 21:14 . 2012-04-05 20:35        73656        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-23 21:14 . 2012-04-05 20:35        697272        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-17 13:04 . 2012-04-10 15:35        66395536        ----a-w-        c:\windows\system32\MRT.exe

2012-11-09 21:25 . 2012-05-22 20:15        952        --sha-w-        c:\programdata\KGyGaAvL.sys

2012-10-16 08:38 . 2012-11-27 19:29        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-27 19:29        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-27 19:29        561664        ----a-w-        c:\windows\apppatch\AcLayers.dll

2012-10-09 20:06 . 2012-10-09 20:06        893552        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2012-10-09 20:05 . 2012-10-09 20:05        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

2012-09-29 18:54 . 2012-04-12 14:13        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-09-14 19:19 . 2012-10-10 19:18        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-09-14 18:28 . 2012-10-10 19:18        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2011-08-23 16:42 . 2012-05-24 16:24        332144        ----a-w-        c:\program files (x86)\Common Files\MediaOrganizer.dll

2011-08-23 16:35 . 2012-05-24 16:24        33136        ----a-w-        c:\program files (x86)\Common Files\FlickrProvider.dll

2011-08-23 16:35 . 2012-05-24 16:24        402800        ----a-w-        c:\program files (x86)\Common Files\facebook.dll

2011-08-23 16:35 . 2012-05-24 16:24        130416        ----a-w-        c:\program files (x86)\Common Files\PluginCommon.dll

2011-08-23 16:34 . 2012-05-24 16:24        465264        ----a-w-        c:\program files (x86)\Common Files\AppFramework.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Software Antivirus\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 FreemakeVideoCapture;FreemakeVideoCapture;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-07-30 102240]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]

R3 FXDrv32;FXDrv32;F:\FXDrv64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-07-30 203104]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R4 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-11-23 219368]

R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-02-11 202752]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Software Antivirus\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-22 347680]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-06-20 13:05        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

.

--------- X64 Entries -----------

.

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.web.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202

TCP: DhcpNameServer = 192.168.1.1

DPF: {DB28CF23-0083-40B5-BF63-69925D672385} - hxxp://www.nero.com/doc/NeroVersionChecker.cab

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-EASEUS Partition Master Home Edition_is1 - c:\program files (x86)\Software fürn PC\EASEUS Partition Master 9.1.1 Home Edition\unins000.exe

AddRemove-EVEREST Home Edition_is1 - c:\program files (x86)\Software fürn PC\Everest\EVEREST Home Edition\unins000.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-12-10  19:58:09

ComboFix-quarantined-files.txt  2012-12-10 18:58

ComboFix2.txt  2012-12-04 19:56

.

Vor Suchlauf: 14 Verzeichnis(se), 41.073.815.552 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 40.749.674.496 Bytes frei

.

- - End Of File - - 24871BDF11A93477B65A7E2941ED67EB

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6844

# api_version=3.0.2

# EOSSerial=dab05e0005c84b4ea70bd464ea98fc1e

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-12-10 08:21:08

# local_time=2012-12-10 09:21:08 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 98 9466 220594158 2250 0

# compatibility_mode=5893 16776573 100 94 5533 106800718 0 0

# scanned=248698

# found=0

# cleaned=0

# scan_time=4153

Code:

OTL logfile created on: 10.12.2012 21:24:41 - Run 3

OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Tobano\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,75 Gb Total Physical Memory | 5,78 Gb Available Physical Memory | 74,53% Memory free

15,50 Gb Paging File | 13,52 Gb Available in Paging File | 87,24% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 115,82 Gb Total Space | 37,54 Gb Free Space | 32,41% Space Free | Partition Type: NTFS

Drive D: | 931,51 Gb Total Space | 512,78 Gb Free Space | 55,05% Space Free | Partition Type: NTFS

Drive E: | 2,93 Gb Total Space | 0,36 Gb Free Space | 12,45% Space Free | Partition Type: FAT32

Drive H: | 114,03 Gb Total Space | 113,41 Gb Free Space | 99,45% Space Free | Partition Type: NTFS

 

Computer Name: *** | User Name: Tobano | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_110_ActiveX.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Software Antivirus\AVIRA\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Users\Tobano\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (PSI_SVC_2) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)

SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.)

DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)

DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)

DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)

DRV:64bit: - (epmntdrv) -- C:\Windows\SysNative\epmntdrv.sys ()

DRV:64bit: - (EuGdiDrv) -- C:\Windows\SysNative\EuGdiDrv.sys ()

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.)

DRV - (epmntdrv) -- C:\Windows\SysWOW64\epmntdrv.sys ()

DRV - (EuGdiDrv) -- C:\Windows\SysWOW64\EuGdiDrv.sys ()

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=61163b32-4d0f-4f30-a5c7-bf5e6864eab2&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE - HKCU\..\SearchScopes,DefaultScope = {873607B3-27D9-4788-9DFE-21C44E2D4E2E}

IE - HKCU\..\SearchScopes\{873607B3-27D9-4788-9DFE-21C44E2D4E2E}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SPLBR2&pc=SPLH

IE - HKCU\..\SearchScopes\{9BC79249-C48D-4ea6-9EA7-25A41BE6853A}: "URL" = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A4067623346&ie=UTF-8&q={searchTerms}&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4067623346

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll File not found

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll File not found

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\Software Video DVD\VLC Media Player\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

[2012.04.25 18:08:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

 

O1 HOSTS File: ([2012.11.25 17:00:58 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Software Antivirus\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8:64bit: - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8:64bit: - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8:64bit: - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O13 - gopher Prefix: missing

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)

O16 - DPF: {DB28CF23-0083-40B5-BF63-69925D672385} hxxp://www.nero.com/doc/NeroVersionChecker.cab (CNeroSerialChecker Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A4D6516-D118-469E-B755-CE34A2D82223}: DhcpNameServer = 192.168.1.1

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (systempropertiesperformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.12.10 20:09:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.12.10 19:58:11 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.12.10 19:45:03 | 005,011,065 | R--- | C] (Swearware) -- C:\Users\Tobano\Desktop\ComboFix.exe

[2012.12.03 21:52:14 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Roaming\Haufe

[2012.12.03 21:52:14 | 000,000,000 | ---D | C] -- C:\Users\Tobano\AppData\Local\Haufe

[2012.12.03 21:27:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lexware

[2012.12.03 21:27:25 | 000,000,000 | ---D | C] -- C:\ProgramData\BTrieve

[2012.12.03 21:26:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Haufe

[2012.12.03 21:26:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Haufe

[2012.12.02 19:22:04 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Neuer Ordner (2)

[2012.12.02 18:24:28 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Documents\Lotto

[2012.11.26 17:16:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.11.26 17:16:08 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll

[2012.11.26 17:16:08 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe

[2012.11.26 17:16:01 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe

[2012.11.26 17:16:01 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe

[2012.11.26 17:16:01 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

[2012.11.25 16:54:27 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.11.25 16:54:27 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.11.25 16:54:27 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.11.25 16:53:26 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.11.25 16:52:53 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2012.11.24 18:28:19 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Tobano\Desktop\aswMBR.exe

[2012.11.21 20:30:38 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2012.11.21 19:42:49 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys

[2012.11.21 19:42:49 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll

[2012.11.20 20:45:20 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Desktop\mbar-1.01.0.1009

[2012.11.17 14:06:22 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2012.11.17 14:06:22 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2012.11.17 14:06:21 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2012.11.17 14:06:21 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2012.11.17 14:06:21 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2012.11.17 14:06:21 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2012.11.17 14:06:21 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2012.11.17 14:06:21 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2012.11.17 14:06:21 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2012.11.17 14:06:20 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2012.11.17 14:06:20 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2012.11.17 14:06:20 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2012.11.17 14:06:19 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2012.11.17 14:06:19 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2012.11.17 14:06:19 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2012.11.17 14:03:46 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll

[2012.11.17 14:03:46 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe

[2012.11.17 14:03:46 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll

[2012.11.17 14:03:46 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll

[2012.11.16 17:09:53 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll

[2012.11.16 17:09:53 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll

[2012.11.16 17:09:52 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll

[2012.11.16 17:09:45 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll

[2012.11.16 17:09:45 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll

[2012.11.16 17:09:45 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll

[2012.11.16 17:09:45 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll

[2012.11.16 17:09:45 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll

[2012.11.16 17:09:45 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll

[2012.11.16 17:09:27 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll

[2012.11.16 17:09:27 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll

[2012.11.13 22:36:05 | 000,000,000 | ---D | C] -- C:\Users\Tobano\Documents\Hamburg Energie

[2012.11.13 19:17:36 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2012.11.11 19:38:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2012.11.11 19:37:37 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll

[2012.11.11 19:37:37 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe

[2012.11.11 19:37:36 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RdpGroupPolicyExtension.dll

[2012.11.11 19:37:33 | 001,048,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe

[2012.11.11 19:37:33 | 000,384,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprt.exe

[2012.11.11 19:37:33 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll

[2012.11.11 19:37:33 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll

[2012.11.11 19:37:33 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpudd.dll

[2012.11.11 19:37:33 | 000,228,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpendp_winip.dll

[2012.11.11 19:37:33 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpendp_winip.dll

[2012.11.11 19:37:33 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe

[2012.11.11 19:37:33 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys

[2012.11.11 19:37:33 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsRdpWebAccess.dll

[2012.11.11 19:37:33 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsRdpWebAccess.dll

[2012.11.11 19:37:33 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll

[2012.11.11 19:37:33 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbGDCoInstaller.dll

[2012.11.11 19:37:33 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll

[2012.11.11 19:37:33 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys

[2012.11.11 19:37:33 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprtPS.dll

[2012.11.11 19:37:33 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wksprtPS.dll

[2012.11.11 19:37:32 | 005,773,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll

[2012.11.11 19:37:32 | 004,916,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll

[2012.11.11 19:37:32 | 003,174,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll

[2012.11.11 19:37:32 | 001,123,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe

[2012.11.11 19:36:55 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll

[2012.11.11 19:36:55 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll

[2012.11.11 19:36:54 | 001,448,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2012.11.11 19:36:54 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2012.05.24 17:24:42 | 000,465,264 | ---- | C] (Corel) -- C:\Program Files (x86)\Common Files\AppFramework.dll

[2012.05.24 17:24:42 | 000,332,144 | ---- | C] (Corel) -- C:\Program Files (x86)\Common Files\MediaOrganizer.dll

[2012.05.24 17:24:42 | 000,033,136 | ---- | C] (Corel-V1E) -- C:\Program Files (x86)\Common Files\FlickrProvider.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.12.10 19:47:17 | 000,015,760 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.12.10 19:47:17 | 000,015,760 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.12.10 19:45:17 | 005,011,065 | R--- | M] (Swearware) -- C:\Users\Tobano\Desktop\ComboFix.exe

[2012.12.10 19:42:48 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.12.10 19:42:48 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.12.10 19:42:48 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.12.10 19:42:48 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.12.10 19:42:48 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.12.10 19:38:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.12.10 19:37:58 | 1945,608,191 | -HS- | M] () -- C:\hiberfil.sys

[2012.12.03 18:02:47 | 000,000,083 | -HS- | M] () -- C:\ProgramData\.zreglib

[2012.11.27 20:40:14 | 000,001,180 | ---- | M] () -- C:\Users\Public\Desktop\AnyDVD.lnk

[2012.11.26 17:15:55 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

[2012.11.26 17:15:54 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll

[2012.11.26 17:15:54 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe

[2012.11.26 17:15:54 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe

[2012.11.26 17:15:54 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe

[2012.11.25 17:00:58 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.11.24 18:28:29 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Tobano\Desktop\aswMBR.exe

[2012.11.23 22:19:42 | 000,108,008 | ---- | M] () -- C:\Windows\SysNative\WindowsAccessBridge-64.dll

[2012.11.23 22:19:41 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll

[2012.11.23 22:19:41 | 000,916,456 | ---- | M] () -- C:\Windows\SysNative\deployJava1.dll

[2012.11.23 22:14:49 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.11.23 22:14:49 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.11.21 19:38:18 | 000,410,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.11.20 20:44:50 | 012,961,620 | ---- | M] () -- C:\Users\Tobano\Desktop\mbar-1.01.0.1009.zip

[2012.11.12 22:19:39 | 000,255,950 | ---- | M] () -- C:\Users\Tobano\Scan_Exmatrikulationsbescheinigung_Klapp.pdf

[2012.11.12 10:42:49 | 000,001,469 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.11.25 16:54:27 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.11.25 16:54:27 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.11.25 16:54:27 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.11.25 16:54:27 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.11.25 16:54:27 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.11.23 22:19:46 | 000,108,008 | ---- | C] () -- C:\Windows\SysNative\WindowsAccessBridge-64.dll

[2012.11.21 19:43:04 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf

[2012.11.20 20:44:50 | 012,961,620 | ---- | C] () -- C:\Users\Tobano\Desktop\mbar-1.01.0.1009.zip

[2012.11.17 14:03:46 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf

[2012.11.12 22:19:39 | 000,255,950 | ---- | C] () -- C:\Users\Tobano\Scan_Exmatrikulationsbescheinigung_Klapp.pdf

[2012.11.09 22:26:25 | 000,007,619 | ---- | C] () -- C:\Users\Tobano\AppData\Local\Resmon.ResmonCfg

[2012.10.18 17:47:17 | 005,454,636 | ---- | C] () -- C:\Users\Tobano\Handbuch_pk_Alice_Modem_WLAN_1121.pdf

[2012.05.24 17:24:42 | 000,402,800 | ---- | C] () -- C:\Program Files (x86)\Common Files\facebook.dll

[2012.05.24 17:24:42 | 000,148,177 | ---- | C] () -- C:\Program Files (x86)\Common Files\BookViewer.xap

[2012.05.24 17:24:42 | 000,130,416 | ---- | C] () -- C:\Program Files (x86)\Common Files\PluginCommon.dll

[2012.05.22 21:15:50 | 000,000,952 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2012.05.07 13:24:59 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit.INI

[2012.04.17 20:47:44 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2012.04.12 14:35:56 | 000,000,083 | -HS- | C] () -- C:\ProgramData\.zreglib

[2012.04.12 12:59:21 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe

[2012.04.12 12:59:21 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll

[2012.04.12 12:59:20 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe

[2012.04.12 12:59:20 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys

[2012.04.12 12:59:20 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys

[2012.04.12 12:24:55 | 000,000,262 | ---- | C] () -- C:\Windows\ULEAD32.INI

[2012.04.05 20:31:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2012.04.05 20:27:09 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 

< End of report >

Wie läuft der Rechner? :)