Trojaner-Board - Allgemeine Kontrolle meines PC's

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Allgemeine Kontrolle meines PC's (https://www.trojaner-board.de/135609-allgemeine-kontrolle-meines-pcs.html)

Allgemeine Kontrolle meines PC's

Hallo zusammen,

habe gestern durch Kaspersky Windowsunlocker einen Bundestrojaner gelöscht.

Der Virusscan zeigte mir 24 Trojaner auf dem PC, welche abern icht alle gelöscht wurden.

Kann mir jemand sagen`, welche Auswertungen von welchen Programmen ihr braucht, um mal drüber gucken zu können.

Wäre sehr lieb.

vielen Dank.

EDIT:

Habe es gefunden.

Werde demnächst die Files erstellen

Da isses :)

Betriebssystemname Microsoft Windows 7 Home Premium
Version 6.1.7601 Service Pack 1 Build 7601
Zusätzliche Betriebssystembeschreibung Nicht verfügbar
Betriebssystemhersteller Microsoft Corporation
Systemhersteller To Be Filled By O.E.M.
Systemmodell To Be Filled By O.E.M.
Systemtyp x64-basierter PC
Prozessor AMD Athlon(tm) II X3 440 Processor, 2993 MHz, 3 Kern(e), 3 logische(r) Prozessor(en)
BIOS-Version/-Datum American Megatrends Inc. P1.40, 26.11.2009
SMBIOS-Version 2.5
Windows-Verzeichnis C:\Windows
Systemverzeichnis C:\Windows\system32
Startgerät \Device\HarddiskVolume1
Gebietsschema Deutschland
Hardwareabstraktionsebene Version = "6.1.7601.17514"
Zeitzone Mitteleuropäische Sommerzeit
Installierter physikalischer Speicher (RAM) Nicht verfügbar
Gesamter realer Speicher 4,00 GB
Verfügbarer realer Speicher 2,20 GB
Gesamter virtueller Speicher 7,99 GB
Verfügbarer virtueller Speicher 6,05 GB
Größe der Auslagerungsdatei 4,00 GB
Auslagerungsdatei C:\pagefile.sys

Defugger hat keine Probleme angezeigt

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:51 on 27/05/2013 (Max Mustermann)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

OTL TXTOTL Logfile:

Code:

OTL logfile created on: 27.05.2013 10:55:35 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\...\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16540)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,54 Gb Available Physical Memory | 63,49% Memory free

7,99 Gb Paging File | 6,50 Gb Available in Paging File | 81,32% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465,76 Gb Total Space | 237,55 Gb Free Space | 51,00% Space Free | Partition Type: NTFS

 

Computer Name: ...PC | User Name: ...| Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.27 10:46:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\...\Desktop\OTL.exe

PRC - [2013.04.12 01:24:12 | 027,156,136 | ---- | M] (Dropbox, Inc.) -- C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

PRC - [2012.11.13 15:08:08 | 003,825,176 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

PRC - [2012.11.13 15:07:24 | 000,168,384 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

PRC - [2012.11.13 15:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

PRC - [2012.11.13 15:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

PRC - [2012.08.18 19:57:40 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.05.09 06:29:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.06.09 14:06:06 | 000,507,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\...\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\...\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

MOD - [2012.11.13 15:06:32 | 000,158,624 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

MOD - [2012.11.13 15:06:30 | 000,108,960 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

MOD - [2012.11.13 15:06:28 | 000,554,400 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl

MOD - [2012.11.13 15:06:28 | 000,528,288 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl

MOD - [2012.11.13 15:06:28 | 000,416,160 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2009.09.19 04:17:40 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2013.05.26 20:09:37 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)

SRV - [2013.01.08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.05.09 06:29:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.05.09 06:29:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007.05.31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.02.06 08:42:08 | 000,203,544 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudserd.sys -- (ssudserd)

DRV:64bit: - [2012.09.19 11:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)

DRV:64bit: - [2012.09.19 11:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)

DRV:64bit: - [2012.07.09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2012.05.09 06:29:34 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.05.09 06:29:34 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.08.02 17:38:44 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009.10.20 18:20:36 | 000,114,608 | ---- | M] (Philips Applied Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\phaudlwr.sys -- (phaudlwr)

DRV:64bit: - [2009.09.19 06:32:36 | 006,170,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.09.17 13:04:18 | 001,250,816 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2009.08.23 16:02:30 | 000,120,336 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2009.07.30 13:58:42 | 000,236,544 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.04 18:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)

DRV:64bit: - [2009.04.28 03:03:42 | 000,067,128 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009.04.28 03:03:42 | 000,028,216 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2008.05.21 14:30:58 | 000,583,168 | ---- | M] (                                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPC530.sys -- (SPC530)

DRV:64bit: - [2008.05.21 14:30:58 | 000,008,192 | ---- | M] (                                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPC530m.sys -- (SPC530m)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A7 FD E7 74 C1 28 CE 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKCU\..\SearchScopes\{12E785F4-1132-4171-8950-AE192B55808A}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{696CA4B9-130F-4C48-AE7F-57CBFBF633DA}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{BF125486-37D0-49EC-889D-BCDF751B36DA}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{C55359D2-FA3D-4AB8-A217-C8AAEBEF9DBF}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..network.proxy.type: 0

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\...\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.16 20:45:21 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\specialsavings@superfish.com: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles/39tdm9so.default\extensions\specialsavings@superfish.com [2012.03.11 13:25:46 | 000,000,000 | ---D | M]

 

[2011.10.24 21:11:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\...\AppData\Roaming\mozilla\Extensions

[2013.04.18 19:35:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\...\AppData\Roaming\mozilla\Firefox\Profiles\39tdm9so.default\extensions

[2012.03.11 13:25:46 | 000,000,000 | ---D | M] (SpecialSavings) -- C:\Users\...\AppData\Roaming\mozilla\Firefox\Profiles\39tdm9so.default\extensions\specialsavings@superfish.com

[2012.12.15 15:49:39 | 000,036,139 | ---- | M] () (No name found) -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

[2013.05.09 11:43:16 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\1und1-suche.xml

[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\amazondotcom-de.xml

[2013.04.18 18:28:58 | 000,001,294 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\delta.xml

[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\eBay-de.xml

[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\gmx-suche.xml

[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\lastminute.xml

[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\mailcom-search.xml

[2012.03.29 19:57:23 | 000,001,210 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\search.xml

[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Users\...\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\webde-suche.xml

[2013.05.26 20:09:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions

[2013.05.26 20:09:38 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2013.05.23 21:18:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\updated\browser\extensions

[2013.05.23 21:18:58 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2011.12.18 18:32:15 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2013.04.18 18:28:48 | 000,006,470 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)

O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe (Electronic Arts)

O4 - HKCU..\Run: [Spybot-S&D Cleaning] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)

O4 - Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\...\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\...\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.191.74.18 62.109.123.196

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E632D70B-F65D-4468-A070-431D0AFF442D}: DhcpNameServer = 213.191.74.18 62.109.123.196

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{5f7d9a6f-fe6c-11e0-bc22-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{5f7d9a6f-fe6c-11e0-bc22-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe

O33 - MountPoints2\{dafdb589-fe6f-11e0-b9bd-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{dafdb589-fe6f-11e0-b9bd-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.27 10:46:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\..\Desktop\OTL.exe

[2013.05.26 16:38:06 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2013.05.22 20:10:45 | 000,000,000 | ---D | C] -- C:\Users\...\Desktop\F&I

[2013.05.22 20:04:56 | 000,000,000 | ---D | C] -- C:\Users\...\Desktop\Rechnungen für Investitionen und Finanzierungen

[2013.05.02 19:32:07 | 000,000,000 | ---D | C] -- C:\Users\...\Desktop\Vhannibal E1 Dual Feeds 25 apr

[2013.05.02 19:30:47 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dreamboxEDIT

[2013.05.02 19:30:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\dreamboxEDIT

[2013.05.02 18:23:46 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\TeamViewer

[2013.05.01 16:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts

[2013.05.01 16:10:10 | 000,000,000 | ---D | C] -- C:\Users\...\Documents\FUSSBALL MANAGER 10

[2013.05.01 15:54:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA SPORTS

[1 C:\Users\...\AppData\Roaming\*.tmp files -> C:\Users\...\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.27 10:50:33 | 000,000,000 | ---- | M] () -- C:\Users\...\defogger_reenable

[2013.05.27 10:46:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\...\Desktop\OTL.exe

[2013.05.27 10:45:31 | 000,050,477 | ---- | M] () -- C:\Users\...\Desktop\Defogger.exe

[2013.05.27 10:36:12 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.27 10:36:12 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.27 10:35:47 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.27 10:35:47 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.27 10:35:47 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.27 10:35:47 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.27 10:35:47 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.27 10:28:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.27 10:28:27 | 3219,890,176 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.05 00:54:32 | 000,103,463 | ---- | M] () -- C:\Users\...\Desktop\Unbenannt.PNG

[2013.05.02 21:28:00 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1906196563-1151653495-1530203156-1001UA.job

[2013.05.02 19:30:47 | 000,001,953 | ---- | M] () -- C:\Users\...\Desktop\dreamboxEDIT.lnk

[2013.05.01 15:55:07 | 000,001,135 | ---- | M] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

[1 C:\Users\...\AppData\Roaming\*.tmp files -> C:\Users\...\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.05.27 10:50:33 | 000,000,000 | ---- | C] () -- C:\Users\...\defogger_reenable

[2013.05.27 10:45:00 | 000,050,477 | ---- | C] () -- C:\Users\...\Desktop\Defogger.exe

[2013.05.05 00:54:32 | 000,103,463 | ---- | C] () -- C:\Users\...\Desktop\Unbenannt.PNG

[2013.05.02 19:30:47 | 000,001,953 | ---- | C] () -- C:\Users\...\Desktop\dreamboxEDIT.lnk

[2013.05.01 15:55:07 | 000,001,147 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Download Manager.lnk

[2013.05.01 15:55:07 | 000,001,135 | ---- | C] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

[2013.04.18 18:28:26 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll

[2012.09.22 15:49:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2012.09.10 20:43:21 | 000,003,584 | ---- | C] () -- C:\Users\...\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.09.02 21:32:03 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad

[2012.08.24 22:28:00 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad

[2012.04.15 00:48:03 | 000,000,016 | ---- | C] () -- C:\Users\...\AppData\Roaming\blckdom.res

[2012.03.11 13:30:32 | 006,904,040 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe

[2011.11.25 13:27:32 | 000,001,065 | ---- | C] () -- C:\Windows\winamp.ini

[2011.10.24 21:02:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2011.12.26 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\1&1 Mail & Media GmbH

[2012.04.16 07:17:30 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\11013

[2013.04.18 18:28:37 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\Babylon

[2012.03.11 13:31:23 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\dBpoweramp

[2013.05.27 10:30:24 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\Dropbox

[2011.11.25 16:47:02 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\DVDVideoSoft

[2011.11.25 16:46:43 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\DVDVideoSoftIEHelpers

[2013.03.05 20:57:02 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\elsterformular

[2011.12.06 19:45:17 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\Engelmann Media

[2012.04.16 07:02:25 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\gizza

[2012.04.15 00:47:52 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\kock

[2012.02.06 22:05:26 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\OpenOffice.org

[2012.09.10 20:43:21 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\Solveig Multimedia

[2013.05.02 18:23:46 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\TeamViewer

[2012.04.15 19:56:59 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\UAs

[2012.09.20 19:54:44 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\WindSolutions

[2012.04.15 19:57:37 | 000,000,000 | ---D | M] -- C:\Users\...\AppData\Roaming\xmldm

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

EXTRA TXT

OTL Logfile:

Code:

OTL Extras logfile created on: 27.05.2013 10:55:35 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\...\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16540)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,54 Gb Available Physical Memory | 63,49% Memory free

7,99 Gb Paging File | 6,50 Gb Available in Paging File | 81,32% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465,76 Gb Total Space | 237,55 Gb Free Space | 51,00% Space Free | Partition Type: NTFS

 

Computer Name: ...-PC | User Name: ...| Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{01B12A1B-E9A3-44D4-AE45-363157F3FF3E}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{066E72E2-4442-4087-A36E-6A6A37F3A34E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{10115868-B8E1-4FE2-84D6-163823BC9F8F}" = rport=445 | protocol=6 | dir=out | app=system | 

"{33F2C736-AA0E-41E6-A84A-F51278A64535}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{390D7E2B-CBCD-49B5-9D1F-BBE1BD0A0D7E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{3BD3D120-2CC2-401F-9A6D-8E5A0991598F}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{513FDC85-D06C-4C97-ADE2-7C3A3FE45910}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{5326B715-6C14-42A0-98EC-080EF8FC7095}" = lport=138 | protocol=17 | dir=in | app=system | 

"{563843DD-45CC-4EF5-B8E2-4D2AD3533023}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{579E7280-316D-4592-BDE9-F95C0109C53B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{65CB68BD-5835-4EFE-A646-4ECF9DE97765}" = lport=445 | protocol=6 | dir=in | app=system | 

"{72521D06-0A49-429F-83BA-4EB977AE27B2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{809DFD66-7B85-4DFA-8D35-072F8FF37181}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{9A8DE2EC-2D4A-4713-A418-4241A7DA3DFB}" = rport=138 | protocol=17 | dir=out | app=system | 

"{A0D8EAED-B941-4266-BFE0-971FBE19978E}" = rport=139 | protocol=6 | dir=out | app=system | 

"{A952043E-3147-435B-BF4D-FBE6DE1665DA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{AAD8CBDF-A9EA-4E98-A9E8-338ED3471F2A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{AF1D087A-8952-4AE2-A6FD-6F331C0626CA}" = lport=139 | protocol=6 | dir=in | app=system | 

"{C4102030-16F0-4B56-B700-975A71E340BA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{DDD957E8-4232-49E5-8418-DCAE8719D04E}" = lport=137 | protocol=17 | dir=in | app=system | 

"{E01B1F5B-B6A8-4D29-B4FA-16D7BB1FFDF0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{E5CFD396-6C8A-43AC-B28F-09D345A4A4F0}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 

"{EF26A214-6017-4E29-9CFD-76927BE5682E}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{EF5C2993-B3E2-435C-8D3D-B4455BF7C477}" = rport=137 | protocol=17 | dir=out | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{176A8B15-3F14-4C91-A9DB-ACDB318F2763}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{26937C04-F607-4A10-8F11-74F0EFBF32A1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{2B2F4AF7-678E-401E-84FA-BCC524360D35}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{3A776B90-5EED-4990-9B64-D2CDB6F7E915}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4D1AA35A-F904-47BE-904D-28538974C0C6}" = protocol=6 | dir=in | app=c:\users\...\appdata\roaming\dropbox\bin\dropbox.exe | 

"{51D90732-C7EE-4AC1-8819-D3119EC9AFA6}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{52CDF28B-7D37-4A38-93D8-9977F491CBCA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{58629296-F0C8-45BB-8359-02A2273D63E4}" = protocol=6 | dir=in | app=c:\program files (x86)\veetle\player\veetlenet.exe | 

"{6053A891-6EDB-4B02-97A7-EE9248CE18AC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{668AF7F5-496A-4003-AB6E-56E899AE8EF3}" = protocol=6 | dir=out | app=system | 

"{6C9AEC4D-BC7C-4784-92AC-FB55B5ECE86E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{6CC1BC3B-FA65-43A0-AA6E-3BADD4946173}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{823B7A41-9B0F-44F2-BA1C-937AE1067F74}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{855BF7A7-7D50-4BC2-8972-B5D5973C0541}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{9608166D-3A87-48D8-963A-F63B70DA1F1F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{A0F9B2F2-DC6E-42D9-974F-4DF8F7DD861A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{A9FD9EF8-41E5-4EB0-8F4A-93392691F5F7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B7E14F41-8C8E-4116-96B0-01543FF64AA0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B9326A72-49A6-412C-BDCA-918DF82E714B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{C07E557B-F527-4228-A40E-155A0B52D69D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{C224FAAE-7063-4F80-B434-A12329FA3E01}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{C4A28341-F5A7-43EC-95F2-3D4C54BB809A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{CBBEAD36-6746-42BB-BE30-B0ACD8E26424}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{D15A1FE6-C4A6-4307-9264-BDAC2F483F66}" = protocol=17 | dir=in | app=c:\users\...\appdata\roaming\dropbox\bin\dropbox.exe | 

"{D3E26C0C-3C4C-4665-96F8-838FD20C227A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{D6D8F935-AB3A-492C-9924-699362E27213}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{D8A5468B-2EA6-4C35-82BF-9B20A6F9A5E7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{EFA3431E-C069-42C1-8FFE-96589775645C}" = dir=in | app=c:\users\...\appdata\local\microsoft\skydrive\skydrive.exe | 

"{F272928B-19D4-438E-8910-9C270CDE0A29}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{F9C58A04-BD81-4B40-9DEE-813E5768B42B}" = dir=in | app=c:\users\...\appdata\local\facebook\video\skype\facebookvideocalling.exe | 

"TCP Query User{0DD02908-669C-4CD9-BE19-E81C974C33F3}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"TCP Query User{B38308FD-8EC9-4038-B06D-908FFFE27FAB}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"TCP Query User{DF3D6A2F-6130-4070-B52D-3480D0569421}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe | 

"UDP Query User{0971E77D-E422-4336-9A5D-E8B9BC6205BE}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"UDP Query User{78ED4CF2-966D-4718-AEBD-9633E37A96B8}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe | 

"UDP Query User{95883683-4C44-41B8-9659-A185EAA0AA1D}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

"{5800B5A7-176D-C773-7BA0-AABB25C57591}" = ATI Problem Report Wizard

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter

"{62803CAB-203F-6307-BCCE-27B5E5A01419}" = ccc-utility64

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007

"{911C72E0-D841-BC96-C433-BE0DE64BFE35}" = ATI Catalyst Install Manager

"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = Windows Mobile-Gerätecenter: Treiberupdate

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{CB5340E7-7745-7B18-1413-C14508C2AC2B}" = ATI AVIVO64 Codecs

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"WinRAR archiver" = WinRAR 4.01 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{04B989A5-70D0-3DDB-B88A-629F31D98814}" = CCC Help Korean

"{06036CDA-6B67-1338-5886-9B7DEB2491C6}" = Catalyst Control Center Graphics Full New

"{1A46E1D3-0E8A-B75C-28A3-2DD05838A21B}" = CCC Help Italian

"{1EF419E0-E1FC-2990-C86B-BBB15D51F057}" = Catalyst Control Center Graphics Full Existing

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{23F612EA-0F86-472F-2DCE-5C82DDBCC148}" = CCC Help Greek

"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22

"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29

"{2DB5CB5C-5EA0-D22D-5223-0B57A3A57525}" = CCC Help Czech

"{3124232A-A9AB-2FAD-6462-454921EDDCDE}" = CCC Help Norwegian

"{3D98AE11-B5A5-1EDB-F815-B1C2DA7BE1DB}" = Catalyst Control Center InstallProxy

"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3

"{4363FE00-52E3-E8B5-58EE-1CB396D68000}" = CCC Help Russian

"{46059418-BB80-F9D4-8DBC-813C28883022}" = CCC Help Chinese Standard

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4B1BD47B-51CF-0C0E-21AB-027B331EDFD5}" = CCC Help English

"{4B6E9F7F-7DEE-8570-0FEB-305E000BB462}" = ccc-core-static

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1

"{52FB9C98-2704-DAF1-8999-11EC1C14EB3C}" = Catalyst Control Center Localization All

"{553D7A1E-D263-FBF7-68E0-EA10865BC478}" = CCC Help Dutch

"{58DBB693-BE6E-DA0F-42DE-3944FA9229F9}" = Catalyst Control Center HydraVision Full

"{58F3E8F1-E7CE-B5E8-AF18-C1F1B7C6FB03}" = Catalyst Control Center Graphics Previews Vista

"{6582B077-4BC5-3383-4F6D-1F0BC0279120}" = CCC Help Hungarian

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{669B7CF5-FC58-AE3C-EDB1-3950A5E45920}" = Catalyst Control Center Graphics Previews Common

"{6E0D0ABC-22CF-8CBB-F3E9-14776A25AA82}" = CCC Help Japanese

"{74CCE403-68F5-7CC9-967B-976229BF5180}" = CCC Help Chinese Traditional

"{7CC15B5F-DDA9-43D6-E53F-EE0CCBC8DB1A}" = CCC Help Danish

"{80AA9FA1-CA39-FC76-D4CE-A5E6C659F4C7}" = CCC Help Portuguese

"{82FB3E3F-1A3F-BBF2-0926-C92F6974EC91}" = Catalyst Control Center Graphics Light

"{85F82863-A6DB-E29B-6B81-4A8582180679}" = CCC Help Thai

"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.16

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller  Driver

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-002A-0000-1000-0000000FF1CE}_PROHYBRIDR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002A-0407-1000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{98A55952-7BE9-0869-A062-B6E402CCBF85}" = CCC Help Spanish

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A68F5819-0EF7-72E5-41B4-F26EFC453553}" = CCC Help Finnish

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch

"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy

"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287

"{CE8C262E-5DB4-C8AC-7DA2-DC88767653A1}" = HydraVision

"{CF8C33F5-9279-5A08-7EA0-5624E6D5AD55}" = Catalyst Control Center Core Implementation

"{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}" = Catalyst Control Center - Branding

"{D83BFF4C-FBB6-5A62-C27C-EF5612626205}" = CCC Help German

"{E000847A-AA69-E617-B038-217F8995FC4A}" = CCC Help French

"{E2300343-26C4-11DA-7E89-FD35E1C6FDDA}" = CCC Help Polish

"{E46C4D1B-39D0-4A9F-0001-6529DDC11226}" = CDRWIN 9 Basic

"{E59F4CC1-E338-7141-5B1C-1F4ADF371A87}" = CCC Help Swedish

"{F00B33C1-9F1C-FEA5-52EF-EE612E498D8D}" = CCC Help Turkish

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Avira AntiVir Desktop" = Avira Free Antivirus

"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1

"Cossacks : Back To War" = Cossacks - Back To War

"dreamboxEDIT" = dreamboxEDIT -- The one and only settings editor for your Dreambox

"E.M. Free Photo Collage 1.30_is1" = E.M. Free Photo Collage 1.30

"EADM" = EA Download Manager

"ElsterFormular" = ElsterFormular

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.13.1123

"FUSSBALL MANAGER 10" = FUSSBALL MANAGER 10

"HandWallet" = HandWallet

"HyperCam 3" = HyperCam 3

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"McAfee Security Scan" = McAfee Security Scan Plus

"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Picasa 3" = Picasa 3

"PokerStars" = PokerStars

"PROHYBRIDR" = 2007 Microsoft Office system

"SopCast" = SopCast 3.4.8

"Sparfuchs_is1" = Sparfuchs

"Updater Service" = Updater Service

"Veetle TV" = Veetle TV

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"SkyDriveSetup.exe" = Microsoft SkyDrive

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 18.02.2013 14:30:57 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:57 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:58 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:58 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:58 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:59 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:59 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:30:59 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:31:00 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

Error - 18.02.2013 14:31:00 | Computer Name = PC | Source = .NET Runtime Optimization Service | ID = 1101

Description = 

 

[ Spybot - Search and Destroy Events ]

Error - 07.03.2013 16:44:09 | Computer Name = PC | Source = SDCleaner | ID = 100

Description = LoadCleaningInstructions

 

[ System Events ]

Error - 26.05.2013 07:31:44 | Computer Name = PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

Error - 26.05.2013 07:32:23 | Computer Name = PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Updater Service" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%2

 

Error - 26.05.2013 08:26:04 | Computer Name = PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

Error - 26.05.2013 08:27:20 | Computer Name = PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Updater Service" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%2

 

Error - 26.05.2013 14:04:30 | Computer Name = PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

Error - 26.05.2013 14:04:54 | Computer Name = PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Updater Service" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%2

 

Error - 26.05.2013 14:04:58 | Computer Name = PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Avira Echtzeit Scanner" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%306.

 

Error - 27.05.2013 04:28:22 | Computer Name = PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6

Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 

im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich

 an den Computerhersteller, um aktualisierte Firmware zu erhalten.

 

Error - 27.05.2013 04:28:40 | Computer Name = PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Updater Service" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%2

 

Error - 27.05.2013 04:28:44 | Computer Name = PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Avira Echtzeit Scanner" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%306.

 

 

< End of report >

--- --- ---

GMER

GMER Logfile:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-05-27 11:44:26

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000004d SAMSUNG_ rev.1AJ1 465,76GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\...\AppData\Local\Temp\kxdiapow.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[1784] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69   00000000757d1465 2 bytes [7D, 75]

.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[1784] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155  00000000757d14bb 2 bytes [7D, 75]

.text  ...                                                                                                                            * 2

.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000757d1465 2 bytes [7D, 75]

.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000757d14bb 2 bytes [7D, 75]

.text  ...                                                                                                                            * 2
 

---- EOF - GMER 2.1 ----

--- --- ---

Hi,

da bleibt noch en vissl Arbeit.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Danke :)

Combofix Logfile:

Code:

ComboFix 13-05-27.01 - Pietro 27.05.2013  14:17:14.1.3 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4094.2945 [GMT 2:00]

ausgeführt von:: c:\users\Pietro\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\programdata\ism_0_llatsni.pad

c:\programdata\nud0repor.pad

c:\users\Pietro\AppData\Roaming\AcroIEHelpe.txt

c:\users\Pietro\AppData\Roaming\srvblck5.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-27 bis 2013-05-27  ))))))))))))))))))))))))))))))

.

.

2013-05-27 12:24 . 2013-05-27 12:24        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-05-27 12:22 . 2013-05-27 12:22        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{37F2BDFD-22DC-4FDF-9E47-F61C38C70511}\offreg.dll

2013-05-27 08:44 . 2013-05-13 23:48        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{37F2BDFD-22DC-4FDF-9E47-F61C38C70511}\mpengine.dll

2013-05-27 08:43 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2013-05-27 08:43 . 2013-04-10 06:01        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-05-27 08:43 . 2011-02-03 11:25        144384        ----a-w-        c:\windows\system32\cdd.dll

2013-05-27 08:43 . 2013-02-27 05:52        14172672        ----a-w-        c:\windows\system32\shell32.dll

2013-05-27 08:43 . 2013-02-27 05:52        197120        ----a-w-        c:\windows\system32\shdocvw.dll

2013-05-27 08:43 . 2013-02-27 05:48        1930752        ----a-w-        c:\windows\system32\authui.dll

2013-05-27 08:43 . 2013-02-27 06:02        111448        ----a-w-        c:\windows\system32\consent.exe

2013-05-27 08:43 . 2013-02-27 04:49        1796096        ----a-w-        c:\windows\SysWow64\authui.dll

2013-05-27 08:43 . 2013-02-27 05:47        70144        ----a-w-        c:\windows\system32\appinfo.dll

2013-05-27 08:42 . 2013-03-19 05:53        48640        ----a-w-        c:\windows\system32\wwanprotdim.dll

2013-05-27 08:42 . 2013-03-19 05:53        230400        ----a-w-        c:\windows\system32\wwansvc.dll

2013-05-27 08:42 . 2013-04-10 03:30        3153920        ----a-w-        c:\windows\system32\win32k.sys

2013-05-26 18:09 . 2013-05-26 18:09        262552        ----a-w-        c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll

2013-05-26 14:38 . 2013-05-26 20:01        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0

2013-05-02 17:30 . 2013-05-02 17:30        --------        d-----w-        c:\program files (x86)\dreamboxEDIT

2013-05-02 16:23 . 2013-05-02 16:23        --------        d-----w-        c:\users\Pietro\AppData\Roaming\TeamViewer

2013-05-01 14:33 . 2013-05-01 14:33        --------        d-----w-        c:\programdata\Electronic Arts

2013-05-01 13:54 . 2013-05-01 13:54        --------        d-----w-        c:\program files (x86)\EA SPORTS

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-27 10:02 . 2013-01-17 18:13        75016696        ----a-w-        c:\windows\system32\MRT.exe

2013-05-02 00:06 . 2011-10-24 19:21        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-13 05:49 . 2013-05-27 08:43        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-27 08:43        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-27 08:43        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-27 08:43        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-27 08:43        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-27 08:43        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-12 14:45 . 2013-04-24 18:49        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-03-24 19:38 . 2013-03-24 19:38        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-03-24 19:38 . 2013-03-24 19:38        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-03-24 19:38 . 2013-03-24 19:38        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-03-24 19:38 . 2013-03-24 19:38        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-24 19:38 . 2013-03-24 19:38        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-03-24 19:38 . 2013-03-24 19:38        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-03-24 19:38 . 2013-03-24 19:38        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-03-24 19:38 . 2013-03-24 19:38        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-03-24 19:38 . 2013-03-24 19:38        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-03-24 19:38 . 2013-03-24 19:38        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-03-24 19:38 . 2013-03-24 19:38        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-03-24 19:38 . 2013-03-24 19:38        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-03-24 19:38 . 2013-03-24 19:38        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-03-24 19:38 . 2013-03-24 19:38        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-03-24 19:38 . 2013-03-24 19:38        441856        ----a-w-        c:\windows\system32\html.iec

2013-03-24 19:38 . 2013-03-24 19:38        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-03-24 19:38 . 2013-03-24 19:38        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-03-24 19:38 . 2013-03-24 19:38        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-03-24 19:38 . 2013-03-24 19:38        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-03-24 19:38 . 2013-03-24 19:38        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-03-24 19:38 . 2013-03-24 19:38        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-03-24 19:38 . 2013-03-24 19:38        235008        ----a-w-        c:\windows\system32\url.dll

2013-03-24 19:38 . 2013-03-24 19:38        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-03-24 19:38 . 2013-03-24 19:38        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-03-24 19:38 . 2013-03-24 19:38        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-03-24 19:38 . 2013-03-24 19:38        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-03-24 19:38 . 2013-03-24 19:38        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-03-24 19:38 . 2013-03-24 19:38        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-03-24 19:38 . 2013-03-24 19:38        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-03-24 19:38 . 2013-03-24 19:38        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-03-24 19:38 . 2013-03-24 19:38        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-03-24 19:38 . 2013-03-24 19:38        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-03-24 19:38 . 2013-03-24 19:38        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-03-24 19:38 . 2013-03-24 19:38        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-03-24 19:38 . 2013-03-24 19:38        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-03-24 19:38 . 2013-03-24 19:38        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-03-24 19:38 . 2013-03-24 19:38        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-03-24 19:38 . 2013-03-24 19:38        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-03-24 19:38 . 2013-03-24 19:38        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-03-24 19:38 . 2013-03-24 19:38        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-03-24 19:38 . 2013-03-24 19:38        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-03-24 19:38 . 2013-03-24 19:38        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-03-24 19:38 . 2013-03-24 19:38        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-03-24 19:38 . 2013-03-24 19:38        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-03-24 19:38 . 2013-03-24 19:38        149504        ----a-w-        c:\windows\system32\occache.dll

2013-03-24 19:38 . 2013-03-24 19:38        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-03-24 19:38 . 2013-03-24 19:38        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-03-24 19:38 . 2013-03-24 19:38        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-03-24 19:38 . 2013-03-24 19:38        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-03-19 06:04 . 2013-04-11 18:35        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-03-19 05:46 . 2013-04-11 18:35        43520        ----a-w-        c:\windows\system32\csrsrv.dll

2013-03-19 05:04 . 2013-04-11 18:35        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-11 18:35        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47 . 2013-04-11 18:35        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll

2013-03-19 03:06 . 2013-04-11 18:35        112640        ----a-w-        c:\windows\system32\smss.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2013-01-03 21:16        220632        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2013-01-03 21:16        220632        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2013-01-03 21:16        220632        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        130736        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        130736        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        130736        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 2583040]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-18 98304]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-18 348664]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

c:\users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Pietro\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-4-12 27156136]

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0\0sdnclean64.exe

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 IBUpdaterService;Updater Service;c:\programdata\IBUpdaterService\ibsvc.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-19 102368]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-02-05 235216]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-08-02 22528]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-19 203104]

R3 ssudserd;SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudserd.sys [2013-02-06 203544]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-09 1255736]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 27760]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-19 202752]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]

S3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-30 236544]

S3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [2008-05-21 583168]

S3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [2008-05-21 8192]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-09-17 1250816]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

Inhalt des "geplante Tasks" Ordners

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2013-01-03 21:16        244696        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2013-01-03 21:16        244696        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2013-01-03 21:16        244696        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube to MP3 Converter - c:\users\Pietro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 213.191.74.18 62.109.123.196

FF - ProfilePath - c:\users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\

FF - prefs.js: network.proxy.type - 0

FF - user.js: extensions.delta.tlbrSrchUrl - 

FF - user.js: extensions.delta.id - 701c861d00000000000000252235ab82

FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

FF - user.js: extensions.delta.instlDay - 15813

FF - user.js: extensions.delta.vrsn - 1.8.16.16

FF - user.js: extensions.delta.vrsni - 1.8.16.16

FF - user.js: extensions.delta.vrsnTs - 1.8.16.1618:28

FF - user.js: extensions.delta.prtnrId - delta

FF - user.js: extensions.delta.prdct - delta

FF - user.js: extensions.delta.aflt - babsst

FF - user.js: extensions.delta.smplGrp - none

FF - user.js: extensions.delta.tlbrId - base

FF - user.js: extensions.delta.instlRef - sst

FF - user.js: extensions.delta.dfltLng - en

FF - user.js: extensions.delta.excTlbr - false

FF - user.js: extensions.delta.ffxUnstlRst - true

FF - user.js: extensions.delta.admin - false

FF - user.js: extensions.delta.autoRvrt - false

FF - user.js: extensions.delta.rvrt - false

FF - user.js: extensions.delta.newTab - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

AddRemove-Updater Service - c:\programdata\IBUpdaterService\ibsvc.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1906196563-1151653495-1530203156-1001\Software\SecuROM\License information*]

"datasecu"=hex:5d,71,35,7d,98,9a,f5,5a,1a,61,cd,ad,a3,b7,b5,d7,16,93,2e,bb,c6,

   cc,fb,02,51,5f,7c,42,49,b5,29,cc,52,d9,bc,44,5b,7d,8f,66,c4,6a,d1,82,e6,bd,\

"rkeysecu"=hex:3d,2a,25,25,c0,cc,01,81,16,c7,57,ed,c8,13,8a,4f

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-05-27  14:27:19

ComboFix-quarantined-files.txt  2013-05-27 12:27

.

Vor Suchlauf: 8 Verzeichnis(se), 258.183.180.288 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 258.883.641.344 Bytes frei

.

- - End Of File - - 16CF5825C900B9AFF4CAA3C75EF387D7

--- --- ---

hi,

Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:

Driver:: IBUpdaterService Folder:: c:\programdata\IBUpdaterService Firefox:: FF - ProfilePath - c:\users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\ FF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - 701c861d00000000000000252235ab82 FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} FF - user.js: extensions.delta.instlDay - 15813 FF - user.js: extensions.delta.vrsn - 1.8.16.16 FF - user.js: extensions.delta.vrsni - 1.8.16.16 FF - user.js: extensions.delta.vrsnTs - 1.8.16.1618:28 FF - user.js: extensions.delta.prtnrId - delta FF - user.js: extensions.delta.prdct - delta FF - user.js: extensions.delta.aflt - babsst FF - user.js: extensions.delta.smplGrp - none FF - user.js: extensions.delta.tlbrId - base FF - user.js: extensions.delta.instlRef - sst FF - user.js: extensions.delta.dfltLng - en FF - user.js: extensions.delta.excTlbr - false FF - user.js: extensions.delta.ffxUnstlRst - true FF - user.js: extensions.delta.admin - false FF - user.js: extensions.delta.autoRvrt - false FF - user.js: extensions.delta.rvrt - false FF - user.js: extensions.delta.newTab - false

Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Und zum Schluss bitte ein frisches OTL logfile.

Hi habe combofix wie beschrieben laufen lassen . Nach dem automatischen Neustart lässt sich nichts mehr öffnen. ..
Egal was ich öffnen möchte kommt ein pop up c:/ Program files...

Es wurde versucht, einen registrierungsschlüssel einem unzulässigen vorgang zu unterziehen, der zum löschen markiert wurde

Rechner einmal neustarten bitte :)

daaaanke

Combofix

Combofix Logfile:

Code:

ComboFix 13-05-27.01 - Pietro 27.05.2013  15:39:04.2.3 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4094.2962 [GMT 2:00]

ausgeführt von:: c:\users\Pietro\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Pietro\Desktop\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\IBUpdaterService

c:\programdata\IBUpdaterService\repository.xml

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_IBUpdaterService

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-27 bis 2013-05-27  ))))))))))))))))))))))))))))))

.

.

2013-05-27 09:57 . 2013-04-05 04:43        2706432        ----a-w-        c:\windows\system32\mshtml.tlb

2013-05-27 08:44 . 2013-05-13 23:48        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{37F2BDFD-22DC-4FDF-9E47-F61C38C70511}\mpengine.dll

2013-05-27 08:43 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2013-05-27 08:43 . 2013-04-10 06:01        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-05-27 08:43 . 2011-02-03 11:25        144384        ----a-w-        c:\windows\system32\cdd.dll

2013-05-27 08:43 . 2013-02-27 05:52        14172672        ----a-w-        c:\windows\system32\shell32.dll

2013-05-27 08:43 . 2013-02-27 05:52        197120        ----a-w-        c:\windows\system32\shdocvw.dll

2013-05-27 08:43 . 2013-02-27 05:48        1930752        ----a-w-        c:\windows\system32\authui.dll

2013-05-27 08:43 . 2013-02-27 06:02        111448        ----a-w-        c:\windows\system32\consent.exe

2013-05-27 08:43 . 2013-02-27 04:49        1796096        ----a-w-        c:\windows\SysWow64\authui.dll

2013-05-27 08:43 . 2013-02-27 05:47        70144        ----a-w-        c:\windows\system32\appinfo.dll

2013-05-27 08:42 . 2013-03-19 05:53        48640        ----a-w-        c:\windows\system32\wwanprotdim.dll

2013-05-27 08:42 . 2013-03-19 05:53        230400        ----a-w-        c:\windows\system32\wwansvc.dll

2013-05-27 08:42 . 2013-04-10 03:30        3153920        ----a-w-        c:\windows\system32\win32k.sys

2013-05-26 18:09 . 2013-05-26 18:09        262552        ----a-w-        c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll

2013-05-26 14:38 . 2013-05-26 20:01        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0

2013-05-02 17:30 . 2013-05-02 17:30        --------        d-----w-        c:\program files (x86)\dreamboxEDIT

2013-05-02 16:23 . 2013-05-02 16:23        --------        d-----w-        c:\users\Pietro\AppData\Roaming\TeamViewer

2013-05-01 14:33 . 2013-05-01 14:33        --------        d-----w-        c:\programdata\Electronic Arts

2013-05-01 13:54 . 2013-05-01 13:54        --------        d-----w-        c:\program files (x86)\EA SPORTS

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-27 10:02 . 2013-01-17 18:13        75016696        ----a-w-        c:\windows\system32\MRT.exe

2013-05-02 00:06 . 2011-10-24 19:21        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-13 05:49 . 2013-05-27 08:43        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-27 08:43        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-27 08:43        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-27 08:43        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-27 08:43        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-27 08:43        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-12 14:45 . 2013-04-24 18:49        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-03-24 19:38 . 2013-03-24 19:38        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-03-24 19:38 . 2013-03-24 19:38        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-03-24 19:38 . 2013-03-24 19:38        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-03-24 19:38 . 2013-03-24 19:38        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-24 19:38 . 2013-03-24 19:38        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-03-24 19:38 . 2013-03-24 19:38        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-03-24 19:38 . 2013-03-24 19:38        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-03-24 19:38 . 2013-03-24 19:38        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-03-24 19:38 . 2013-03-24 19:38        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-03-24 19:38 . 2013-03-24 19:38        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-03-24 19:38 . 2013-03-24 19:38        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-03-24 19:38 . 2013-03-24 19:38        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-03-24 19:38 . 2013-03-24 19:38        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-03-24 19:38 . 2013-03-24 19:38        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-03-24 19:38 . 2013-03-24 19:38        441856        ----a-w-        c:\windows\system32\html.iec

2013-03-24 19:38 . 2013-03-24 19:38        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-03-24 19:38 . 2013-03-24 19:38        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-03-24 19:38 . 2013-03-24 19:38        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-03-24 19:38 . 2013-03-24 19:38        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-03-24 19:38 . 2013-03-24 19:38        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-03-24 19:38 . 2013-03-24 19:38        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-03-24 19:38 . 2013-03-24 19:38        235008        ----a-w-        c:\windows\system32\url.dll

2013-03-24 19:38 . 2013-03-24 19:38        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-03-24 19:38 . 2013-03-24 19:38        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-03-24 19:38 . 2013-03-24 19:38        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-03-24 19:38 . 2013-03-24 19:38        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-03-24 19:38 . 2013-03-24 19:38        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-03-24 19:38 . 2013-03-24 19:38        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-03-24 19:38 . 2013-03-24 19:38        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-03-24 19:38 . 2013-03-24 19:38        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-03-24 19:38 . 2013-03-24 19:38        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-03-24 19:38 . 2013-03-24 19:38        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-03-24 19:38 . 2013-03-24 19:38        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-03-24 19:38 . 2013-03-24 19:38        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-03-24 19:38 . 2013-03-24 19:38        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-03-24 19:38 . 2013-03-24 19:38        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-03-24 19:38 . 2013-03-24 19:38        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-03-24 19:38 . 2013-03-24 19:38        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-03-24 19:38 . 2013-03-24 19:38        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-03-24 19:38 . 2013-03-24 19:38        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-03-24 19:38 . 2013-03-24 19:38        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-03-24 19:38 . 2013-03-24 19:38        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-03-24 19:38 . 2013-03-24 19:38        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-03-24 19:38 . 2013-03-24 19:38        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-03-24 19:38 . 2013-03-24 19:38        149504        ----a-w-        c:\windows\system32\occache.dll

2013-03-24 19:38 . 2013-03-24 19:38        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-03-24 19:38 . 2013-03-24 19:38        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-03-24 19:38 . 2013-03-24 19:38        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-03-24 19:38 . 2013-03-24 19:38        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-03-19 06:04 . 2013-04-11 18:35        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-03-19 05:46 . 2013-04-11 18:35        43520        ----a-w-        c:\windows\system32\csrsrv.dll

2013-03-19 05:04 . 2013-04-11 18:35        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-11 18:35        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47 . 2013-04-11 18:35        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll

2013-03-19 03:06 . 2013-04-11 18:35        112640        ----a-w-        c:\windows\system32\smss.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2013-01-03 21:16        220632        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2013-01-03 21:16        220632        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2013-01-03 21:16        220632        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        130736        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        130736        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        130736        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 2583040]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-18 98304]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-18 348664]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

c:\users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Pietro\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-4-12 27156136]

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0\0sdnclean64.exe

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-19 102368]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-02-05 235216]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-08-02 22528]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-19 203104]

R3 ssudserd;SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudserd.sys [2013-02-06 203544]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-09 1255736]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 27760]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-19 202752]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]

S3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-30 236544]

S3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [2008-05-21 583168]

S3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [2008-05-21 8192]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-09-17 1250816]

.

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2013-01-03 21:16        244696        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2013-01-03 21:16        244696        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2013-01-03 21:16        244696        ----a-w-        c:\users\Pietro\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-11 23:08        164016        ----a-w-        c:\users\Pietro\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube to MP3 Converter - c:\users\Pietro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 213.191.74.18 62.109.123.196

FF - ProfilePath - c:\users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\

FF - prefs.js: network.proxy.type - 0

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-Updater Service - c:\programdata\IBUpdaterService\ibsvc.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1906196563-1151653495-1530203156-1001\Software\SecuROM\License information*]

"datasecu"=hex:5d,71,35,7d,98,9a,f5,5a,1a,61,cd,ad,a3,b7,b5,d7,16,93,2e,bb,c6,

   cc,fb,02,51,5f,7c,42,49,b5,29,cc,52,d9,bc,44,5b,7d,8f,66,c4,6a,d1,82,e6,bd,\

"rkeysecu"=hex:3d,2a,25,25,c0,cc,01,81,16,c7,57,ed,c8,13,8a,4f

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-05-27  15:48:24 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-05-27 13:48

ComboFix2.txt  2013-05-27 12:27

.

Vor Suchlauf: 12 Verzeichnis(se), 258.584.039.424 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 258.139.693.056 Bytes frei

.

- - End Of File - - C2D586B805BFF337C9A58FAF1D3FA720

--- --- ---

ADW CleanerAdwCleaner Logfile:

Code:

# AdwCleaner v2.301 - Datei am 27/05/2013 um 16:04:26 erstellt

# Aktualisiert am 16/05/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Pietro - PIETRO-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Pietro\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

Datei Gelöscht : C:\Users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\searchplugins\delta.xml

Datei Gelöscht : C:\Users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\searchplugins\search.xml

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\Users\Pietro\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\Pietro\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\extensions\specialsavings@superfish.com
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\5c6df8abc3aed15

Schlüssel Gelöscht : HKLM\Software\Babylon

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5c6df8abc3aed15

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [specialsavings@superfish.com]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16576
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v21.0 (de)
 

Datei : C:\Users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\prefs.js
 

C:\Users\Pietro\AppData\Roaming\Mozilla\Firefox\Profiles\39tdm9so.default\user.js ... Gelöscht !
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [2120 octets] - [27/05/2013 16:04:26]
 

########## EOF - C:\AdwCleaner[S1].txt - [2180 octets] ##########

--- --- ---

ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=511dc80fc0ea5047bf815739c296fcf0
# engine=13925
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-27 05:01:16
# local_time=2013-05-27 07:01:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 99 18043 235097366 10796 0
# compatibility_mode=5893 16776573 100 94 11876 121303926 0 0
# scanned=184296
# found=0
# cleaned=0
# scan_time=9547

OTL Logfile:

Code:

OTL logfile created on: 27.05.2013 19:04:02 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Pietro\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,45 Gb Available Physical Memory | 61,36% Memory free

7,99 Gb Paging File | 6,31 Gb Available in Paging File | 78,94% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465,76 Gb Total Space | 239,96 Gb Free Space | 51,52% Space Free | Partition Type: NTFS

 

Computer Name: PIETRO-PC | User Name: Pietro | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.27 10:46:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pietro\Desktop\OTL.exe

PRC - [2013.05.26 20:09:37 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

PRC - [2012.08.18 19:57:40 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.05.09 06:29:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.09 06:29:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.05.26 20:09:37 | 003,128,728 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2009.09.19 04:17:40 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2013.05.26 20:09:37 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)

SRV - [2013.01.08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.05.09 06:29:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.05.09 06:29:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007.05.31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.02.06 08:42:08 | 000,203,544 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudserd.sys -- (ssudserd)

DRV:64bit: - [2012.09.19 11:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)

DRV:64bit: - [2012.09.19 11:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)

DRV:64bit: - [2012.07.09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2012.05.09 06:29:34 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.05.09 06:29:34 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.08.02 17:38:44 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009.10.20 18:20:36 | 000,114,608 | ---- | M] (Philips Applied Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\phaudlwr.sys -- (phaudlwr)

DRV:64bit: - [2009.09.19 06:32:36 | 006,170,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.09.17 13:04:18 | 001,250,816 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2009.08.23 16:02:30 | 000,120,336 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2009.07.30 13:58:42 | 000,236,544 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.04 18:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)

DRV:64bit: - [2009.04.28 03:03:42 | 000,067,128 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009.04.28 03:03:42 | 000,028,216 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2008.05.21 14:30:58 | 000,583,168 | ---- | M] (                                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPC530.sys -- (SPC530)

DRV:64bit: - [2008.05.21 14:30:58 | 000,008,192 | ---- | M] (                                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPC530m.sys -- (SPC530m)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A7 FD E7 74 C1 28 CE 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKCU\..\SearchScopes\{12E785F4-1132-4171-8950-AE192B55808A}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{696CA4B9-130F-4C48-AE7F-57CBFBF633DA}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{BF125486-37D0-49EC-889D-BCDF751B36DA}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{C55359D2-FA3D-4AB8-A217-C8AAEBEF9DBF}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Pietro\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.16 20:45:21 | 000,000,000 | ---D | M]

 

[2011.10.24 21:11:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\Extensions

[2013.05.27 16:04:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\Firefox\Profiles\39tdm9so.default\extensions

[2012.12.15 15:49:39 | 000,036,139 | ---- | M] () (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

[2013.05.09 11:43:16 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\1und1-suche.xml

[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\amazondotcom-de.xml

[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\eBay-de.xml

[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\gmx-suche.xml

[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\lastminute.xml

[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\mailcom-search.xml

[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\webde-suche.xml

[2013.05.26 20:09:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions

[2013.05.26 20:09:38 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2013.05.23 21:18:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\updated\browser\extensions

[2013.05.23 21:18:58 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2011.12.18 18:32:15 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

 

O1 HOSTS File: ([2013.05.27 14:25:04 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe (Electronic Arts)

O4 - Startup: C:\Users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Pietro\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pietro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pietro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.191.74.18 62.109.123.196

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E632D70B-F65D-4468-A070-431D0AFF442D}: DhcpNameServer = 213.191.74.18 62.109.123.196

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.27 16:02:43 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Pietro\Desktop\esetsmartinstaller_enu.exe

[2013.05.27 15:44:49 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2013.05.27 15:43:03 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2013.05.27 15:33:38 | 005,073,202 | R--- | C] (Swearware) -- C:\Users\Pietro\Desktop\ComboFix.exe

[2013.05.27 14:15:32 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.05.27 14:15:32 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.05.27 14:15:32 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.05.27 14:09:13 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Documents\ProcAlyzer Dumps

[2013.05.27 14:02:10 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.05.27 14:00:57 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.05.27 10:46:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Pietro\Desktop\OTL.exe

[2013.05.26 16:38:06 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2013.05.22 20:10:45 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\F&I

[2013.05.22 20:04:56 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\Rechnungen für Investitionen und Finanzierungen

[2013.05.02 19:32:07 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\Vhannibal E1 Dual Feeds 25 apr

[2013.05.02 19:30:47 | 000,000,000 | ---D | C] -- C:\Users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dreamboxEDIT

[2013.05.02 19:30:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\dreamboxEDIT

[2013.05.02 18:23:46 | 000,000,000 | ---D | C] -- C:\Users\Pietro\AppData\Roaming\TeamViewer

[2013.05.01 16:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts

[2013.05.01 16:10:10 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Documents\FUSSBALL MANAGER 10

[2013.05.01 15:54:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA SPORTS

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.27 16:13:59 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.27 16:13:59 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.27 16:06:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.27 16:06:12 | 3219,890,176 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.27 16:02:44 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Pietro\Desktop\esetsmartinstaller_enu.exe

[2013.05.27 15:36:18 | 000,632,031 | ---- | M] () -- C:\Users\Pietro\Desktop\adwcleaner.exe

[2013.05.27 15:34:11 | 005,073,202 | R--- | M] (Swearware) -- C:\Users\Pietro\Desktop\ComboFix.exe

[2013.05.27 14:25:04 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2013.05.27 14:01:52 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.27 14:01:52 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.27 14:01:52 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.27 14:01:52 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.27 14:01:52 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.27 13:55:06 | 000,444,760 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.05.27 10:50:33 | 000,000,000 | ---- | M] () -- C:\Users\Pietro\defogger_reenable

[2013.05.27 10:48:08 | 000,377,856 | ---- | M] () -- C:\Users\Pietro\Desktop\gmer_2.1.19163.exe

[2013.05.27 10:46:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pietro\Desktop\OTL.exe

[2013.05.27 10:45:31 | 000,050,477 | ---- | M] () -- C:\Users\Pietro\Desktop\Defogger.exe

[2013.05.05 00:54:32 | 000,103,463 | ---- | M] () -- C:\Users\Pietro\Desktop\Unbenannt.PNG

[2013.05.02 19:30:47 | 000,001,953 | ---- | M] () -- C:\Users\Pietro\Desktop\dreamboxEDIT.lnk

[2013.05.01 15:55:07 | 000,001,135 | ---- | M] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

 
 ========== Files Created - No Company Name ==========

 

[2013.05.27 15:36:13 | 000,632,031 | ---- | C] () -- C:\Users\Pietro\Desktop\adwcleaner.exe

[2013.05.27 14:15:32 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.05.27 14:15:32 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.05.27 14:15:32 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.05.27 14:15:32 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.05.27 14:15:32 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.05.27 10:50:33 | 000,000,000 | ---- | C] () -- C:\Users\Pietro\defogger_reenable

[2013.05.27 10:48:06 | 000,377,856 | ---- | C] () -- C:\Users\Pietro\Desktop\gmer_2.1.19163.exe

[2013.05.27 10:45:00 | 000,050,477 | ---- | C] () -- C:\Users\Pietro\Desktop\Defogger.exe

[2013.05.05 00:54:32 | 000,103,463 | ---- | C] () -- C:\Users\Pietro\Desktop\Unbenannt.PNG

[2013.05.02 19:30:47 | 000,001,953 | ---- | C] () -- C:\Users\Pietro\Desktop\dreamboxEDIT.lnk

[2013.05.01 15:55:07 | 000,001,147 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Download Manager.lnk

[2013.05.01 15:55:07 | 000,001,135 | ---- | C] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

[2013.04.18 18:28:26 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll

[2012.09.22 15:49:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2012.09.10 20:43:21 | 000,003,584 | ---- | C] () -- C:\Users\Pietro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.04.15 00:48:03 | 000,000,016 | ---- | C] () -- C:\Users\Pietro\AppData\Roaming\blckdom.res

[2012.03.11 13:30:32 | 006,904,040 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe

[2011.11.25 13:27:32 | 000,001,065 | ---- | C] () -- C:\Windows\winamp.ini

[2011.10.24 21:02:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2011.12.26 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\1&1 Mail & Media GmbH

[2012.04.16 07:17:30 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\11013

[2012.03.11 13:31:23 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\dBpoweramp

[2013.05.27 16:07:34 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\Dropbox

[2011.11.25 16:47:02 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\DVDVideoSoft

[2013.03.05 20:57:02 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\elsterformular

[2011.12.06 19:45:17 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\Engelmann Media

[2012.04.16 07:02:25 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\gizza

[2012.04.15 00:47:52 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\kock

[2012.02.06 22:05:26 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\OpenOffice.org

[2012.09.10 20:43:21 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\Solveig Multimedia

[2013.05.02 18:23:46 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\TeamViewer

[2012.04.15 19:56:59 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\UAs

[2012.09.20 19:54:44 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\WindSolutions

[2012.04.15 19:57:37 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\xmldm

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

wie läuft der rechner?

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Danke nochmals

PC läuft unflüssig

Results of screen317's Security Check version 0.99.63
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 22
Java(TM) 6 Update 29
Java version out of Date!
Adobe Flash Player 11.5.502.110 Flash Player out of Date!
Adobe Reader 10.1.4 Adobe Reader out of Date!
Mozilla Firefox (21.0)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Java, Adobe, und Flashplayer aktualisiert

Deinstallier alle Programme, die rot gelistet sind, und ersetz sie durch die aktuelle Version.
Definier mal "unflüssig" :)

Hi,

also unflüssig heißt die Dateien werden nur langsam geöffnet. Bilder Textdateien musik , egal was.

Mozilla firefox zum Beispiel dauert am längsten

Mit dem IE lösst sich gar keine Seite öffnen

Und ich nehme an das war vorher besser?

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Downloade dir bitte Farbar's Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Richtig ;)

done

Farbar Service Scanner Version: 25-05-2013
Ran by Pietro (administrator) on 29-05-2013 at 12:22:49
Running from "C:\Users\...\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Ok dann bitte mal ein frisches OTL logfile.

OTL Logfile:

Code:

OTL logfile created on: 29.05.2013 14:08:02 - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Pietro\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 58,77% Memory free

7,99 Gb Paging File | 6,23 Gb Available in Paging File | 77,96% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465,76 Gb Total Space | 239,22 Gb Free Space | 51,36% Space Free | Partition Type: NTFS

 

Computer Name: PIETRO-PC | User Name: Pietro | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.27 10:46:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pietro\Desktop\OTL.exe

PRC - [2013.05.12 00:26:08 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2013.04.12 01:24:12 | 027,156,136 | ---- | M] (Dropbox, Inc.) -- C:\Users\Pietro\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

PRC - [2012.08.18 19:57:40 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.05.09 06:29:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.09 06:29:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.05.12 00:26:24 | 003,128,728 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

MOD - [2012.02.06 22:01:54 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2009.09.19 04:17:40 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2013.05.26 20:09:37 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)

SRV - [2013.01.08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.05.09 06:29:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.05.09 06:29:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007.05.31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.02.06 08:42:08 | 000,203,544 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudserd.sys -- (ssudserd)

DRV:64bit: - [2012.09.19 11:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)

DRV:64bit: - [2012.09.19 11:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)

DRV:64bit: - [2012.07.09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2012.05.09 06:29:34 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.05.09 06:29:34 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.08.02 17:38:44 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009.10.20 18:20:36 | 000,114,608 | ---- | M] (Philips Applied Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\phaudlwr.sys -- (phaudlwr)

DRV:64bit: - [2009.09.19 06:32:36 | 006,170,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.09.17 13:04:18 | 001,250,816 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2009.08.23 16:02:30 | 000,120,336 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2009.07.30 13:58:42 | 000,236,544 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.04 18:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)

DRV:64bit: - [2009.04.28 03:03:42 | 000,067,128 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009.04.28 03:03:42 | 000,028,216 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2008.05.21 14:30:58 | 000,583,168 | ---- | M] (                                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPC530.sys -- (SPC530)

DRV:64bit: - [2008.05.21 14:30:58 | 000,008,192 | ---- | M] (                                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPC530m.sys -- (SPC530m)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A7 FD E7 74 C1 28 CE 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKCU\..\SearchScopes\{12E785F4-1132-4171-8950-AE192B55808A}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{696CA4B9-130F-4C48-AE7F-57CBFBF633DA}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{BF125486-37D0-49EC-889D-BCDF751B36DA}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{C55359D2-FA3D-4AB8-A217-C8AAEBEF9DBF}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Pietro\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.29 10:58:19 | 000,000,000 | ---D | M]

 

[2011.10.24 21:11:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\Extensions

[2013.05.27 16:04:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\Firefox\Profiles\39tdm9so.default\extensions

[2012.12.15 15:49:39 | 000,036,139 | ---- | M] () (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi

[2013.05.09 11:43:16 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2011.10.13 17:19:44 | 000,000,855 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\1und1-suche.xml

[2011.10.10 15:27:30 | 000,001,281 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\amazondotcom-de.xml

[2011.10.10 14:59:22 | 000,002,364 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\eBay-de.xml

[2011.10.13 17:01:56 | 000,010,507 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\gmx-suche.xml

[2011.10.10 15:12:38 | 000,002,385 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\lastminute.xml

[2011.10.13 17:34:10 | 000,002,248 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\mailcom-search.xml

[2011.10.13 15:07:08 | 000,005,490 | ---- | M] () -- C:\Users\Pietro\AppData\Roaming\mozilla\firefox\profiles\39tdm9so.default\searchplugins\webde-suche.xml

[2013.05.29 12:09:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions

[2013.05.29 12:09:55 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2013.05.23 21:18:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\updated\browser\extensions

[2013.05.23 21:18:58 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

 

O1 HOSTS File: ([2013.05.27 14:25:04 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe (Electronic Arts)

O4 - Startup: C:\Users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Pietro\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pietro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pietro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.21.2)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.109.123.7 213.191.92.86

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E632D70B-F65D-4468-A070-431D0AFF442D}: DhcpNameServer = 62.109.123.7 213.191.92.86

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.29 12:16:44 | 000,354,297 | ---- | C] (Farbar) -- C:\Users\Pietro\Desktop\FSS.exe

[2013.05.29 12:16:28 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Pietro\Desktop\TFC.exe

[2013.05.29 10:58:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe

[2013.05.29 10:58:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe

[2013.05.29 10:55:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2013.05.28 21:23:04 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\Neuer Ordner (3)

[2013.05.27 16:02:43 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Pietro\Desktop\esetsmartinstaller_enu.exe

[2013.05.27 15:44:49 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2013.05.27 15:43:03 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2013.05.27 15:33:38 | 005,073,202 | R--- | C] (Swearware) -- C:\Users\Pietro\Desktop\ComboFix.exe

[2013.05.27 14:15:32 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.05.27 14:15:32 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.05.27 14:15:32 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.05.27 14:09:13 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Documents\ProcAlyzer Dumps

[2013.05.27 14:02:10 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.05.27 14:00:57 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.05.27 10:46:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Pietro\Desktop\OTL.exe

[2013.05.26 16:38:06 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2013.05.22 20:10:45 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\F&I

[2013.05.22 20:04:56 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\Rechnungen für Investitionen und Finanzierungen

[2013.05.02 19:32:07 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Desktop\Vhannibal E1 Dual Feeds 25 apr

[2013.05.02 19:30:47 | 000,000,000 | ---D | C] -- C:\Users\Pietro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dreamboxEDIT

[2013.05.02 19:30:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\dreamboxEDIT

[2013.05.02 18:23:46 | 000,000,000 | ---D | C] -- C:\Users\Pietro\AppData\Roaming\TeamViewer

[2013.05.01 16:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts

[2013.05.01 16:10:10 | 000,000,000 | ---D | C] -- C:\Users\Pietro\Documents\FUSSBALL MANAGER 10

[2013.05.01 15:54:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA SPORTS

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.29 14:09:44 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.29 14:09:44 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.29 14:01:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.29 14:01:24 | 3219,890,176 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.29 12:16:48 | 000,354,297 | ---- | M] (Farbar) -- C:\Users\Pietro\Desktop\FSS.exe

[2013.05.29 12:16:30 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Pietro\Desktop\TFC.exe

[2013.05.29 12:09:57 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2013.05.29 10:58:19 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.28 21:58:24 | 000,048,364 | ---- | M] () -- C:\Users\Pietro\Desktop\mukk.PNG

[2013.05.28 21:11:16 | 000,013,888 | ---- | M] () -- C:\Users\Pietro\Documents\Geb.ods

[2013.05.28 17:44:39 | 000,890,825 | ---- | M] () -- C:\Users\Pietro\Desktop\SecurityCheck.exe

[2013.05.27 16:02:44 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Pietro\Desktop\esetsmartinstaller_enu.exe

[2013.05.27 15:36:18 | 000,632,031 | ---- | M] () -- C:\Users\Pietro\Desktop\adwcleaner.exe

[2013.05.27 15:34:11 | 005,073,202 | R--- | M] (Swearware) -- C:\Users\Pietro\Desktop\ComboFix.exe

[2013.05.27 14:25:04 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2013.05.27 14:01:52 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.27 14:01:52 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.27 14:01:52 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.27 14:01:52 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.27 14:01:52 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.27 13:55:06 | 000,444,760 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.05.27 10:50:33 | 000,000,000 | ---- | M] () -- C:\Users\Pietro\defogger_reenable

[2013.05.27 10:48:08 | 000,377,856 | ---- | M] () -- C:\Users\Pietro\Desktop\gmer_2.1.19163.exe

[2013.05.27 10:46:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pietro\Desktop\OTL.exe

[2013.05.27 10:45:31 | 000,050,477 | ---- | M] () -- C:\Users\Pietro\Desktop\Defogger.exe

[2013.05.05 00:54:32 | 000,103,463 | ---- | M] () -- C:\Users\Pietro\Desktop\Unbenannt.PNG

[2013.05.02 19:30:47 | 000,001,953 | ---- | M] () -- C:\Users\Pietro\Desktop\dreamboxEDIT.lnk

[2013.05.01 15:55:07 | 000,001,135 | ---- | M] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

 
 ========== Files Created - No Company Name ==========

 

[2013.05.29 12:09:57 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2013.05.29 10:58:19 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

[2013.05.29 10:58:19 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.28 21:58:24 | 000,048,364 | ---- | C] () -- C:\Users\Pietro\Desktop\mukk.PNG

[2013.05.28 21:11:14 | 000,013,888 | ---- | C] () -- C:\Users\Pietro\Documents\Geb.ods

[2013.05.28 17:44:34 | 000,890,825 | ---- | C] () -- C:\Users\Pietro\Desktop\SecurityCheck.exe

[2013.05.27 15:36:13 | 000,632,031 | ---- | C] () -- C:\Users\Pietro\Desktop\adwcleaner.exe

[2013.05.27 14:15:32 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.05.27 14:15:32 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.05.27 14:15:32 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.05.27 14:15:32 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.05.27 14:15:32 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.05.27 10:50:33 | 000,000,000 | ---- | C] () -- C:\Users\Pietro\defogger_reenable

[2013.05.27 10:48:06 | 000,377,856 | ---- | C] () -- C:\Users\Pietro\Desktop\gmer_2.1.19163.exe

[2013.05.27 10:45:00 | 000,050,477 | ---- | C] () -- C:\Users\Pietro\Desktop\Defogger.exe

[2013.05.05 00:54:32 | 000,103,463 | ---- | C] () -- C:\Users\Pietro\Desktop\Unbenannt.PNG

[2013.05.02 19:30:47 | 000,001,953 | ---- | C] () -- C:\Users\Pietro\Desktop\dreamboxEDIT.lnk

[2013.05.01 15:55:07 | 000,001,147 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Download Manager.lnk

[2013.05.01 15:55:07 | 000,001,135 | ---- | C] () -- C:\Users\Public\Desktop\EA Download Manager.lnk

[2013.04.18 18:28:26 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll

[2012.09.22 15:49:16 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2012.09.10 20:43:21 | 000,003,584 | ---- | C] () -- C:\Users\Pietro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.04.15 00:48:03 | 000,000,016 | ---- | C] () -- C:\Users\Pietro\AppData\Roaming\blckdom.res

[2012.03.11 13:30:32 | 006,904,040 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe

[2011.11.25 13:27:32 | 000,001,065 | ---- | C] () -- C:\Windows\winamp.ini

[2011.10.24 21:02:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2011.12.26 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\1&1 Mail & Media GmbH

[2012.04.16 07:17:30 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\11013

[2012.03.11 13:31:23 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\dBpoweramp

[2013.05.29 14:02:25 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\Dropbox

[2011.11.25 16:47:02 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\DVDVideoSoft

[2013.03.05 20:57:02 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\elsterformular

[2011.12.06 19:45:17 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\Engelmann Media

[2012.04.16 07:02:25 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\gizza

[2012.04.15 00:47:52 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\kock

[2012.02.06 22:05:26 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\OpenOffice.org

[2012.09.10 20:43:21 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\Solveig Multimedia

[2013.05.02 18:23:46 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\TeamViewer

[2012.04.15 19:56:59 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\UAs

[2012.09.20 19:54:44 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\WindSolutions

[2012.04.15 19:57:37 | 000,000,000 | ---D | M] -- C:\Users\Pietro\AppData\Roaming\xmldm

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---