Trojaner-Board - tcbhn hat ein Problem festgestellt und muß beendet werden

Hallo,
wenn ich den computer einschalte erscheint die meldung "tcbhn hat ein Problem festgestellt und muß beendet werden".
Ich habe daher OTL.exe runtergeladen und einen suchlauf mit folgendem ergebniss gestartet.

OTL.Txt:OTL Logfile:

Code:

OTL logfile created on: 12.03.2013 11:50:47 - Run 2

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Name\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.11)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

502,98 Mb Total Physical Memory | 243,60 Mb Available Physical Memory | 48,43% Memory free

1,21 Gb Paging File | 0,91 Gb Available in Paging File | 75,50% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 37,27 Gb Total Space | 6,84 Gb Free Space | 18,35% Space Free | Partition Type: NTFS

Drive D: | 55,90 Gb Total Space | 55,07 Gb Free Space | 98,51% Space Free | Partition Type: NTFS

Drive G: | 14,64 Gb Total Space | 0,73 Gb Free Space | 4,98% Space Free | Partition Type: FAT32

 

Computer Name: R08 | User Name: Name | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.02.18 11:49:58 | 000,590,848 | ---- | M] (Blabbers Communications Ltd) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GinyasBrowserCompanion\tbhcn.exe

PRC - [2012.10.05 21:57:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Name\Desktop\OTL.exe

PRC - [2012.10.01 19:00:42 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.10.01 18:55:54 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.10.01 18:54:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.10.01 18:54:38 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.18 14:02:04 | 000,508,136 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe

PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.01.06 16:33:28 | 000,131,584 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2003.08.19 10:00:40 | 000,053,248 | ---- | M] (Lexmark International, Inc.) -- C:\Programme\Lexmark X1100 Series\lxbkbmon.exe

PRC - [2003.08.19 09:51:44 | 000,057,344 | ---- | M] (Lexmark International, Inc.) -- C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe

PRC - [2002.07.15 14:36:54 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

PRC - [2002.06.26 15:36:58 | 000,090,112 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMTray.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.12.18 22:59:18 | 000,019,144 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\ViewerPS.dll

MOD - [2012.10.01 19:01:24 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2009.02.27 15:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU

MOD - [2005.01.06 16:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll

MOD - [2003.07.29 08:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBKPP5C.DLL

 

 
 ========== Services (SafeList) ==========

 

SRV - [2013.03.08 21:38:57 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.02.28 10:18:49 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.10.01 19:00:42 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.10.01 18:54:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2005.04.03 23:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2002.07.15 14:36:54 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvuvc.sys -- (LVUVC)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\LVUSBSta.sys -- (LVUSBSta)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvrs.sys -- (LVRS)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvuvcflt.sys -- (FilterService)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - [2012.10.01 19:04:59 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2012.10.01 19:04:58 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2012.10.01 19:04:51 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.10.01 19:04:45 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2008.04.13 19:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)

DRV - [2008.04.13 19:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2005.11.03 15:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02)

DRV - [2005.08.10 13:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01)

DRV - [2005.05.16 14:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02)

DRV - [2004.08.04 13:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)

DRV - [2004.08.04 13:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)

DRV - [2004.08.03 22:32:32 | 000,084,480 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97via.sys -- (VIAudio)

DRV - [2004.08.03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)

DRV - [2003.07.02 03:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)

DRV - [2001.08.18 04:19:50 | 000,075,392 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atimpae.sys -- (atirage3)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\..\SearchScopes\{84414EBB-D21B-4D64-99F1-2A8146DAD48B}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3075125

IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredimail.com//?search={searchTerms}&loc=search_box&a=1ex6P5dCbJJ

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 72.37.213.104:8089

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"

FF - prefs.js..browser.search.defaultthis.engineName: "Die FreeRide Games Bar Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3075125&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "https://www.google.de/"

FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9

FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.7

FF - prefs.js..extensions.enabledAddons: bbrs_002%40blabbers.com:1.0.5

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {c9508125-4747-4733-b048-e4b82dc9716d}:2.6.0.15

FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102572&q="

FF - prefs.js..network.proxy.http: "74.63.201.156"

FF - prefs.js..network.proxy.http_port: 3128

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll File not found

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.03.08 21:39:03 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.03.09 23:14:40 | 000,000,000 | ---D | M]

 

[2008.11.28 13:46:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Extensions

[2013.03.04 20:52:59 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions

[2010.05.27 21:57:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.12.23 17:30:51 | 000,000,000 | ---D | M] (Ginyas Browser Companion) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com

[2011.05.16 13:19:12 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\engine@conduit.com

[2013.03.04 20:52:59 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\ich@maltegoetz.de

[2012.12.11 23:08:27 | 000,036,098 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

[2013.02.15 11:05:35 | 000,817,280 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2013.02.22 20:09:06 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\0324adea3b6ec02af09ea4ae9424591b_expire

[2013.03.11 21:26:55 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\24779e9d2de93d13d7e07b527a1684d4_expire

[2013.03.11 21:26:51 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\292124057d00cb0fa73db6b90d079658_expire

[2013.03.10 21:43:58 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\4d3d10bd28ff623813254a49b26be41f_expire

[2013.03.11 21:26:55 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\5f9c09c99c058ffa5befab6cbe17f7d4_expire

[2013.03.11 21:26:52 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\72891ec935a3d247f2da6562ef29a005_expire

[2013.03.11 21:26:53 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\7c703b5a324924a63df3f62c4c95fae8_expire

[2013.03.11 21:26:52 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\a38dbdd1af07f4236d43e8fd995f57a6_expire

[2013.03.11 21:26:52 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\a7e0abb80dabcdbb6dbaec920aa126a0_expire

[2013.03.11 21:26:52 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\bf73732e1f0b76bac435293ba3880579_expire

[2013.03.11 21:26:54 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\e919434ec29526b28593c426e4264271_expire

[2013.03.11 21:26:54 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\f03527c67e08602d2e4c18ae7867300d_expire

[2013.03.10 21:43:57 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\fa74672918974682c82b8d91dfbe0d6b_expire

[2013.03.10 21:43:57 | 000,000,013 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f_expire

[2010.02.01 20:09:05 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\searchplugins\forestle-de.xml

[2010.02.14 20:59:25 | 000,004,153 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\searchplugins\youtube.xml

[2013.03.08 21:37:04 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2013.03.08 21:39:02 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2012.03.08 20:54:06 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2010.03.28 13:23:20 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Programme\mozilla firefox\plugins\npPandoWebInst.dll

[2012.10.14 16:54:28 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.10.14 16:54:27 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2012.10.14 16:54:27 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2012.10.14 16:54:27 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.10.14 16:54:27 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.10.14 16:54:27 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: hxxp://www.google.at/

CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\25.0.1364.152\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\25.0.1364.152\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\25.0.1364.152\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

CHR - plugin: Pando Web Installer (Enabled) = C:\Programme\Mozilla Firefox\plugins\npPandoWebInst.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll

CHR - plugin: Unity Player (Enabled) = C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll

CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.124\npGoogleUpdate3.dll

CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Programme\Java\jre6\bin\plugin2\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

CHR - Extension: James White = C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\bkeidgmehkdjmpjodpjkepolokanalkm\3_0\

CHR - Extension: Ginyas Browser Companion = C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\bodddioamolcibagionmmobehnbhiakf\1.0.5_0\

CHR - Extension: DVDVideoSoft Browser Extension = C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\

 

O1 HOSTS File: ([2004.08.04 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Ginyas Browser Companion) - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Programme\GinyasBrowserCompanion\jsloader.dll ( )

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Ginyas Browser Companion Verifier) - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Programme\GinyasBrowserCompanion\updatebhoWin32.dll (Blabbers Communications Ltd)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [Lexmark X1100 Series] C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)

O4 - HKLM..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKCU..\Run: [GoogleChromeAutoLaunch_946CA06ADD5F933EFA0231D90E9C9CDF] C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)

O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Programme/Risk/Images/stg_drm.ocx (SpinTop DRM Control)

O16 - DPF: {4FF78044-96B4-4312-A5B7-FDA3CB328095} (Reg Error: Key error.)

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1227876728903 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Programme/Risk/Images/armhelper.ocx (ArmHelper Control)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3088E742-539D-43DB-995B-F8604E7699CD}: DhcpNameServer = 192.168.1.1 194.25.2.130

O18 - Protocol\Handler\base64 {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Programme\GinyasBrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)

O18 - Protocol\Handler\chrome {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Programme\GinyasBrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\prox {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Programme\GinyasBrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 0

O32 - AutoRun File - [2007.08.23 21:02:49 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Programme\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.03.12 11:38:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Name\Desktop\OTL.exe

[2013.03.10 11:26:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\BeKi

[2013.03.08 21:37:00 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox

[2013.02.27 18:07:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\TuneUp Software

[2013.02.27 18:05:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TuneUp Software

[2013.02.16 00:42:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Opera

[2013.02.16 00:11:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\Adobe PDF

[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.03.12 11:30:05 | 000,001,052 | ---- | M] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Stats Report.job

[2013.03.12 11:27:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2013.03.12 11:14:08 | 000,001,004 | ---- | M] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion FireFox Watcher.job

[2013.03.12 11:14:07 | 000,001,004 | ---- | M] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Chrome Watcher.job

[2013.03.12 11:13:02 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2013.03.12 11:06:38 | 000,367,614 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2013.03.12 11:06:38 | 000,067,910 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2013.03.12 11:06:38 | 000,033,522 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2013.03.12 11:06:38 | 000,014,218 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2013.03.12 11:04:27 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2013.03.12 11:03:05 | 000,001,004 | ---- | M] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Update Checker.job

[2013.03.12 11:02:59 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2013.03.12 11:02:57 | 000,001,004 | ---- | M] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Runner.job

[2013.03.12 11:02:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2013.03.12 11:02:31 | 527,486,976 | -HS- | M] () -- C:\hiberfil.sys

[2013.03.10 19:28:20 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini

[2013.03.05 21:51:33 | 000,027,946 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\UGB-NEWSLETTER März 2013.eml

[2013.02.25 10:44:38 | 000,008,697 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Sprechstunden 12-13.pdf

[2013.02.17 14:06:19 | 000,119,744 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2013.02.15 23:00:05 | 000,004,138 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\.recently-used.xbel

[2013.02.14 12:53:01 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.03.05 21:51:33 | 000,027,946 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\UGB-NEWSLETTER März 2013.eml

[2013.02.25 10:44:38 | 000,008,697 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Sprechstunden 12-13.pdf

[2013.02.22 20:02:51 | 000,001,004 | ---- | C] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Runner.job

[2013.02.22 20:02:49 | 000,001,004 | ---- | C] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Update Checker.job

[2013.02.22 20:02:41 | 000,001,052 | ---- | C] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Stats Report.job

[2013.02.22 20:02:38 | 000,001,004 | ---- | C] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion Chrome Watcher.job

[2013.02.22 20:02:33 | 000,001,004 | ---- | C] () -- C:\WINDOWS\tasks\GinyasBrowserCompanion FireFox Watcher.job

[2013.02.16 00:02:03 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe

[2013.02.15 23:00:05 | 000,004,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\.recently-used.xbel

[2012.08.19 18:19:48 | 000,000,101 | ---- | C] () -- C:\WINDOWS\lexstat.ini

[2012.08.19 18:18:41 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll

[2012.08.19 18:18:40 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBKIH.EXE

[2012.08.19 18:18:40 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL

[2012.08.19 18:18:35 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE

[2012.08.19 18:17:29 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini

[2012.07.23 14:58:15 | 000,000,102 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\games.stat

[2012.07.15 20:49:47 | 000,000,014 | ---- | C] () -- C:\WINDOWS\popcinfo.dat

[2012.02.15 09:04:00 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011.06.21 22:02:54 | 000,000,116 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2011.04.17 19:02:51 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\qttask.exe

[2011.04.17 18:56:36 | 000,507,904 | ---- | C] () -- C:\WINDOWS\Silent Hunter II remove.exe

[2008.12.25 19:30:40 | 000,020,480 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.08.23 22:10:35 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

 
 ========== ZeroAccess Check ==========

 

[2007.08.23 22:38:46 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 03:22:25 | 001,499,136 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2009.09.07 11:44:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Age of Empires 3

[2013.01.02 03:17:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files

[2012.06.27 08:41:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular

[2010.08.30 18:56:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Firefly Studios

[2012.07.30 18:53:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreeRide Games

[2012.11.03 13:15:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GamesBar

[2013.02.28 17:24:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GinyasBrowserCompanion

[2012.07.22 19:17:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Intenium

[2011.08.22 19:20:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MumboJumbo

[2012.02.21 18:19:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Playrix Entertainment

[2010.11.06 09:01:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files

[2010.04.07 19:16:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

[2012.02.20 18:38:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TERMINAL Studio

[2013.02.27 18:06:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software

[2010.09.07 17:36:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Youdagames

[2013.02.27 18:45:30 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}

[2008.03.20 15:47:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Auslogics

[2012.02.21 22:02:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Awem

[2012.07.23 22:07:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\cerasus.media

[2013.01.02 03:17:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoft

[2011.10.16 11:37:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers

[2012.06.27 08:42:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\elsterformular

[2011.08.08 15:59:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Feuerwache

[2010.04.05 18:48:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\flightgear.org

[2010.04.05 18:41:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\fltk.org

[2013.02.15 23:00:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\gtk-2.0

[2012.02.20 20:55:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\iWin

[2008.12.23 15:19:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Leadertech

[2012.08.21 10:23:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mount&Blade

[2013.01.02 03:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\OpenCandy

[2013.02.16 00:42:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Opera

[2012.11.03 13:27:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PriceGong

[2010.04.07 19:09:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\SpinTop

[2013.02.27 18:05:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TuneUp Software

[2010.04.09 08:02:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Uniblue

[2012.12.23 11:25:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Unity

[2010.09.07 17:36:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Youdagames

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2009.09.24 10:21:33 | 000,000,000 | ---D | M] -- C:\327

[2009.06.06 14:09:17 | 000,000,000 | ---D | M] -- C:\BlueByte

[2009.09.02 15:53:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings

[2012.11.03 12:30:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen

[2013.02.25 09:28:37 | 000,000,000 | ---D | M] -- C:\Download

[2009.09.23 18:02:18 | 000,000,000 | ---D | M] -- C:\epson

[2009.09.05 14:06:39 | 000,000,000 | ---D | M] -- C:\GAMIGO

[2008.11.28 14:20:55 | 000,000,000 | ---D | M] -- C:\IBMTOOLS

[2012.08.19 18:16:46 | 000,000,000 | ---D | M] -- C:\Lxk1100

[2009.09.16 15:19:15 | 000,000,000 | ---D | M] -- C:\Meine Bilder

[2007.08.23 23:14:33 | 000,000,000 | ---D | M] -- C:\Musik

[2007.08.23 21:59:07 | 000,000,000 | R--D | M] -- C:\o2k

[2013.03.09 23:19:47 | 000,000,000 | ---D | M] -- C:\Programme

[2007.08.23 21:19:44 | 000,000,000 | -HSD | M] -- C:\RECYCLER

[2009.08.21 21:37:12 | 000,000,000 | ---D | M] -- C:\SIERRA

[2007.08.23 21:08:19 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012.09.03 12:17:38 | 000,000,000 | ---D | M] -- C:\Temp

[2013.02.27 18:03:01 | 000,000,000 | ---D | M] -- C:\WINDOWS

[2013.01.31 22:30:12 | 000,000,000 | ---D | M] -- C:\Zylom Games

 
 < %PROGRAMFILES%\*.exe >

Invalid Environment Variable: LOCALAPPDATA

 
 < %systemroot%\*. /mp /s >

 
 < C:\Windows\system32\*.tsp >

[2008.04.14 03:23:08 | 000,266,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\h323.tsp

[2008.04.14 03:23:08 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2008.04.14 03:23:08 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ipconf.tsp

[2008.04.14 03:23:08 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2008.04.14 03:23:08 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2008.04.14 03:23:08 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2008.04.14 03:23:08 | 000,207,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

[9 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

[2007.08.23 20:59:40 | 000,000,065 | RH-- | C] () -- C:\WINDOWS\Tasks\desktop.ini

[2007.08.23 21:08:10 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\Tasks\SA.DAT

[2012.12.22 19:03:04 | 000,001,082 | ---- | C] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

[2012.12.22 19:03:05 | 000,001,086 | ---- | C] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

[2013.02.03 18:05:38 | 000,000,884 | ---- | C] () -- C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

[2013.02.22 20:02:33 | 000,001,004 | ---- | C] () -- C:\WINDOWS\Tasks\GinyasBrowserCompanion FireFox Watcher.job

[2013.02.22 20:02:38 | 000,001,004 | ---- | C] () -- C:\WINDOWS\Tasks\GinyasBrowserCompanion Chrome Watcher.job

[2013.02.22 20:02:41 | 000,001,052 | ---- | C] () -- C:\WINDOWS\Tasks\GinyasBrowserCompanion Stats Report.job

[2013.02.22 20:02:49 | 000,001,004 | ---- | C] () -- C:\WINDOWS\Tasks\GinyasBrowserCompanion Update Checker.job

[2013.02.22 20:02:51 | 000,001,004 | ---- | C] () -- C:\WINDOWS\Tasks\GinyasBrowserCompanion Runner.job

 
 < MD5 for: AGP440.SYS >

[2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.11.28 14:21:19 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008.11.28 14:21:19 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS >

[2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.11.28 14:21:19 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.11.28 14:21:19 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2008.11.28 13:11:46 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

 
 < MD5 for: EVENTLOG.DLL >

[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: EXPLORER.EXE >

[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe

[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

[2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

 
 < MD5 for: NETLOGON.DLL >

[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: SCECLI.DLL >

[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.04 13:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL >

[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE >

[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.04 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE >

[2004.08.04 13:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS >

[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2007.08.23 22:40:41 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2007.08.23 22:40:41 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2007.08.23 22:40:41 | 000,409,600 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\system32\*.dll /lockedfiles >

[9 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 
 < %USERPROFILE%\*.* >

[2013.02.15 23:00:05 | 000,004,138 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\.recently-used.xbel

[2012.07.23 23:08:29 | 000,000,102 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\games.stat

[2013.03.11 21:59:46 | 006,029,312 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\NTUSER.DAT

[2013.03.12 11:50:09 | 000,001,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\Name\NTUSER.DAT.LOG

[2013.03.11 21:59:39 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Name\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2013.01.04 11:09:09 | 001,867,392 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 85 bytes -> C:\Dokumente und Einstellungen\All Users\Desktop:$SS_DESCRIPTOR_PVX2VCGFMV89V8N4TKBRVDNGCMXLJ4M28WLP36MVLGKMVW5FS4K5

@Alternate Data Stream - 141 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:550179F5

@Alternate Data Stream - 124 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:3F2F06F2

 

< End of report >

--- --- ---

Extras.TxtOTL Logfile:

Code:

OTL Extras logfile created on: 12.03.2013 11:41:34 - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Name\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.11)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

502,98 Mb Total Physical Memory | 268,76 Mb Available Physical Memory | 53,43% Memory free

1,21 Gb Paging File | 0,91 Gb Available in Paging File | 75,29% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 37,27 Gb Total Space | 6,84 Gb Free Space | 18,35% Space Free | Partition Type: NTFS

Drive D: | 55,90 Gb Total Space | 55,07 Gb Free Space | 98,51% Space Free | Partition Type: NTFS

Drive G: | 14,64 Gb Total Space | 0,73 Gb Free Space | 4,98% Space Free | Partition Type: FAT32

 

Computer Name: R08 | User Name: Name | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 360 Days

 
 ========== Extra Registry (All) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.bat [@ = batfile] -- "%1" %*

.chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation)

.cmd [@ = cmdfile] -- "%1" %*

.com [@ = comfile] -- "%1" %*

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.exe [@ = exefile] -- "%1" %*

.hlp [@ = hlpfile] -- C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation)

.hta [@ = htafile] -- C:\WINDOWS\System32\mshta.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)

.inf [@ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)

.ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

.js [@ = JSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

.jse [@ = JSEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

.pif [@ = piffile] -- "%1" %*

.reg [@ = regfile] -- C:\WINDOWS\regedit.exe (Microsoft Corporation)

.scr [@ = scrfile] -- "%1" /S

.txt [@ = txtfile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)

.vbe [@ = VBEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

.vbs [@ = VBSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

.wsf [@ = WSFFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

.wsh [@ = WSHFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

 

[HKEY_USERS\S-1-5-21-57989841-1957994488-1708537768-1003\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

batfile [open] -- "%1" %*

batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

chm.file [open] -- "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)

cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

cmdfile [open] -- "%1" %*

cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

helpfile [open] -- winhlp32.exe %1 (Microsoft Corporation)

hlpfile [open] -- %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation)

htafile [open] -- C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)

inffile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

inffile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

inifile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

inifile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

InternetShortcut [print] -- rundll32.exe C:\WINDOWS\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)

jsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)

jsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)

jsefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)

jsefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [edit] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

regfile [open] -- regedit.exe "%1" (Microsoft Corporation)

regfile [merge] -- Reg Error: Key error.

regfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)

vbefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)

vbefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)

vbefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)

vbsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)

vbsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)

vbsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)

wsffile [edit] -- %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)

wsffile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)

wsffile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)

wshfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Programme\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

"56989:TCP" = 56989:TCP:*:Enabled:Pando Media Booster

"56989:UDP" = 56989:UDP:*:Enabled:Pando Media Booster

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"C:\Programme\totalcmd\TOTALCMD.EXE" = C:\Programme\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows -- (C. Ghisler & Co.)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()

"C:\Download\incredimail_install.exe" = C:\Download\incredimail_install.exe:*:Enabled:IncrediMail Installer -- ()

"C:\WINDOWS\system32\LEXPPS.EXE" = C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE -- (Lexmark International, Inc.)

"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{10CE1EA2-12E9-11D3-825E-00C04F6843FE}" = Microsoft Office Sounds

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics Driver

"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.4 - Deutsch

"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8

"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation

"{BBF10B37-4ED3-11D5-A818-00500435FC18}" = Gothic

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D627784F-B3EE-44E8-96B1-9509B991EA34}_is1" = AusLogics Registry Defrag

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag

"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0

"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"Avira AntiVir Desktop" = Avira Free Antivirus

"DirectXMediaRuntime" = DirectX Media Runtime 5.1

"EAX Unified" = EAX Unified

"ElsterFormular 13.2.0.8623p" = ElsterFormular

"EPSON Printer and Utilities" = EPSON Printer Software

"Filzip 3.0.6.93_is1" = Filzip 3.06

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212

"FreePDF_XP" = FreePDF XP (Remove only)

"GinyasBrowserCompanion" = GinyasBrowserCompanion

"Google Chrome" = Google Chrome

"GPL Ghostscript 8.15" = GPL Ghostscript 8.15

"GPL Ghostscript Fonts" = GPL Ghostscript Fonts

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"IrfanView" = IrfanView (remove only)

"Lexmark X1100 Series" = Lexmark X1100 Series

"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU

"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"OpenAL" = OpenAL

"PROSet" = Intel(R) PRO Network Adapters and Drivers

"QuickTime" = QuickTime

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Silent Hunter II" = Silent Hunter II

"Totalcmd" = Total Commander (Remove or Repair)

"Tweak UI 2.10" = Tweak UI

"VLC media player" = VLC media player 1.0.3

"Winamp" = Winamp

"Winamp 5.02 Deutsche Sprachdatei v14" = Deutsche Sprachdatei für Winamp 5.02 v14 

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WinGimp-2.0_is1" = GIMP 2.6.7

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

"XP Codec Pack" = XP Codec Pack

"xp-AntiSpy" = xp-AntiSpy 3.94-2

"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-57989841-1957994488-1708537768-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"UnityWebPlayer" = Unity Web Player

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 10.03.2013 05:23:24 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

Error - 10.03.2013 09:28:39 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul tbhcn.exe, Version 1.0.0.9, Fehleradresse 0x00057738.

 

Error - 10.03.2013 13:07:22 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

Error - 10.03.2013 13:07:23 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

Error - 10.03.2013 16:39:55 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul tbhcn.exe, Version 1.0.0.9, Fehleradresse 0x00057738.

 

Error - 10.03.2013 16:39:55 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

Error - 11.03.2013 15:48:01 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul tbhcn.exe, Version 1.0.0.9, Fehleradresse 0x00057738.

 

Error - 11.03.2013 15:48:01 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

Error - 12.03.2013 06:03:16 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

Error - 12.03.2013 06:03:18 | Computer Name = R08 | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung tbhcn.exe, Version 1.0.0.9, fehlgeschlagenes

Modul unknown, Version 0.0.0.0, Fehleradresse 0x0017e3c8.

 

[ System Events ]

Error - 09.03.2013 11:36:06 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 09.03.2013 14:50:28 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 10.03.2013 05:24:47 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 10.03.2013 09:32:33 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 10.03.2013 13:10:01 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 10.03.2013 16:41:42 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 11.03.2013 15:49:46 | Computer Name = R08 | Source = Service Control Manager | ID = 7009

Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst

auf Anwendungsebene.

 

Error - 11.03.2013 15:50:12 | Computer Name = R08 | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden

Fehlers nicht gestartet: %%1053

 

Error - 11.03.2013 15:50:32 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

Error - 12.03.2013 06:05:04 | Computer Name = R08 | Source = Service Control Manager | ID = 7023

Description = Der Dienst "WMI-Leistungsadapter" wurde mit folgendem Fehler beendet:

%%2147500037

 

 

< End of report >

--- --- ---

Wie muss ich jetzt weiter vorgehen ?

Vielen dank und beste grüße

Danke für die schnelle antwort :)

hier malwarebytes das erste:

Malwarebytes Anti-Rootkit BETA 1.01.0.1021
Malwarebytes : Free anti-malware download

Database version: v2013.02.15.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.11
Name :: R08 [administrator]

12.03.2013 14:07:38
mbar-log-2013-03-12 (14-07-38).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 25702
Time elapsed: 15 minute(s), 44 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 1
c:\Programme\GinyasBrowserCompanion\updatebhoWin32.dll (PUP.Blabbers) -> Delete on reboot.

Registry Keys Detected: 23
HKLM\SOFTWARE\CLASSES\CLSID\{00cbb66b-1d3b-46d3-9577-323a336acb50} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TYPELIB\{8830DDF0-3042-404D-A62C-384A85E34833} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{817923CB-4744-4216-B250-CF7EDA8F1767} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\CLSID\{00CBB66B-1D3B-46D3-9577-323A336ACB50}\INPROCSERVER32 (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\wit4ie.WitBHO.2 (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\wit4ie.WitBHO (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TYPELIB\{830B56CB-FD22-44AA-9887-7898F4F4158D} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\tdataprotocol.CTData.1 (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\tdataprotocol.CTData (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TYPELIB\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{9F0C17EB-EF2C-4278-9136-2D547656BC03} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531}\INPROCSERVER32 (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\updatebho.TimerBHO.1 (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\updatebho.TimerBHO (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\BASE64 (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\CHROME (PUP.Blabbers) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\PROX (PUP.Blabbers) -> Delete on reboot.

Registry Values Detected: 3
HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\BASE64|CLSID (PUP.Blabbers) -> Data: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\CHROME|CLSID (PUP.Blabbers) -> Data: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\PROX|CLSID (PUP.Blabbers) -> Data: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Delete on reboot.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 3
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache (PUP.Blabbers) -> Delete on reboot.

Files Detected: 39
c:\Programme\GinyasBrowserCompanion\jsloader.dll (PUP.Blabbers) -> Delete on reboot.
c:\Programme\GinyasBrowserCompanion\tdataprotocol.dll (PUP.Blabbers) -> Delete on reboot.
c:\Programme\GinyasBrowserCompanion\updatebhoWin32.dll (PUP.Blabbers) -> Delete on reboot.
c:\WINDOWS\EditPad.exe (Fake.Dropped.Malware) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\fix2.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\fix3.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\fix4.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\fix5.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\fixJQ1_83.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\icon.png (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\jquery4toolbar.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\jquery4toolbar183.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\lock.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\witapi.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\witmain.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\wittoolbar.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\witwidgetapi.js (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\0324adea3b6ec02af09ea4ae9424591b (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\0324adea3b6ec02af09ea4ae9424591b_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\24779e9d2de93d13d7e07b527a1684d4 (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\24779e9d2de93d13d7e07b527a1684d4_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\292124057d00cb0fa73db6b90d079658 (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\292124057d00cb0fa73db6b90d079658_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\4d3d10bd28ff623813254a49b26be41f (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\4d3d10bd28ff623813254a49b26be41f_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\9432a59cebc26f248a26b37875994d5e (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\9432a59cebc26f248a26b37875994d5e_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\9f3032ec969f913b49d07c582fec9672 (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\9f3032ec969f913b49d07c582fec9672_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\a7e0abb80dabcdbb6dbaec920aa126a0 (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\a7e0abb80dabcdbb6dbaec920aa126a0_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\e919434ec29526b28593c426e4264271 (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\e919434ec29526b28593c426e4264271_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\f03527c67e08602d2e4c18ae7867300d (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\f03527c67e08602d2e4c18ae7867300d_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\fa74672918974682c82b8d91dfbe0d6b (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\fa74672918974682c82b8d91dfbe0d6b_expire (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f (PUP.Blabbers) -> Delete on reboot.
c:\Dokumente und Einstellungen\Name\AppData\LocalLow\bbrs_002.tb\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f_expire (PUP.Blabbers) -> Delete on reboot.

(end)

das zweite:

Malwarebytes Anti-Rootkit BETA 1.01.0.1021
Malwarebytes : Free anti-malware download

Database version: v2013.02.15.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.11
Name :: R08 [administrator]

12.03.2013 14:33:34
mbar-log-2013-03-12 (14-33-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 25662
Time elapsed: 16 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

und hier die drei von Adwcleaner:AdwCleaner Logfile:

Code:

# AdwCleaner v2.114 - Datei am 12/03/2013 um 16:08:59 erstellt

# Aktualisiert am 05/03/2013 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : Name - R08

# Bootmodus : Normal

# Ausgef¸hrt unter : C:\Dokumente und Einstellungen\Name\Desktop\adwcleaner.exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\foxydeal.sqlite

Datei Gefunden : C:\END

Datei Gefunden : C:\WINDOWS\Tasks\GinyasBrowserCompanion Chrome Watcher.job

Datei Gefunden : C:\WINDOWS\Tasks\GinyasBrowserCompanion FireFox Watcher.job

Datei Gefunden : C:\WINDOWS\Tasks\GinyasBrowserCompanion Runner.job

Datei Gefunden : C:\WINDOWS\Tasks\GinyasBrowserCompanion Stats Report.job

Datei Gefunden : C:\WINDOWS\Tasks\GinyasBrowserCompanion Update Checker.job

Ordner Gefunden : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\y53da0qc.default\extensions\bbrs_002@blabbers.com

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GamesBar

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GinyasBrowserCompanion

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GinyasBrowserCompanion

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\dvdvideosoftiehelpers

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\iWin

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\Conduit

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\ConduitCommon

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\ConduitEngine

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\engine@conduit.com

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\OpenCandy

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PriceGong

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Conduit

Ordner Gefunden : C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\bodddioamolcibagionmmobehnbhiakf

Ordner Gefunden : C:\Programme\Conduit

Ordner Gefunden : C:\Programme\GinyasBrowserCompanion

Ordner Gefunden : C:\Programme\GinyasBrowserCompanion
 

***** [Registrierungsdatenbank] *****
 

Schl¸ssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit

Schl¸ssel Gefunden : HKCU\Software\Blabbers

Schl¸ssel Gefunden : HKCU\Software\BrowserCompanion

Schl¸ssel Gefunden : HKCU\Software\Conduit

Schl¸ssel Gefunden : HKCU\Software\ConduitSearchScopes

Schl¸ssel Gefunden : HKCU\Software\IM

Schl¸ssel Gefunden : HKCU\Software\ImInstaller

Schl¸ssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schl¸ssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}

Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A93C934-025B-4C3A-B38E-9654A7003239}

Schl¸ssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}

Schl¸ssel Gefunden : HKCU\Software\PriceGong

Schl¸ssel Gefunden : HKCU\Software\SmartBar

Schl¸ssel Gefunden : HKCU\Software\Softonic

Schl¸ssel Gefunden : HKLM\Software\BrowserCompanion

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\AppID\wit4ie.DLL

Schl¸ssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schl¸ssel Gefunden : HKLM\Software\Conduit

Schl¸ssel Gefunden : HKLM\Software\GinyasBrowserCompanion

Schl¸ssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\bodddioamolcibagionmmobehnbhiakf

Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\GinyasBrowserCompanion

Schl¸ssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GinyasBrowserCompanion

Schl¸ssel Gefunden : HKU\S-1-5-21-57989841-1957994488-1708537768-1003\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schl¸ssel Gefunden : HKU\S-1-5-21-57989841-1957994488-1708537768-1003\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v7.0.6000.17117
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v19.0.2 (de)
 

Datei : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\prefs.js
 

Gefunden : user_pref("CT2102572.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Gefunden : user_pref("CT2102572.CTID", "CT2102572");

Gefunden : user_pref("CT2102572.CurrentServerDate", "5-4-2011");

Gefunden : user_pref("CT2102572.DialogsAlignMode", "LTR");

Gefunden : user_pref("CT2102572.DownloadReferralCookieData", "");

Gefunden : user_pref("CT2102572.EMailNotifierPollDate", "Tue Apr 05 2011 20:42:13 GMT+0200");

Gefunden : user_pref("CT2102572.ExternalComponentPollDate128980152151612826", "Tue Apr 05 2011 20:36:37 GMT+020[...]

Gefunden : user_pref("CT2102572.ExternalComponentPollDate129010430308906809", "Tue Apr 05 2011 20:36:37 GMT+020[...]

Gefunden : user_pref("CT2102572.FeedLastCount128731380714969334", 595);

Gefunden : user_pref("CT2102572.FeedPollDate128734848660238153", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734848780081259", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734848899768760", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734849162893952", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734849298831492", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734849447894294", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734849563988162", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734849694613310", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734849871644036", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734850012112791", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734850140238024", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734850329613306", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734851254769189", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734851343519240", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734851486175530", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734851555550653", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734851626019450", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128734851705082013", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedPollDate128737465108387945", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.FeedTTL128734849694613310", 5);

Gefunden : user_pref("CT2102572.FeedTTL128734850012112791", 30);

Gefunden : user_pref("CT2102572.FeedTTL128737465108387945", 5);

Gefunden : user_pref("CT2102572.FirstServerDate", "27-5-2010");

Gefunden : user_pref("CT2102572.FirstTime", true);

Gefunden : user_pref("CT2102572.FirstTimeFF3", true);

Gefunden : user_pref("CT2102572.FirstTimeSettingsDone", true);

Gefunden : user_pref("CT2102572.FixPageNotFoundErrors", true);

Gefunden : user_pref("CT2102572.GroupingServerCheckInterval", 1440);

Gefunden : user_pref("CT2102572.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Gefunden : user_pref("CT2102572.Initialize", true);

Gefunden : user_pref("CT2102572.InitializeCommonPrefs", true);

Gefunden : user_pref("CT2102572.InstallationAndCookieDataSentCount", 3);

Gefunden : user_pref("CT2102572.InstalledDate", "Thu May 27 2010 22:56:39 GMT+0200");

Gefunden : user_pref("CT2102572.InvalidateCache", false);

Gefunden : user_pref("CT2102572.IsGrouping", false);

Gefunden : user_pref("CT2102572.IsMulticommunity", false);

Gefunden : user_pref("CT2102572.IsOpenThankYouPage", true);

Gefunden : user_pref("CT2102572.IsOpenUninstallPage", true);

Gefunden : user_pref("CT2102572.LanguagePackLastCheckTime", "Tue Apr 05 2011 20:36:48 GMT+0200");

Gefunden : user_pref("CT2102572.LanguagePackReloadIntervalMM", 1440);

Gefunden : user_pref("CT2102572.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Gefunden : user_pref("CT2102572.LastLogin_2.6.0.15", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.LatestVersion", "3.3.3.2");

Gefunden : user_pref("CT2102572.Locale", "de");

Gefunden : user_pref("CT2102572.LoginCache", 4);

Gefunden : user_pref("CT2102572.MCDetectTooltipHeight", "83");

Gefunden : user_pref("CT2102572.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Gefunden : user_pref("CT2102572.MCDetectTooltipWidth", "295");

Gefunden : user_pref("CT2102572.RadioIsPodcast", false);

Gefunden : user_pref("CT2102572.RadioLastCheckTime", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gefunden : user_pref("CT2102572.RadioLastUpdateIPServer", "3");

Gefunden : user_pref("CT2102572.RadioLastUpdateServer", "128929877726170000");

Gefunden : user_pref("CT2102572.RadioMediaID", "9512588");

Gefunden : user_pref("CT2102572.RadioMediaType", "Media Player");

Gefunden : user_pref("CT2102572.RadioMenuSelectedID", "EBRadioMenu_CT21025729512588");

Gefunden : user_pref("CT2102572.RadioShrinked", "shrinked");

Gefunden : user_pref("CT2102572.RadioStationName", "Antenne%20Bayern%20Top%2040%20");

Gefunden : user_pref("CT2102572.RadioStationURL", "hxxp://channels.webradio.antenne.de/top-40");

Gefunden : user_pref("CT2102572.SHRINK_TOOLBAR", 0);

Gefunden : user_pref("CT2102572.SavedHomepage", "hxxp://www.google.de/");

Gefunden : user_pref("CT2102572.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]

Gefunden : user_pref("CT2102572.SearchFromAddressBarIsInit", true);

Gefunden : user_pref("CT2102572.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT210[...]

Gefunden : user_pref("CT2102572.SearchInNewTabEnabled", true);

Gefunden : user_pref("CT2102572.SearchInNewTabIntervalMM", 1440);

Gefunden : user_pref("CT2102572.SearchInNewTabLastCheckTime", "Tue Apr 05 2011 20:36:37 GMT+0200");

Gefunden : user_pref("CT2102572.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Gefunden : user_pref("CT2102572.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Gefunden : user_pref("CT2102572.SettingsCheckIntervalMin", 120);

Gefunden : user_pref("CT2102572.SettingsLastCheckTime", "Tue Apr 05 2011 20:36:37 GMT+0200");

Gefunden : user_pref("CT2102572.SettingsLastUpdate", "1272782607");

Gefunden : user_pref("CT2102572.ThirdPartyComponentsInterval", 504);

Gefunden : user_pref("CT2102572.ThirdPartyComponentsLastCheck", "Tue Apr 05 2011 20:36:37 GMT+0200");

Gefunden : user_pref("CT2102572.ThirdPartyComponentsLastUpdate", "1271159567");

Gefunden : user_pref("CT2102572.TrusteLinkUrl", "hxxp://trust.conduit.com/EB_ORIGINAL_CTID");

Gefunden : user_pref("CT2102572.UserID", "UN88482350608006942");

Gefunden : user_pref("CT2102572.ValidationData_Search", 1);

Gefunden : user_pref("CT2102572.ValidationData_Toolbar", 2);

Gefunden : user_pref("CT2102572.WeatherNetwork", "");

Gefunden : user_pref("CT2102572.WeatherPollDate", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gefunden : user_pref("CT2102572.WeatherUnit", "C");

Gefunden : user_pref("CT2102572.alertChannelId", "518348");

Gefunden : user_pref("CT2102572.clientLogIsEnabled", true);

Gefunden : user_pref("CT2102572.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]

Gefunden : user_pref("CT2102572.myStuffEnabled", true);

Gefunden : user_pref("CT2102572.myStuffPublihserMinWidth", 400);

Gefunden : user_pref("CT2102572.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Gefunden : user_pref("CT2102572.myStuffServiceIntervalMM", 1440);

Gefunden : user_pref("CT2102572.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Gefunden : user_pref("CT2102572.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]

Gefunden : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3075125&Search[...]

Gefunden : user_pref("CommunityToolbar.ConduitSearchList", "  ,Die FreeRide Games Bar Customized Web Search");

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2786678/CT2786678[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3075125/CT3075125[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1178763/1174448/DE", "\"0\"[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1466551/1462205/DE", "\"0\"[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2786678", [...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3075125", [...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2786678",[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3075125",[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2786678&octid=[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/idel.gif", "[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/minimize.gif[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/play.gif", "[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/stop.gif", "[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/vol.gif", "\[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE",[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"c5b[...]

Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"d63[...]

Gefunden : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");

Gefunden : user_pref("CommunityToolbar.EngineOwnerGuid", "engine@conduit.com");

Gefunden : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");

Gefunden : user_pref("CommunityToolbar.IsEngineShown", true);

Gefunden : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Gefunden : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Dokumente und Einstellungen\\Name\\Anwendu[...]

Gefunden : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.15.1.0");

Gefunden : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://facebook.conduitapps.com/v3.13/gadget.html", [...]

Gefunden : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://youtube.conduitapps.com/v115/gadget.php?appMo[...]

Gefunden : user_pref("CommunityToolbar.OriginalEngineOwner", "ConduitEngine");

Gefunden : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "engine@conduit.com");

Gefunden : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "conduitengine");

Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]

Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2102572,ConduitEngine");

Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2102572");

Gefunden : user_pref("CommunityToolbar.ToolbarsList4", "");

Gefunden : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Mon May 16 2011 14:19:34 GMT+02[...]

Gefunden : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Gefunden : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Sat Jun 25 2011 17:58:55 GMT+0200");

Gefunden : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Gefunden : user_pref("CommunityToolbar.alert.locale", "en");

Gefunden : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Gefunden : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Tue Jun 28 2011 11:17:39 GMT+0200");

Gefunden : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Gefunden : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Gefunden : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Gefunden : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Gefunden : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Gefunden : user_pref("CommunityToolbar.alert.userId", "ae304c0f-9c26-41d2-8a0e-14409eca2d2e");

Gefunden : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Dec 25 2011 13:11:24 GMT+0100");

Gefunden : user_pref("CommunityToolbar.globalUserId", "586ac63b-2853-43bb-b0d6-7fbf152b82b8");

Gefunden : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Gefunden : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Gefunden : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3075125");

Gefunden : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Fri Nov 02 2012 11:13:4[...]

Gefunden : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

Gefunden : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Nov 03 2012 11:13:48 GMT+010[...]

Gefunden : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Gefunden : user_pref("CommunityToolbar.notifications.locale", "en");

Gefunden : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

Gefunden : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Nov 03 2012 11:13:40 GMT+0100");

Gefunden : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

Gefunden : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Gefunden : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Gefunden : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Gefunden : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Gefunden : user_pref("CommunityToolbar.notifications.userId", "efb3219b-2f2a-4e06-8464-c35fa7c09692");

Gefunden : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.google.de/");

Gefunden : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]

Gefunden : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Sun Jun 26 2011 09:56:22 GMT+0200");

Gefunden : user_pref("ConduitEngine.CTID", "ConduitEngine");

Gefunden : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Sun Jun 26 2011 19:26:58 GMT+0200");

Gefunden : user_pref("ConduitEngine.FirstServerDate", "05/16/2011 15");

Gefunden : user_pref("ConduitEngine.FirstTime", true);

Gefunden : user_pref("ConduitEngine.FirstTimeFF3", true);

Gefunden : user_pref("ConduitEngine.HasUserGlobalKeys", true);

Gefunden : user_pref("ConduitEngine.Initialize", true);

Gefunden : user_pref("ConduitEngine.InitializeCommonPrefs", true);

Gefunden : user_pref("ConduitEngine.InstalledDate", "Mon May 16 2011 14:19:36 GMT+0200");

Gefunden : user_pref("ConduitEngine.IsMulticommunity", false);

Gefunden : user_pref("ConduitEngine.IsOpenThankYouPage", false);

Gefunden : user_pref("ConduitEngine.IsOpenUninstallPage", true);

Gefunden : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Tue Jun 28 2011 11:17:44 GMT+0200");

Gefunden : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Tue Jun 28 2011 11:17:43 GMT+0200");

Gefunden : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Gefunden : user_pref("ConduitEngine.SettingsLastCheckTime", "Tue Jun 28 2011 11:17:43 GMT+0200");

Gefunden : user_pref("ConduitEngine.UserID", "UN28382078416637784");

Gefunden : user_pref("ConduitEngine.componentAlertEnabled", false);

Gefunden : user_pref("ConduitEngine.engineLocale", "de");

Gefunden : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Tue Jun 28 2011 11:17:43 GMT+0200");

Gefunden : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Tue Jun 28 2011 11:17:44 GMT+0200");

Gefunden : user_pref("ConduitEngine.initDone", true);

Gefunden : user_pref("ConduitEngine.isAppTrackingManagerOn", true);

Gefunden : user_pref("ConduitEngine.usagesFlag", 2);

Gefunden : user_pref("browser.search.defaultenginename", "MyStart Search");

Gefunden : user_pref("browser.search.defaultthis.engineName", "Die FreeRide Games Bar Customized Web Search");

Gefunden : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3075125&Sea[...]

Gefunden : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102572&q=");
 

Datei : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\y53da0qc.default\prefs.js
 

[OK] Die Datei ist sauber.
 

-\\ Google Chrome v25.0.1364.152
 

Datei : C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Preferences
 

Gefunden [l.2347] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=48", "hxxp://de.msn.com/?pc=UP21&ocid=UP21DHP&dt=022813" ]
 

*************************
 

AdwCleaner[R1].txt - [25680 octets] - [12/03/2013 16:08:59]
 

########## EOF - C:\AdwCleaner[R1].txt - [25741 octets] ##########

--- --- ---
zwei:AdwCleaner Logfile:

Code:

# AdwCleaner v2.114 - Datei am 12/03/2013 um 16:10:04 erstellt

# Aktualisiert am 05/03/2013 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : Name - R08

# Bootmodus : Normal

# Ausgef¸hrt unter : C:\Dokumente und Einstellungen\Name\Desktop\adwcleaner.exe

# Option [Lˆschen]
 
 

**** [Dienste] ****
 

drei:
 

# AdwCleaner v2.114 - Datei am 12/03/2013 um 16:11:48 erstellt

# Aktualisiert am 05/03/2013 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : Name - R08

# Bootmodus : Normal

# Ausgef¸hrt unter : C:\Dokumente und Einstellungen\Name\Desktop\adwcleaner.exe

# Option [Lˆschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\foxydeal.sqlite

Datei Gelˆscht : C:\END

Datei Gelˆscht : C:\WINDOWS\Tasks\GinyasBrowserCompanion Chrome Watcher.job

Datei Gelˆscht : C:\WINDOWS\Tasks\GinyasBrowserCompanion FireFox Watcher.job

Datei Gelˆscht : C:\WINDOWS\Tasks\GinyasBrowserCompanion Runner.job

Datei Gelˆscht : C:\WINDOWS\Tasks\GinyasBrowserCompanion Stats Report.job

Datei Gelˆscht : C:\WINDOWS\Tasks\GinyasBrowserCompanion Update Checker.job

Gelˆscht mit Neustart : C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\bodddioamolcibagionmmobehnbhiakf

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\y53da0qc.default\extensions\bbrs_002@blabbers.com

Ordner Gelˆscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GamesBar

Ordner Gelˆscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GinyasBrowserCompanion

Ordner Gelˆscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\dvdvideosoftiehelpers

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\iWin

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\Conduit

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\ConduitCommon

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\ConduitEngine

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\bbrs_002@blabbers.com

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\extensions\engine@conduit.com

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\OpenCandy

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PriceGong

Ordner Gelˆscht : C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Conduit

Ordner Gelˆscht : C:\Programme\Conduit

Ordner Gelˆscht : C:\Programme\GinyasBrowserCompanion
 

***** [Registrierungsdatenbank] *****
 

Schl¸ssel Gelˆscht : HKCU\Software\AppDataLow\Software\Conduit

Schl¸ssel Gelˆscht : HKCU\Software\Blabbers

Schl¸ssel Gelˆscht : HKCU\Software\BrowserCompanion

Schl¸ssel Gelˆscht : HKCU\Software\Conduit

Schl¸ssel Gelˆscht : HKCU\Software\ConduitSearchScopes

Schl¸ssel Gelˆscht : HKCU\Software\IM

Schl¸ssel Gelˆscht : HKCU\Software\ImInstaller

Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}

Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A93C934-025B-4C3A-B38E-9654A7003239}

Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}

Schl¸ssel Gelˆscht : HKCU\Software\PriceGong

Schl¸ssel Gelˆscht : HKCU\Software\SmartBar

Schl¸ssel Gelˆscht : HKCU\Software\Softonic

Schl¸ssel Gelˆscht : HKLM\Software\BrowserCompanion

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\wit4ie.DLL

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schl¸ssel Gelˆscht : HKLM\Software\Conduit

Schl¸ssel Gelˆscht : HKLM\Software\GinyasBrowserCompanion

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bodddioamolcibagionmmobehnbhiakf

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\GinyasBrowserCompanion

Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GinyasBrowserCompanion
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v7.0.6000.17117
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v19.0.2 (de)
 

Datei : C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\sk0ac58y.default\prefs.js
 

Gelˆscht : user_pref("CT2102572.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Gelˆscht : user_pref("CT2102572.CTID", "CT2102572");

Gelˆscht : user_pref("CT2102572.CurrentServerDate", "5-4-2011");

Gelˆscht : user_pref("CT2102572.DialogsAlignMode", "LTR");

Gelˆscht : user_pref("CT2102572.DownloadReferralCookieData", "");

Gelˆscht : user_pref("CT2102572.EMailNotifierPollDate", "Tue Apr 05 2011 20:42:13 GMT+0200");

Gelˆscht : user_pref("CT2102572.ExternalComponentPollDate128980152151612826", "Tue Apr 05 2011 20:36:37 GMT+020[...]

Gelˆscht : user_pref("CT2102572.ExternalComponentPollDate129010430308906809", "Tue Apr 05 2011 20:36:37 GMT+020[...]

Gelˆscht : user_pref("CT2102572.FeedLastCount128731380714969334", 595);

Gelˆscht : user_pref("CT2102572.FeedPollDate128734848660238153", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734848780081259", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734848899768760", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734849162893952", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734849298831492", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734849447894294", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734849563988162", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734849694613310", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734849871644036", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734850012112791", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734850140238024", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734850329613306", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734851254769189", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734851343519240", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734851486175530", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734851555550653", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734851626019450", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128734851705082013", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedPollDate128737465108387945", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.FeedTTL128734849694613310", 5);

Gelˆscht : user_pref("CT2102572.FeedTTL128734850012112791", 30);

Gelˆscht : user_pref("CT2102572.FeedTTL128737465108387945", 5);

Gelˆscht : user_pref("CT2102572.FirstServerDate", "27-5-2010");

Gelˆscht : user_pref("CT2102572.FirstTime", true);

Gelˆscht : user_pref("CT2102572.FirstTimeFF3", true);

Gelˆscht : user_pref("CT2102572.FirstTimeSettingsDone", true);

Gelˆscht : user_pref("CT2102572.FixPageNotFoundErrors", true);

Gelˆscht : user_pref("CT2102572.GroupingServerCheckInterval", 1440);

Gelˆscht : user_pref("CT2102572.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Gelˆscht : user_pref("CT2102572.Initialize", true);

Gelˆscht : user_pref("CT2102572.InitializeCommonPrefs", true);

Gelˆscht : user_pref("CT2102572.InstallationAndCookieDataSentCount", 3);

Gelˆscht : user_pref("CT2102572.InstalledDate", "Thu May 27 2010 22:56:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.InvalidateCache", false);

Gelˆscht : user_pref("CT2102572.IsGrouping", false);

Gelˆscht : user_pref("CT2102572.IsMulticommunity", false);

Gelˆscht : user_pref("CT2102572.IsOpenThankYouPage", true);

Gelˆscht : user_pref("CT2102572.IsOpenUninstallPage", true);

Gelˆscht : user_pref("CT2102572.LanguagePackLastCheckTime", "Tue Apr 05 2011 20:36:48 GMT+0200");

Gelˆscht : user_pref("CT2102572.LanguagePackReloadIntervalMM", 1440);

Gelˆscht : user_pref("CT2102572.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Gelˆscht : user_pref("CT2102572.LastLogin_2.6.0.15", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.LatestVersion", "3.3.3.2");

Gelˆscht : user_pref("CT2102572.Locale", "de");

Gelˆscht : user_pref("CT2102572.LoginCache", 4);

Gelˆscht : user_pref("CT2102572.MCDetectTooltipHeight", "83");

Gelˆscht : user_pref("CT2102572.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Gelˆscht : user_pref("CT2102572.MCDetectTooltipWidth", "295");

Gelˆscht : user_pref("CT2102572.RadioIsPodcast", false);

Gelˆscht : user_pref("CT2102572.RadioLastCheckTime", "Tue Apr 05 2011 20:36:38 GMT+0200");

Gelˆscht : user_pref("CT2102572.RadioLastUpdateIPServer", "3");

Gelˆscht : user_pref("CT2102572.RadioLastUpdateServer", "128929877726170000");

Gelˆscht : user_pref("CT2102572.RadioMediaID", "9512588");

Gelˆscht : user_pref("CT2102572.RadioMediaType", "Media Player");

Gelˆscht : user_pref("CT2102572.RadioMenuSelectedID", "EBRadioMenu_CT21025729512588");

Gelˆscht : user_pref("CT2102572.RadioShrinked", "shrinked");

Gelˆscht : user_pref("CT2102572.RadioStationName", "Antenne%20Bayern%20Top%2040%20");

Gelˆscht : user_pref("CT2102572.RadioStationURL", "hxxp://channels.webradio.antenne.de/top-40");

Gelˆscht : user_pref("CT2102572.SHRINK_TOOLBAR", 0);

Gelˆscht : user_pref("CT2102572.SavedHomepage", "hxxp://www.google.de/");

Gelˆscht : user_pref("CT2102572.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]

Gelˆscht : user_pref("CT2102572.SearchFromAddressBarIsInit", true);

Gelˆscht : user_pref("CT2102572.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT210[...]

Gelˆscht : user_pref("CT2102572.SearchInNewTabEnabled", true);

Gelˆscht : user_pref("CT2102572.SearchInNewTabIntervalMM", 1440);

Gelˆscht : user_pref("CT2102572.SearchInNewTabLastCheckTime", "Tue Apr 05 2011 20:36:37 GMT+0200");

Gelˆscht : user_pref("CT2102572.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Gelˆscht : user_pref("CT2102572.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Gelˆscht : user_pref("CT2102572.SettingsCheckIntervalMin", 120);

Gelˆscht : user_pref("CT2102572.SettingsLastCheckTime", "Tue Apr 05 2011 20:36:37 GMT+0200");

Gelˆscht : user_pref("CT2102572.SettingsLastUpdate", "1272782607");

Gelˆscht : user_pref("CT2102572.ThirdPartyComponentsInterval", 504);

Gelˆscht : user_pref("CT2102572.ThirdPartyComponentsLastCheck", "Tue Apr 05 2011 20:36:37 GMT+0200");

Gelˆscht : user_pref("CT2102572.ThirdPartyComponentsLastUpdate", "1271159567");

Gelˆscht : user_pref("CT2102572.TrusteLinkUrl", "hxxp://trust.conduit.com/EB_ORIGINAL_CTID");

Gelˆscht : user_pref("CT2102572.UserID", "UN88482350608006942");

Gelˆscht : user_pref("CT2102572.ValidationData_Search", 1);

Gelˆscht : user_pref("CT2102572.ValidationData_Toolbar", 2);

Gelˆscht : user_pref("CT2102572.WeatherNetwork", "");

Gelˆscht : user_pref("CT2102572.WeatherPollDate", "Tue Apr 05 2011 20:36:39 GMT+0200");

Gelˆscht : user_pref("CT2102572.WeatherUnit", "C");

Gelˆscht : user_pref("CT2102572.alertChannelId", "518348");

Gelˆscht : user_pref("CT2102572.clientLogIsEnabled", true);

Gelˆscht : user_pref("CT2102572.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]

Gelˆscht : user_pref("CT2102572.myStuffEnabled", true);

Gelˆscht : user_pref("CT2102572.myStuffPublihserMinWidth", 400);

Gelˆscht : user_pref("CT2102572.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Gelˆscht : user_pref("CT2102572.myStuffServiceIntervalMM", 1440);

Gelˆscht : user_pref("CT2102572.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Gelˆscht : user_pref("CT2102572.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]

Gelˆscht : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3075125&Search[...]

Gelˆscht : user_pref("CommunityToolbar.ConduitSearchList", "  ,Die FreeRide Games Bar Customized Web Search");

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2786678/CT2786678[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3075125/CT3075125[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1178763/1174448/DE", "\"0\"[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1466551/1462205/DE", "\"0\"[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2786678", [...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3075125", [...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2786678",[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3075125",[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2786678&octid=[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/idel.gif", "[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/minimize.gif[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/play.gif", "[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/stop.gif", "[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/vol.gif", "\[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE",[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"c5b[...]

Gelˆscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"d63[...]

Gelˆscht : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");

Gelˆscht : user_pref("CommunityToolbar.EngineOwnerGuid", "engine@conduit.com");

Gelˆscht : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");

Gelˆscht : user_pref("CommunityToolbar.IsEngineShown", true);

Gelˆscht : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Gelˆscht : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Dokumente und Einstellungen\\Name\\Anwendu[...]

Gelˆscht : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.15.1.0");

Gelˆscht : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://facebook.conduitapps.com/v3.13/gadget.html", [...]

Gelˆscht : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://youtube.conduitapps.com/v115/gadget.php?appMo[...]

Gelˆscht : user_pref("CommunityToolbar.OriginalEngineOwner", "ConduitEngine");

Gelˆscht : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "engine@conduit.com");

Gelˆscht : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "conduitengine");

Gelˆscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]

Gelˆscht : user_pref("CommunityToolbar.ToolbarsList", "CT2102572,ConduitEngine");

Gelˆscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2102572");

Gelˆscht : user_pref("CommunityToolbar.ToolbarsList4", "");

Gelˆscht : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Mon May 16 2011 14:19:34 GMT+02[...]

Gelˆscht : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Gelˆscht : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Sat Jun 25 2011 17:58:55 GMT+0200");

Gelˆscht : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Gelˆscht : user_pref("CommunityToolbar.alert.locale", "en");

Gelˆscht : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Gelˆscht : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Tue Jun 28 2011 11:17:39 GMT+0200");

Gelˆscht : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Gelˆscht : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Gelˆscht : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Gelˆscht : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Gelˆscht : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Gelˆscht : user_pref("CommunityToolbar.alert.userId", "ae304c0f-9c26-41d2-8a0e-14409eca2d2e");

Gelˆscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Dec 25 2011 13:11:24 GMT+0100");

Gelˆscht : user_pref("CommunityToolbar.globalUserId", "586ac63b-2853-43bb-b0d6-7fbf152b82b8");

Gelˆscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Gelˆscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Gelˆscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3075125");

Gelˆscht : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Fri Nov 02 2012 11:13:4[...]

Gelˆscht : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

Gelˆscht : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Nov 03 2012 11:13:48 GMT+010[...]

Gelˆscht : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Gelˆscht : user_pref("CommunityToolbar.notifications.locale", "en");

Gelˆscht : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

Gelˆscht : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Nov 03 2012 11:13:40 GMT+0100");

Gelˆscht : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

Gelˆscht : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Gelˆscht : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Gelˆscht : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Gelˆscht : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Gelˆscht : user_pref("CommunityToolbar.notifications.userId", "efb3219b-2f2a-4e06-8464-c35fa7c09692");

Gelˆscht : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.google.de/");

Gelˆscht : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]

Gelˆscht : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Sun Jun 26 2011 09:56:22 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.CTID", "ConduitEngine");

Gelˆscht : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Sun Jun 26 2011 19:26:58 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.FirstServerDate", "05/16/2011 15");

Gelˆscht : user_pref("ConduitEngine.FirstTime", true);

Gelˆscht : user_pref("ConduitEngine.FirstTimeFF3", true);

Gelˆscht : user_pref("ConduitEngine.HasUserGlobalKeys", true);

Gelˆscht : user_pref("ConduitEngine.Initialize", true);

Gelˆscht : user_pref("ConduitEngine.InitializeCommonPrefs", true);

Gelˆscht : user_pref("ConduitEngine.InstalledDate", "Mon May 16 2011 14:19:36 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.IsMulticommunity", false);

Gelˆscht : user_pref("ConduitEngine.IsOpenThankYouPage", false);

Gelˆscht : user_pref("ConduitEngine.IsOpenUninstallPage", true);

Gelˆscht : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Tue Jun 28 2011 11:17:44 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Tue Jun 28 2011 11:17:43 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Gelˆscht : user_pref("ConduitEngine.SettingsLastCheckTime", "Tue Jun 28 2011 11:17:43 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.UserID", "UN28382078416637784");

Gelˆscht : user_pref("ConduitEngine.componentAlertEnabled", false);

Gelˆscht : user_pref("ConduitEngine.engineLocale", "de");

Gelˆscht : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Tue Jun 28 2011 11:17:43 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Tue Jun 28 2011 11:17:44 GMT+0200");

Gelˆscht : user_pref("ConduitEngine.initDone", true);

Gelˆscht : user_pref("ConduitEngine.isAppTrackingManagerOn", true);

Gelˆscht : user_pref("ConduitEngine.usagesFlag", 2);

Gelˆscht : user_pref("browser.search.defaultenginename", "MyStart Search");

Gelˆscht : user_pref("browser.search.defaultthis.engineName", "Die FreeRide Games Bar Customized Web Search");

Gelˆscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3075125&Sea[...]

Gelˆscht : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102572&q=");
 

Datei : C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\y53da0qc.default\prefs.js
 

[OK] Die Datei ist sauber.
 

-\\ Google Chrome v25.0.1364.152
 

Datei : C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Preferences
 

Gelˆscht [l.2347] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=48", "[...]
 

*************************
 

AdwCleaner[R1].txt - [25811 octets] - [12/03/2013 16:08:59]

AdwCleaner[S1].txt - [346 octets] - [12/03/2013 16:10:04]

AdwCleaner[S2].txt - [25287 octets] - [12/03/2013 16:11:48]
 

########## EOF - C:\AdwCleaner[S2].txt - [25348 octets] ##########

--- --- ---
Vielen Dank

werd jetzt noch ein neues OTL-Log erstellen.