Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   System startet langsam - Open Office Wiederherstellungs"Ketten" (https://www.trojaner-board.de/138210-system-startet-langsam-open-office-wiederherstellungs-ketten.html)

petertroj 14.07.2013 14:38
System startet langsam - Open Office Wiederherstellungs"Ketten"
 
Hallo,

- das Betriebssystem startet sehr langsam. :kaffee:

- Beim Arbeiten mit Open Office Org (Apache), wird besonders bei Tabellenkalkulation immer
wieder die Datei-Wiederherstellung durchlaufen, auch wenn keine Eingaben oder
Bearbeitungen stattfanden. :crazy:

- Der Datei-Explorer setzt aus mit Meldung er "funktioniert nicht mehr", wird in der Regel
automatisch neugestartet.

- MS Security Essential läßt sich im Sicherheits-Center nicht AUS-STELLEN. :stirn:

- Der Sicherheits-Center von Vista Home Premium, 32 bit, meldet Avira grundsätzlich als
AUS-GESCHALTET, ohne Veränderung. :stirn:

Habe nun Defogger, OTL, Lauf-Versuche mit Gmer (2x) downgeloaded und mit je Neustarts bzw. Ausschaltungen Laufen lassen. Da sich ein Packen von 20 möglichen Vista Updates ergab, wurde Vista vor dem 2. OTL-Lauf aktuallisiert.

Wäre sehr nett wenn mich jemand unterstützen würde.

Gruß Peter

Code:
OTL von Samstag
Code:
OTL logfile created on: 13.07.2013 15:13:22 - Run 4
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Standartkonto\Desktop\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,86 Gb Available Physical Memory | 61,99% Memory free
6,42 Gb Paging File | 5,27 Gb Available in Paging File | 82,13% Paging File free
Paging file location(s): c:\pagefile.sys 200 4597d:\pagefi [Binary data over 200 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 225,99 Gb Total Space | 152,13 Gb Free Space | 67,32% Space Free | Partition Type: NTFS
Drive D: | 226,03 Gb Total Space | 151,04 Gb Free Space | 66,82% Space Free | Partition Type: NTFS
 
Computer Name: PETER-VERA-PC | User Name: peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.07.13 13:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Standartkonto\Desktop\Desktop\OTL.exe
PRC - [2013.07.07 18:35:31 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.07.07 18:34:54 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.07.07 18:34:49 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.07.07 18:34:48 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013.01.27 12:11:46 | 000,295,232 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\NisSrv.exe
PRC - [2013.01.27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.11.20 11:32:30 | 002,757,080 | ---- | M] (Mister Group) -- C:\Programme\System Explorer\SystemExplorer.exe
PRC - [2012.11.13 15:08:12 | 003,487,240 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdate.exe
PRC - [2012.11.13 15:08:08 | 003,825,176 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2012.11.13 15:07:24 | 000,168,384 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2012.11.13 15:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2012.11.13 15:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2012.09.20 06:02:24 | 000,363,752 | ---- | M] (BillP Studios) -- C:\Programme\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2012.08.21 07:58:38 | 000,567,256 | ---- | M] (Mister Group) -- C:\Programme\System Explorer\service\SystemExplorerService.exe
PRC - [2012.08.13 11:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2012.08.13 11:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2012.07.25 10:46:44 | 001,326,176 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psia.exe
PRC - [2012.07.25 10:46:42 | 000,681,056 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\sua.exe
PRC - [2012.07.25 10:46:42 | 000,572,000 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psi_tray.exe
PRC - [2012.07.11 20:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.11.28 11:56:06 | 000,024,576 | ---- | M] () -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe
PRC - [2007.03.23 14:20:52 | 000,227,328 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
PRC - [2006.04.18 06:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.11.13 15:06:32 | 000,158,624 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2012.11.13 15:06:30 | 000,108,960 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2012.11.13 15:06:28 | 000,554,400 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
MOD - [2012.11.13 15:06:28 | 000,528,288 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\JSDialogPack150.bpl
MOD - [2012.11.13 15:06:28 | 000,416,160 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012.08.10 16:51:32 | 000,985,088 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll
MOD - [2012.06.20 23:23:00 | 000,599,419 | ---- | M] () -- C:\Programme\BillP Studios\WinPatrol\sqlite3.dll
MOD - [2008.12.11 03:05:52 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - File not found [Auto | Stopped] --  -- (MpsSvc)
SRV - [2013.07.07 18:35:31 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.07.07 18:34:49 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.06.21 07:21:44 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.01.27 12:11:46 | 000,295,232 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013.01.27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.12.01 21:49:24 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.21 07:58:38 | 000,567,256 | ---- | M] (Mister Group) [On_Demand | Running] -- C:\Programme\System Explorer\service\SystemExplorerService.exe -- (SystemExplorerHelpService)
SRV - [2012.07.25 10:46:44 | 001,326,176 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\psia.exe -- (Secunia PSI Agent)
SRV - [2012.07.25 10:46:42 | 000,681,056 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2012.07.11 20:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2009.11.13 13:31:14 | 000,092,008 | ---- | M] (TomTom) [Disabled | Stopped] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2008.11.28 11:56:06 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008.10.04 04:09:02 | 000,069,632 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe -- (CLHNService)
SRV - [2008.07.29 17:53:00 | 000,500,784 | ---- | M] (Egis Incorporated) [Disabled | Stopped] -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.12.06 17:15:28 | 000,110,592 | ---- | M] () [Disabled | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2007.03.26 14:06:24 | 000,292,864 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.04.18 06:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\peter\AppData\Local\Temp\TII200A.tmp\disk1\BIOSCHK.SYS -- (BIOSCHK)
DRV - File not found [Kernel | Auto | Stopped] --  -- (adfs)
DRV - [2013.04.09 02:22:36 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.04.09 02:22:36 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2013.04.09 02:22:36 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2013.01.20 16:59:04 | 000,100,328 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012.08.27 15:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.09.01 10:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2008.12.11 04:30:58 | 004,172,288 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.10.08 10:43:08 | 000,005,632 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hidshim.sys -- (hidshim)
DRV - [2008.10.08 10:43:06 | 000,022,528 | ---- | M] (Nuvoton Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nuvotonhidgeneric.sys -- (nuvotonhidgeneric)
DRV - [2008.10.01 11:04:16 | 000,012,832 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008.08.26 21:25:28 | 000,150,560 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2007.02.22 11:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcd.sys -- (nmwcd)
DRV - [2007.02.22 11:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007.02.22 11:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcj.sys -- (nmwcdcj)
DRV - [2007.02.22 11:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdc.sys -- (nmwcdc)
DRV - [2006.11.29 02:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/421
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.param.yahoo-fr: ""
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: ""
FF - prefs.js..extensions.enabledAddons: copy-urls-expert%40kashiif-gmail.com:2.1.0
FF - prefs.js..extensions.enabledAddons: donottrackplus%40abine.com:2.2.1.829
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.8.3
FF - prefs.js..extensions.enabledAddons: testpilot%40labs.mozilla.com:1.2.2
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.3
FF - prefs.js..extensions.enabledAddons: %7B6bdc61ae-7b80-44a3-9476-e1d121ec2238%7D:0.85
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.2
FF - prefs.js..extensions.enabledAddons: %7B9AA46F4F-4DC7-4c06-97AF-5035170634FE%7D:4.20.3
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20120926
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.7
FF - prefs.js..extensions.enabledAddons: %7Bcd617372-6743-4ee4-bac4-fbf60f35719e%7D:2.0
FF - prefs.js..extensions.enabledAddons: %7Bef62e1ce-d2a4-4cdd-b7ec-92b120366b66%7D:2.7.8
FF - prefs.js..extensions.enabledAddons: %7B91aa5abe-9de4-4347-b7b5-322c38dd9271%7D:3.2
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: savedpasswordeditor%40daniel.dawson:2.6.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.192
FF - prefs.js..extensions.enabledItems: {72CA2996-F580-47DF-98FF-0B853D09CEC8}:4.1.0.164
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.04 15:21:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.26 22:19:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: D:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins
 
[2012.09.23 12:24:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions
[2009.12.28 21:23:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013.05.02 11:39:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions
[2012.11.25 00:56:19 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012.12.01 21:49:42 | 000,000,000 | ---D | M] (Clippings) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271}
[2012.12.01 21:49:42 | 000,000,000 | ---D | M] (WOT) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.12.01 21:49:42 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2012.11.25 00:56:17 | 000,000,000 | ---D | M] (DoNotTrackPlus) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\donottrackplus@abine.com
[2012.12.01 21:49:45 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\firefox@ghostery.com
[2013.05.02 11:40:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\staged
[2012.11.25 00:56:16 | 000,059,702 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\copy-urls-expert@kashiif-gmail.com.xpi
[2012.12.03 21:41:41 | 000,195,091 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\savedpasswordeditor@daniel.dawson.xpi
[2012.11.25 00:56:19 | 000,621,521 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\testpilot@labs.mozilla.com.xpi
[2012.12.01 21:49:42 | 000,073,384 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{6bdc61ae-7b80-44a3-9476-e1d121ec2238}.xpi
[2012.11.25 00:56:19 | 000,530,519 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.11.25 00:56:19 | 000,065,589 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
[2012.11.25 00:56:20 | 000,341,143 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2012.11.25 00:56:20 | 000,008,283 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{cd617372-6743-4ee4-bac4-fbf60f35719e}.xpi
[2013.05.02 11:40:01 | 000,230,163 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\savedpasswordeditor@daniel.dawson.xpi
[2013.05.02 11:39:59 | 000,532,430 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.05.02 11:39:57 | 000,117,151 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
[2013.05.02 11:40:00 | 000,872,587 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013.03.07 02:06:18 | 000,007,919 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\donottrackplus@abine.com\chrome\content\ff\view_expiry.js
[2012.10.04 15:21:02 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.10.04 15:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2009.10.21 06:27:38 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.10.04 15:21:14 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2004.07.02 14:51:00 | 000,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Program Files\mozilla firefox\components\np32asw.dll
[2004.07.02 14:51:00 | 000,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Program Files\mozilla firefox\plugins\np32asw.dll
[2012.09.26 09:29:02 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.26 09:29:02 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.09.26 09:29:02 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.09.26 09:29:02 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.26 09:29:02 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.09.26 09:29:02 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\plugin/npUrlAdvisor.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\plugin/npABPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Authorware Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32asw.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Kaspersky Password Manager (Enabled) = C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\npkpmAutofill.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U7 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.10 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\
CHR - Extension: Anti-Banner = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\
 
O1 HOSTS File: ([2012.10.07 15:12:33 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SystemExplorerAutoStart] C:\Program Files\System Explorer\SystemExplorer.exe (Mister Group)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [*Restore] C:\Windows\System32\rstrui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\Windows\is-OP4HO.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\ie_banner_deny.htm File not found
O8 - Extra context menu item: Kaspersky PURE - res://C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\spIEBho.dll/616 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8E7D015B-C8E3-4106-894D-F3F008C7580A}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - () -  File not found
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.13 11:41:21 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
[2013.06.23 21:11:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013.06.23 21:11:01 | 000,000,000 | ---D | C] -- C:\Program Files\Java
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.13 14:44:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.07.13 14:31:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.07.13 14:29:48 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2013.07.13 14:29:18 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.07.13 14:29:15 | 000,000,620 | ---- | M] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2013.07.13 14:29:00 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013.07.13 14:28:55 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.13 14:28:55 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.13 14:28:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.24 21:04:28 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.06.24 21:04:28 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.06.24 21:04:28 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.06.24 21:04:28 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2013.04.27 18:31:40 | 000,712,264 | ---- | C] () -- C:\Windows\is-OP4HO.exe
[2012.12.07 04:31:10 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll
[2012.12.02 09:49:33 | 000,711,240 | ---- | C] () -- C:\Windows\is-A6818.exe
[2012.12.01 21:50:01 | 000,000,457 | ---- | C] () -- C:\Users\peter\clipdat2.rdf
[2012.07.01 22:53:42 | 000,000,000 | ---- | C] () -- C:\Users\peter\defogger_reenable
[2012.05.19 19:12:07 | 000,017,408 | ---- | C] () -- C:\Users\peter\AppData\Local\WebpageIcons.db
[2012.01.02 18:02:45 | 000,598,981 | ---- | C] () -- C:\Users\peter\AppData\Local\census.cache
[2012.01.02 18:02:12 | 000,214,883 | ---- | C] () -- C:\Users\peter\AppData\Local\ars.cache
[2012.01.02 17:47:36 | 000,000,036 | ---- | C] () -- C:\Users\peter\AppData\Local\housecall.guid.cache
[2010.05.01 09:51:14 | 000,000,680 | ---- | C] () -- C:\Users\peter\AppData\Local\d3d9caps.dat
[2010.01.13 00:28:17 | 000,031,007 | ---- | C] () -- C:\Users\peter\AppData\Roaming\UserTile.png
[2009.09.13 13:54:18 | 000,006,144 | ---- | C] () -- C:\Users\peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2009.01.22 19:59:31 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Acer GameZone Console
[2009.11.08 19:15:21 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\com.adobe.ExMan
[2010.07.26 02:05:22 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\EPSON
[2009.10.06 07:09:21 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\eSobi
[2009.09.23 19:56:54 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Flood Light Games
[2009.11.25 20:51:07 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\GetRightToGo
[2009.09.19 20:48:59 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Meridian93
[2010.01.30 20:18:55 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Nokia
[2010.01.30 20:18:29 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Nokia Multimedia Player
[2009.10.02 08:04:31 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\OpenOffice.org
[2009.11.19 19:27:56 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\PC Suite
[2009.10.06 09:34:20 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\PowerCinema
[2013.05.04 19:39:59 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Safer Networking
[2009.12.28 21:23:32 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TomTom
[2012.10.14 15:05:05 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Uniblue
[2012.09.23 15:36:29 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\WinPatrol
[2009.10.06 19:39:35 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Zylom
 
========== Purity Check ==========
 
 

< End of report >
Code:
OTL nach Vista Updates, MS Essential auch dabei, von heute Sonntag
Code:
OTL logfile created on: 14.07.2013 10:43:27 - Run 5
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Standartkonto\Desktop\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,74 Gb Available Physical Memory | 58,04% Memory free
6,41 Gb Paging File | 5,02 Gb Available in Paging File | 78,27% Paging File free
Paging file location(s): c:\pagefile.sys 200 4597d:\pagefi [Binary data over 200 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 225,99 Gb Total Space | 152,70 Gb Free Space | 67,57% Space Free | Partition Type: NTFS
Drive D: | 226,03 Gb Total Space | 151,01 Gb Free Space | 66,81% Space Free | Partition Type: NTFS
 
Computer Name: PETER-VERA-PC | User Name: peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.07.13 13:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Standartkonto\Desktop\Desktop\OTL.exe
PRC - [2013.07.07 18:35:31 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.07.07 18:34:54 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.07.07 18:34:49 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.07.07 18:34:48 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.06.22 12:03:37 | 004,760,816 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2013.06.20 18:05:14 | 000,295,376 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\NisSrv.exe
PRC - [2013.06.20 18:05:14 | 000,022,208 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2013.06.20 17:25:44 | 000,995,176 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.11.13 15:08:12 | 003,487,240 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdate.exe
PRC - [2012.11.13 15:08:08 | 003,825,176 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2012.11.13 15:07:24 | 000,168,384 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2012.11.13 15:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2012.11.13 15:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2012.09.20 06:02:24 | 000,363,752 | ---- | M] (BillP Studios) -- C:\Programme\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2012.08.13 11:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2012.08.13 11:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2012.07.25 10:46:44 | 001,326,176 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psia.exe
PRC - [2012.07.25 10:46:42 | 000,681,056 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\sua.exe
PRC - [2012.07.25 10:46:42 | 000,572,000 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psi_tray.exe
PRC - [2012.07.11 20:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.11.28 11:56:06 | 000,024,576 | ---- | M] () -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe
PRC - [2007.03.23 14:20:52 | 000,227,328 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
PRC - [2006.04.18 06:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.11.13 15:06:32 | 000,158,624 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2012.11.13 15:06:30 | 000,108,960 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2012.11.13 15:06:28 | 000,554,400 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
MOD - [2012.11.13 15:06:28 | 000,528,288 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\JSDialogPack150.bpl
MOD - [2012.11.13 15:06:28 | 000,416,160 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012.08.10 16:51:32 | 000,985,088 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll
MOD - [2012.08.10 16:50:56 | 000,170,496 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxslt.dll
MOD - [2012.06.20 23:23:00 | 000,599,419 | ---- | M] () -- C:\Programme\BillP Studios\WinPatrol\sqlite3.dll
MOD - [2008.12.11 03:05:52 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - File not found [Auto | Stopped] --  -- (MpsSvc)
SRV - [2013.07.07 18:35:31 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.07.07 18:34:49 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.06.21 07:21:44 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.06.20 18:05:14 | 000,295,376 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013.06.20 18:05:14 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.12.01 21:49:24 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.21 07:58:38 | 000,567,256 | ---- | M] (Mister Group) [On_Demand | Stopped] -- C:\Programme\System Explorer\service\SystemExplorerService.exe -- (SystemExplorerHelpService)
SRV - [2012.07.25 10:46:44 | 001,326,176 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\psia.exe -- (Secunia PSI Agent)
SRV - [2012.07.25 10:46:42 | 000,681,056 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2012.07.11 20:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2009.11.13 13:31:14 | 000,092,008 | ---- | M] (TomTom) [Disabled | Stopped] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2008.11.28 11:56:06 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008.10.04 04:09:02 | 000,069,632 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe -- (CLHNService)
SRV - [2008.07.29 17:53:00 | 000,500,784 | ---- | M] (Egis Incorporated) [Disabled | Stopped] -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.12.06 17:15:28 | 000,110,592 | ---- | M] () [Disabled | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2007.03.26 14:06:24 | 000,292,864 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.04.18 06:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\peter\AppData\Local\Temp\TII200A.tmp\disk1\BIOSCHK.SYS -- (BIOSCHK)
DRV - File not found [Kernel | Auto | Stopped] --  -- (adfs)
DRV - [2013.06.18 21:50:08 | 000,107,392 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2013.04.09 02:22:36 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.04.09 02:22:36 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2013.04.09 02:22:36 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.08.27 15:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.09.01 10:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2008.12.11 04:30:58 | 004,172,288 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.10.08 10:43:08 | 000,005,632 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hidshim.sys -- (hidshim)
DRV - [2008.10.08 10:43:06 | 000,022,528 | ---- | M] (Nuvoton Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nuvotonhidgeneric.sys -- (nuvotonhidgeneric)
DRV - [2008.10.01 11:04:16 | 000,012,832 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008.08.26 21:25:28 | 000,150,560 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2007.02.22 11:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcd.sys -- (nmwcd)
DRV - [2007.02.22 11:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007.02.22 11:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcj.sys -- (nmwcdcj)
DRV - [2007.02.22 11:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdc.sys -- (nmwcdc)
DRV - [2006.11.29 02:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/421
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.param.yahoo-fr: ""
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: ""
FF - prefs.js..extensions.enabledAddons: copy-urls-expert%40kashiif-gmail.com:2.1.0
FF - prefs.js..extensions.enabledAddons: donottrackplus%40abine.com:2.2.1.829
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.8.3
FF - prefs.js..extensions.enabledAddons: testpilot%40labs.mozilla.com:1.2.2
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.3
FF - prefs.js..extensions.enabledAddons: %7B6bdc61ae-7b80-44a3-9476-e1d121ec2238%7D:0.85
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.2
FF - prefs.js..extensions.enabledAddons: %7B9AA46F4F-4DC7-4c06-97AF-5035170634FE%7D:4.20.3
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20120926
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.7
FF - prefs.js..extensions.enabledAddons: %7Bcd617372-6743-4ee4-bac4-fbf60f35719e%7D:2.0
FF - prefs.js..extensions.enabledAddons: %7Bef62e1ce-d2a4-4cdd-b7ec-92b120366b66%7D:2.7.8
FF - prefs.js..extensions.enabledAddons: %7B91aa5abe-9de4-4347-b7b5-322c38dd9271%7D:3.2
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: savedpasswordeditor%40daniel.dawson:2.6.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.192
FF - prefs.js..extensions.enabledItems: {72CA2996-F580-47DF-98FF-0B853D09CEC8}:4.1.0.164
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.04 15:21:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.26 22:19:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: D:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins
 
[2012.09.23 12:24:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions
[2009.12.28 21:23:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013.05.02 11:39:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions
[2012.11.25 00:56:19 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012.12.01 21:49:42 | 000,000,000 | ---D | M] (Clippings) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271}
[2012.12.01 21:49:42 | 000,000,000 | ---D | M] (WOT) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.12.01 21:49:42 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2012.11.25 00:56:17 | 000,000,000 | ---D | M] (DoNotTrackPlus) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\donottrackplus@abine.com
[2012.12.01 21:49:45 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\firefox@ghostery.com
[2013.05.02 11:40:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\7k3nytxg.default\extensions\staged
[2012.11.25 00:56:16 | 000,059,702 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\copy-urls-expert@kashiif-gmail.com.xpi
[2012.12.03 21:41:41 | 000,195,091 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\savedpasswordeditor@daniel.dawson.xpi
[2012.11.25 00:56:19 | 000,621,521 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\testpilot@labs.mozilla.com.xpi
[2012.12.01 21:49:42 | 000,073,384 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{6bdc61ae-7b80-44a3-9476-e1d121ec2238}.xpi
[2012.11.25 00:56:19 | 000,530,519 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.11.25 00:56:19 | 000,065,589 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
[2012.11.25 00:56:20 | 000,341,143 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2012.11.25 00:56:20 | 000,008,283 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\{cd617372-6743-4ee4-bac4-fbf60f35719e}.xpi
[2013.05.02 11:40:01 | 000,230,163 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\savedpasswordeditor@daniel.dawson.xpi
[2013.05.02 11:39:59 | 000,532,430 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.05.02 11:39:57 | 000,117,151 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
[2013.05.02 11:40:00 | 000,872,587 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013.03.07 02:06:18 | 000,007,919 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\7k3nytxg.default\extensions\staged\donottrackplus@abine.com\chrome\content\ff\view_expiry.js
[2012.10.04 15:21:02 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.10.04 15:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2009.10.21 06:27:38 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.10.04 15:21:14 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2004.07.02 14:51:00 | 000,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Program Files\mozilla firefox\components\np32asw.dll
[2004.07.02 14:51:00 | 000,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Program Files\mozilla firefox\plugins\np32asw.dll
[2012.09.26 09:29:02 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.26 09:29:02 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.09.26 09:29:02 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.09.26 09:29:02 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.26 09:29:02 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.09.26 09:29:02 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\plugin/npUrlAdvisor.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\plugin/npABPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Authorware Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32asw.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Kaspersky Password Manager (Enabled) = C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\npkpmAutofill.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U7 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.10 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\
CHR - Extension: Anti-Banner = C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\
 
O1 HOSTS File: ([2012.10.07 15:12:33 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SystemExplorerAutoStart] C:\Program Files\System Explorer\SystemExplorer.exe (Mister Group)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [*Restore] C:\Windows\System32\rstrui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\Windows\is-OP4HO.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\ie_banner_deny.htm File not found
O8 - Extra context menu item: Kaspersky PURE - res://C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\spIEBho.dll/616 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8E7D015B-C8E3-4106-894D-F3F008C7580A}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - () -  File not found
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.13 19:38:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.07.13 11:41:21 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
[2013.06.23 21:11:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013.06.23 21:11:01 | 000,000,000 | ---D | C] -- C:\Program Files\Java
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.14 10:44:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.07.14 10:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.07.14 10:01:11 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.07.14 10:01:11 | 000,000,620 | ---- | M] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2013.07.14 09:52:03 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2013.07.14 09:51:26 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013.07.14 09:51:23 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.14 09:51:23 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.14 09:51:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.13 20:54:02 | 002,259,568 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.07.13 19:39:13 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.07.13 19:39:13 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.07.13 19:39:12 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.07.13 19:39:12 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.07.13 19:35:18 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
 
========== Files Created - No Company Name ==========
 
[2013.04.27 18:31:40 | 000,712,264 | ---- | C] () -- C:\Windows\is-OP4HO.exe
[2012.12.07 04:31:10 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll
[2012.12.02 09:49:33 | 000,711,240 | ---- | C] () -- C:\Windows\is-A6818.exe
[2012.12.01 21:50:01 | 000,000,457 | ---- | C] () -- C:\Users\peter\clipdat2.rdf
[2012.07.01 22:53:42 | 000,000,000 | ---- | C] () -- C:\Users\peter\defogger_reenable
[2012.05.19 19:12:07 | 000,017,408 | ---- | C] () -- C:\Users\peter\AppData\Local\WebpageIcons.db
[2012.01.02 18:02:45 | 000,598,981 | ---- | C] () -- C:\Users\peter\AppData\Local\census.cache
[2012.01.02 18:02:12 | 000,214,883 | ---- | C] () -- C:\Users\peter\AppData\Local\ars.cache
[2012.01.02 17:47:36 | 000,000,036 | ---- | C] () -- C:\Users\peter\AppData\Local\housecall.guid.cache
[2010.05.01 09:51:14 | 000,000,680 | ---- | C] () -- C:\Users\peter\AppData\Local\d3d9caps.dat
[2010.01.13 00:28:17 | 000,031,007 | ---- | C] () -- C:\Users\peter\AppData\Roaming\UserTile.png
[2009.09.13 13:54:18 | 000,006,144 | ---- | C] () -- C:\Users\peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2009.01.22 19:59:31 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Acer GameZone Console
[2009.11.08 19:15:21 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\com.adobe.ExMan
[2010.07.26 02:05:22 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\EPSON
[2009.10.06 07:09:21 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\eSobi
[2009.09.23 19:56:54 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Flood Light Games
[2009.11.25 20:51:07 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\GetRightToGo
[2009.09.19 20:48:59 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Meridian93
[2010.01.30 20:18:55 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Nokia
[2010.01.30 20:18:29 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Nokia Multimedia Player
[2009.10.02 08:04:31 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\OpenOffice.org
[2009.11.19 19:27:56 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\PC Suite
[2009.10.06 09:34:20 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\PowerCinema
[2013.05.04 19:39:59 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Safer Networking
[2009.12.28 21:23:32 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TomTom
[2012.10.14 15:05:05 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Uniblue
[2012.09.23 15:36:29 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\WinPatrol
[2009.10.06 19:39:35 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Zylom
 
========== Purity Check ==========
 
 

< End of report >

schrauber 14.07.2013 14:43
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


petertroj 14.07.2013 15:53
Hi,

zunächst :applaus:, vielen Dank für die schnelle Antwort, schneller als die Polizei erlaubt.

Melde mich nach Download und Erstellung

gruß peter

Hi,

Code:
frst log

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-07-2013
Ran by SYSTEM on 14-07-2013 17:14:36
Running from H:\
Windows Vista (TM) Home Premium Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PCSuiteTrayApplication] - C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [227328 2007-03-23] (Nokia)
HKLM\...\Run: [WinPatrol] - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot [363752 2012-09-19] (BillP Studios)
HKLM\...\Run: [MSC] - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [995176 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-07-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-11] (Oracle Corporation)
HKLM\...\RunOnce: [SpybotSnD] - "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck [5365592 2009-01-26] (Safer Networking Limited)
HKLM\...\RunOnce: [*Restore] - C:\Windows\System32\rstrui.exe /runonce [318464 2008-01-20] (Microsoft Corporation)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\RunOnce: [InnoSetupRegFile.0000000001] - "C:\Windows\is-OP4HO.exe" /REG /REGSVRMODE [712264 2013-04-27] ()
Winlogon\Notify\SDWinLogon:  ()
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Default User\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Gast\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\peter\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-20] (Microsoft Corporation)
HKU\peter\...\Run: [SystemExplorerAutoStart] - "C:\Program Files\System Explorer\SystemExplorer.exe" /TRAY [ 2012-11-20] (Mister Group)
HKU\peter\...\Run: [SpybotSD TeaTimer] - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [ 2009-03-05] (Safer-Networking Ltd.)
HKU\Standartkonto\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Standartkonto\...\Run: [EPSON Stylus DX5000 Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\Users\STANDA~1\AppData\Local\Temp\E_S3344.tmp" /EF "HKCU" [x] <===== ATTENTION
HKU\Standartkonto\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-20] (Microsoft Corporation)
HKU\Standartkonto\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Standartkonto\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [ 2013-06-22] (SUPERAntiSpyware.com)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 ()
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk * sdnclean.exe

========================== Services (Whitelisted) =================

S2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [116608 2012-07-11] (SUPERAntiSpyware.com)
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-07] (Avira Operations GmbH & Co. KG)
S4 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [69632 2008-10-03] ()
S2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-17] (SEIKO EPSON CORPORATION)
S2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-11-28] ()
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S4 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] ()
S2 MpsSvc; C:\Windows\System32\. [0 2013-07-14] ()
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)
S2 RichVideo; c:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-01-09] ()
S2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1326176 2012-07-25] (Secunia)
S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [681056 2012-07-25] (Secunia)
S3 SystemExplorerHelpService; C:\Program Files\System Explorer\service\SystemExplorerService.exe [567256 2012-08-20] (Mister Group)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-08] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-08] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-08] (Avira Operations GmbH & Co. KG)
S3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
S2 int15; C:\Windows\system32\drivers\int15.sys [12832 2008-10-01] (Acer, Inc.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf.sys [15544 2010-09-01] (Secunia)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [150560 2008-08-26] (Realtek Semiconductor Corp.)
S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S2 adfs; No ImagePath
S3 BIOSCHK; \??\C:\Users\peter\AppData\Local\Temp\TII200A.tmp\disk1\BIOSCHK.SYS [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-14 17:14 - 2013-07-14 17:14 - 00000000 ____D C:\FRST
2013-07-13 09:12 - 2013-05-28 17:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-13 09:12 - 2013-05-28 17:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-13 09:12 - 2013-05-28 17:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-13 09:12 - 2013-05-28 17:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-07-13 09:12 - 2013-05-28 17:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-13 09:12 - 2013-05-28 17:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-13 09:12 - 2013-05-28 17:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-07-13 09:12 - 2013-05-28 17:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-13 09:12 - 2013-05-28 17:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-07-13 09:12 - 2013-05-28 17:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-07-13 09:12 - 2013-05-28 17:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-13 09:12 - 2013-05-28 17:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-13 09:12 - 2013-05-28 17:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-13 09:12 - 2013-05-28 17:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-13 09:12 - 2013-05-28 17:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-07-13 09:12 - 2013-05-28 17:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-13 01:46 - 2013-07-13 01:46 - 01269137 _____ C:\Users\Standartkonto\Desktop\TeamSpybot-20130713-114643.cab
2013-07-13 01:41 - 2013-07-13 01:41 - 00000000 ____D C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-10 10:32 - 2013-06-03 17:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-10 10:32 - 2013-04-17 03:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-07-10 10:32 - 2013-04-17 03:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-07-10 10:32 - 2013-04-17 03:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-07-10 10:32 - 2013-04-17 03:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-07-10 10:32 - 2013-04-17 02:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-07-10 10:32 - 2013-04-17 02:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-07-10 10:32 - 2013-04-17 02:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-07-10 10:32 - 2013-04-17 02:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-10 10:32 - 2013-04-17 02:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-07-10 10:31 - 2013-05-31 20:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-10 10:31 - 2013-05-07 20:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-06-23 11:11 - 2013-06-23 11:11 - 00263592 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-06-23 11:11 - 2013-06-23 11:11 - 00175016 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-06-23 11:11 - 2013-06-23 11:11 - 00175016 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2013-06-23 11:11 - 2013-06-23 11:11 - 00094632 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-06-23 11:11 - 2013-06-23 11:11 - 00000000 ____D C:\Program Files\Java
2013-06-23 11:11 - 2013-06-23 11:11 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-21 06:39 - 2013-06-21 06:39 - 00007073 _____ C:\Users\Standartkonto\clipdat2.rdf
2013-06-20 21:17 - 2013-05-07 19:40 - 00914792 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-20 21:17 - 2013-05-07 17:58 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys
2013-06-20 21:17 - 2013-05-02 14:03 - 03603832 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-20 21:17 - 2013-05-02 14:03 - 03551096 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-20 21:17 - 2013-05-01 20:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-20 21:17 - 2013-05-01 20:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-20 21:17 - 2013-04-23 20:00 - 00985600 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-20 21:17 - 2013-04-23 20:00 - 00133120 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-20 21:17 - 2013-04-23 20:00 - 00098304 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-20 21:17 - 2013-04-23 20:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-20 21:17 - 2013-04-23 17:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-20 21:16 - 2013-04-17 04:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-18 11:50 - 2013-06-18 11:50 - 00211560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\MpFilter.sys

==================== One Month Modified Files and Folders =======

2013-07-14 17:14 - 2013-07-14 17:14 - 00000000 ____D C:\FRST
2013-07-14 07:06 - 2009-11-04 11:48 - 00196608 _____ C:\Windows\System32\Ikeext.etl
2013-07-14 07:06 - 2009-08-17 07:19 - 01505114 _____ C:\Windows\WindowsUpdate.log
2013-07-14 07:06 - 2006-11-02 04:47 - 00003744 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-14 07:06 - 2006-11-02 04:47 - 00003744 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-14 06:45 - 2012-11-10 11:56 - 00000000 ____D C:\Users\Standartkonto\Desktop\Desktop
2013-07-14 06:02 - 2006-11-02 02:33 - 01445310 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-14 04:54 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\tracing
2013-07-14 01:28 - 2009-08-17 07:39 - 00000000 _____ C:\Windows\System32\LogConfigTemp.xml
2013-07-14 00:51 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-13 10:54 - 2006-11-02 04:47 - 02259568 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-13 10:51 - 2010-10-06 13:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-13 10:46 - 2006-11-02 04:37 - 00000000 ____D C:\Windows\System32\XPSViewer
2013-07-13 09:35 - 2011-03-10 11:39 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-13 09:33 - 2012-11-21 21:59 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-13 09:14 - 2006-11-02 02:24 - 75699896 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-07-13 09:13 - 2009-01-22 10:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-13 09:03 - 2006-11-02 04:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-13 01:46 - 2013-07-13 01:46 - 01269137 _____ C:\Users\Standartkonto\Desktop\TeamSpybot-20130713-114643.cab
2013-07-13 01:46 - 2009-11-04 11:31 - 00000000 ___RD C:\Users\Standartkonto\Desktop
2013-07-13 01:41 - 2013-07-13 01:41 - 00000000 ____D C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-13 01:41 - 2013-04-25 00:39 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-06-24 04:50 - 2013-05-25 07:29 - 00008106 _____ C:\Users\Standartkonto\Documents\Spider Solitär Prozent-Rechnung 2013.ods
2013-06-23 11:11 - 2013-06-23 11:11 - 00263592 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-06-23 11:11 - 2013-06-23 11:11 - 00175016 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-06-23 11:11 - 2013-06-23 11:11 - 00175016 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2013-06-23 11:11 - 2013-06-23 11:11 - 00094632 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-06-23 11:11 - 2013-06-23 11:11 - 00000000 ____D C:\Program Files\Java
2013-06-23 11:11 - 2013-06-23 11:11 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-23 11:11 - 2012-05-27 03:29 - 00867240 _____ (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-06-23 11:11 - 2010-10-17 08:18 - 00789416 _____ (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-06-21 06:39 - 2013-06-21 06:39 - 00007073 _____ C:\Users\Standartkonto\clipdat2.rdf
2013-06-21 06:39 - 2012-10-12 04:50 - 00000000 ____D C:\Users\Standartkonto\.clipbak
2013-06-21 06:39 - 2009-11-04 11:31 - 00000000 ____D C:\users\Standartkonto
2013-06-21 06:15 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\rescache
2013-06-21 00:32 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-20 21:21 - 2013-05-01 12:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-20 21:21 - 2013-05-01 12:46 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-20 21:21 - 2009-09-20 01:54 - 00000000 ____D C:\Users\peter\AppData\Local\Adobe
2013-06-18 11:50 - 2013-06-18 11:50 - 00211560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\MpFilter.sys
2013-06-18 11:50 - 2012-03-20 11:44 - 00107392 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\NisDrvWFP.sys
2013-06-16 13:29 - 2013-06-08 11:17 - 00087697 _____ C:\Users\Standartkonto\Documents\Astra Liste Pay u Free TV 05052013 odf-ods.ods

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-03 07:50:46
Restore point made on: 2013-06-07 08:13:08
Restore point made on: 2013-06-09 12:12:13
Restore point made on: 2013-06-10 11:21:17
Restore point made on: 2013-06-11 12:40:17
Restore point made on: 2013-06-15 04:15:01
Restore point made on: 2013-06-20 10:16:53
Restore point made on: 2013-06-21 00:17:49
Restore point made on: 2013-06-21 14:00:22
Restore point made on: 2013-06-22 04:29:30
Restore point made on: 2013-06-23 11:05:21
Restore point made on: 2013-06-23 11:07:43
Restore point made on: 2013-06-23 11:10:49
Restore point made on: 2013-06-24 11:01:33
Restore point made on: 2013-06-29 12:32:56
Restore point made on: 2013-07-03 09:30:20
Restore point made on: 2013-07-04 13:58:17
Restore point made on: 2013-07-05 19:17:36
Restore point made on: 2013-07-07 08:44:04
Restore point made on: 2013-07-10 10:33:09
Restore point made on: 2013-07-13 06:18:46
Restore point made on: 2013-07-13 09:03:32
Restore point made on: 2013-07-14 02:25:52

==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 4089.93 MB
Available physical RAM: 3501.88 MB
Total Pagefile: 3780.2 MB
Available Pagefile: 3612.03 MB
Total Virtual: 2047.88 MB
Available Virtual: 1963.02 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:225.99 GB) (Free:152.58 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:226.03 GB) (Free:151.03 GB) NTFS
Drive f: (PQSERVICE) (Fixed) (Total:10.73 GB) (Free:0.78 GB) FAT32
Drive h: (06-12-12 4K) (Removable) (Total:7.9 GB) (Free:6.35 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 9DAD3428)
Partition 1: (Not Active) - (Size=11 GB) - (Type=27)
Partition 2: (Active) - (Size=226 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=226 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=12)

========================================================
Disk: 2 (Size: 8 GB) (Disk ID: 00AFBA73)
Partition 1: (Active) - (Size=8 GB) - (Type=0C)


LastRegBack: 2013-07-14 01:33

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

schrauber 14.07.2013 18:51
Hi,

das tool bitte ganz normal vom Desktop ausführen :)

petertroj 23.07.2013 19:43
Hi,


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-07-2013 (ATTENTION: FRST version is 9 days old)
Ran by peter (administrator) on 23-07-2013 19:12:50
Running from C:\Users\Standartkonto\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
() C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
() c:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Secunia) C:\Program Files\Secunia\PSI\PSIA.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Nokia) C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PCSuiteTrayApplication] - C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [227328 2007-03-23] (Nokia)
HKLM\...\Run: [WinPatrol] - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot [363752 2012-09-20] (BillP Studios)
HKLM\...\Run: [MSC] - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [995176 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-07-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\RunOnce: [SpybotSnD] - "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck [5365592 2009-01-26] (Safer Networking Limited)
HKLM\...\RunOnce: [*Restore] - C:\Windows\System32\rstrui.exe /runonce [318464 2008-01-21] (Microsoft Corporation)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\RunOnce: [InnoSetupRegFile.0000000001] - "C:\Windows\is-OP4HO.exe" /REG /REGSVRMODE [712264 2013-04-27] ()
Winlogon\Notify\SDWinLogon:  ()
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [SystemExplorerAutoStart] - "C:\Program Files\System Explorer\SystemExplorer.exe" /TRAY [2757080 2012-11-20] (Mister Group)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Default User\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Gast\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 ()
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/421
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files\Internet Explorer\iexplore.exe"
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL =
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [113024 2011-07-19] (SuperAdBlocker.com)

FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: DoNotTrackPlus - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\donottrackplus@abine.com
FF Extension: Ghostery - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\firefox@ghostery.com
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\staged
FF Extension: Flagfox - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF Extension: Clippings - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271}
FF Extension: WOT - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: FoxLingo - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
FF Extension: copy-urls-expert - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\copy-urls-expert@kashiif-gmail.com.xpi
FF Extension: savedpasswordeditor - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\savedpasswordeditor@daniel.dawson.xpi
FF Extension: testpilot - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\testpilot@labs.mozilla.com.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{6bdc61ae-7b80-44a3-9476-e1d121ec2238}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{cd617372-6743-4ee4-bac4-fbf60f35719e}.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\pdf.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\plugin/npVKPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\plugin/npUrlAdvisor.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\plugin/npABPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Authorware Web Player) - C:\Program Files\Mozilla Firefox\plugins\np32asw.dll (Macromedia, Inc.)
CHR Plugin: (Windows Genuine Advantage) - C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
CHR Plugin: (Kaspersky Password Manager) - C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\npkpmAutofill.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.10) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Kaspersky URL Advisor) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0
CHR Extension: (Virtual Keyboard) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0
CHR Extension: (Anti-Banner) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0

========================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [116608 2012-07-11] (SUPERAntiSpyware.com)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-07] (Avira Operations GmbH & Co. KG)
S4 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [69632 2008-10-04] ()
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-11-28] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S4 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] ()
S2 MpsSvc; C:\Windows\System32\. [0 2013-07-23] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)
R2 RichVideo; c:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-01-09] ()
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1326176 2012-07-25] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [681056 2012-07-25] (Secunia)
S3 SystemExplorerHelpService; C:\Program Files\System Explorer\service\SystemExplorerService.exe [567256 2012-08-21] (Mister Group)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-09] (Avira Operations GmbH & Co. KG)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
R2 int15; C:\Windows\system32\drivers\int15.sys [12832 2008-10-01] (Acer, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf.sys [15544 2010-09-01] (Secunia)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [150560 2008-08-26] (Realtek Semiconductor Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S2 adfs; No ImagePath
S3 BIOSCHK; \??\C:\Users\peter\AppData\Local\Temp\TII200A.tmp\disk1\BIOSCHK.SYS [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-23 19:07 - 2013-07-14 16:46 - 01218214 _____ (Farbar) C:\Users\Standartkonto\Desktop\FRST.exe
2013-07-23 16:22 - 2013-07-23 16:26 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 13:44 - 2013-07-23 13:43 - 00983543 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0_1.odg
2013-07-23 13:43 - 2013-07-23 13:41 - 00990581 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0.odg
2013-07-15 03:14 - 2013-07-15 03:14 - 00000000 ____D C:\FRST
2013-07-13 19:12 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-13 19:12 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-13 19:12 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-13 19:12 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-13 19:12 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-13 19:12 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-13 19:12 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-13 19:12 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-13 19:12 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-13 19:12 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-13 19:12 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-13 19:12 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-13 19:12 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-13 19:12 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-13 19:12 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-13 19:12 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-13 11:46 - 2013-07-13 11:46 - 01269137 _____ C:\Users\Standartkonto\Desktop\TeamSpybot-20130713-114643.cab
2013-07-13 11:41 - 2013-07-13 11:41 - 00000000 ____D C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-10 20:32 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 20:32 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 20:32 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 20:32 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 20:32 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 20:32 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 20:32 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 20:32 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 20:32 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:32 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 20:31 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 20:31 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-06-23 21:11 - 2013-06-23 21:11 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-06-23 21:11 - 2013-06-23 21:11 - 00000000 ____D C:\Program Files\Java
2013-06-23 21:11 - 2013-06-23 21:11 - 00000000 ____D C:\Program Files\Common Files\Java

==================== One Month Modified Files and Folders =======

2013-07-23 19:07 - 2009-11-04 21:31 - 00000000 ___RD C:\Users\Standartkonto\Desktop
2013-07-23 19:02 - 2009-08-17 17:19 - 01818287 _____ C:\Windows\WindowsUpdate.log
2013-07-23 18:57 - 2012-12-01 10:14 - 00000620 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2013-07-23 18:57 - 2012-10-06 19:25 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-23 18:53 - 2009-08-17 17:39 - 00000000 _____ C:\Windows\system32\LogConfigTemp.xml
2013-07-23 18:52 - 2009-11-04 21:48 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-07-23 18:52 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-23 18:52 - 2006-11-02 14:47 - 00003744 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 18:52 - 2006-11-02 14:47 - 00003744 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-23 17:38 - 2012-10-04 12:42 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-23 17:30 - 2013-05-01 22:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-23 16:44 - 2012-10-06 19:25 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-23 16:26 - 2013-07-23 16:22 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 15:40 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\tracing
2013-07-23 13:43 - 2013-07-23 13:44 - 00983543 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0_1.odg
2013-07-23 13:41 - 2013-07-23 13:43 - 00990581 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0.odg
2013-07-17 20:47 - 2006-11-02 12:33 - 01445310 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-15 03:14 - 2013-07-15 03:14 - 00000000 ____D C:\FRST
2013-07-14 16:46 - 2013-07-23 19:07 - 01218214 _____ (Farbar) C:\Users\Standartkonto\Desktop\FRST.exe
2013-07-14 16:45 - 2012-11-10 21:56 - 00000000 ____D C:\Users\Standartkonto\Desktop\Desktop
2013-07-14 10:51 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-13 20:54 - 2006-11-02 14:47 - 02259568 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-13 20:51 - 2010-10-06 23:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-13 20:46 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-07-13 19:35 - 2011-03-10 21:39 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-13 19:33 - 2012-11-22 07:59 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-13 19:13 - 2009-01-22 20:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-13 19:03 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-13 11:46 - 2013-07-13 11:46 - 01269137 _____ C:\Users\Standartkonto\Desktop\TeamSpybot-20130713-114643.cab
2013-07-13 11:41 - 2013-07-13 11:41 - 00000000 ____D C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-13 11:41 - 2013-04-25 10:39 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-06-24 14:50 - 2013-05-25 17:29 - 00008106 _____ C:\Users\Standartkonto\Documents\Spider Solitär Prozent-Rechnung 2013.ods
2013-06-24 00:37 - 2006-11-02 12:24 - 75733144 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-06-23 21:11 - 2013-06-23 21:11 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-06-23 21:11 - 2013-06-23 21:11 - 00000000 ____D C:\Program Files\Java
2013-06-23 21:11 - 2013-06-23 21:11 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-23 21:11 - 2012-05-27 13:29 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-06-23 21:11 - 2010-10-17 18:18 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 19:02

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-07-2013
Ran by peter at 2013-07-23 19:13:31
Running from C:\Users\Standartkonto\Desktop
Boot Mode: Normal
==========================================================

 Update for Microsoft Office 2007 (KB2508958)
7-Zip 9.07 beta
Acer Arcade Deluxe (Version: 2.0.5817)
Acer Crystal Eye Webcam 2.0.9.2 (Version: 2.0.9.2)
Acer eAudio Management (Version: 3.0.3009)
Acer eDataSecurity Management (Version: 3.0.3065)
Acer Empowering Technology (Version: 3.0.3013)
Acer ePower Management (Version: 3.0.3016)
Acer eRecovery Management (Version: 3.0.3014)
Acer eSettings Management (Version: 3.0.3007)
Acer GridVista (Version: 2.72.317)
Acer Mobility Center Plug-In (Version: 3.0.3000)
Acer Product Registration (Version: 3.0.0.10)
Acer ScreenSaver (Version: 1.01.1111)
Adobe Flash Player 11 Plugin (Version: 11.7.700.224)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Advanced IP Scanner (Version: 2.2.224)
ATI Catalyst Install Manager (Version: 3.0.704.0)
Avira Free Antivirus (Version: 13.0.0.3737)
C:\Program Files\Acer GameZone\GameConsole (Version: 2.0.1.2)
Catalyst Control Center Core Implementation (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Full Existing (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Full New (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Light (Version: 2008.1210.1623.29379)
Catalyst Control Center Graphics Previews Vista (Version: 2008.1210.1623.29379)
Catalyst Control Center InstallProxy (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Chinese Standard (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Chinese Traditional (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Czech (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Danish (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Dutch (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Finnish (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization French (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization German (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Greek (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Hungarian (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Italian (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Japanese (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Korean (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Norwegian (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Polish (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Portuguese (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Russian (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Spanish (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Swedish (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Thai (Version: 2008.1210.1623.29379)
Catalyst Control Center Localization Turkish (Version: 2008.1210.1623.29379)
CCC Help Chinese Standard (Version: 2008.1210.1622.29379)
CCC Help Chinese Traditional (Version: 2008.1210.1622.29379)
CCC Help Czech (Version: 2008.1210.1622.29379)
CCC Help Danish (Version: 2008.1210.1622.29379)
CCC Help Dutch (Version: 2008.1210.1622.29379)
CCC Help English (Version: 2008.1210.1622.29379)
CCC Help Finnish (Version: 2008.1210.1622.29379)
CCC Help French (Version: 2008.1210.1622.29379)
CCC Help German (Version: 2008.1210.1622.29379)
CCC Help Greek (Version: 2008.1210.1622.29379)
CCC Help Hungarian (Version: 2008.1210.1622.29379)
CCC Help Italian (Version: 2008.1210.1622.29379)
CCC Help Japanese (Version: 2008.1210.1622.29379)
CCC Help Korean (Version: 2008.1210.1622.29379)
CCC Help Norwegian (Version: 2008.1210.1622.29379)
CCC Help Polish (Version: 2008.1210.1622.29379)
CCC Help Portuguese (Version: 2008.1210.1622.29379)
CCC Help Russian (Version: 2008.1210.1622.29379)
CCC Help Spanish (Version: 2008.1210.1622.29379)
CCC Help Swedish (Version: 2008.1210.1622.29379)
CCC Help Thai (Version: 2008.1210.1622.29379)
CCC Help Turkish (Version: 2008.1210.1622.29379)
ccc-core-static (Version: 2008.1210.1623.29379)
ccc-utility (Version: 2008.1210.1623.29379)
Choice Guard (Version: 1.2.87.0)
CyberLink PowerDirector (Version: 6.5.3023d)
Data Lifeguard Diagnostic for Windows 1.24
Defraggler (Version: 2.10)
EPSON-Drucker-Software
ESET Online Scanner v3
eSobi v2 (Version: 2.0.3.000201)
Google Update Helper (Version: 1.3.21.135)
HDAUDIO Soft Data Fax Modem with SmartCP
HiJackThis (Version: 1.0.0)
HijackThis 2.0.2 (Version: 2.0.2)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Junk Mail filter update (Version: 14.0.8050.1202)
Launch Manager
LightScribe  1.4.142.1 (Version: 1.4.142.1)
LOGO!Soft Comfort V7.0  (Version: 7.0.0.0)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8107.0)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (Version: 2.9)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 08.05.0822)
Mozilla Firefox 16.0 (x86 de) (Version: 16.0)
Mozilla Firefox 22.0 (x86 de) (Version: 22.0)
Mozilla Maintenance Service (Version: 17.0)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
Mystery Solitaire - Secret Island
Mythic Mahjong
Nero Digital
Nero OEM
Nokia Connectivity Cable Driver (Version: 6.83.9.0)
Nokia PC Suite (Version: 6.83.14.1)
Nuvoton EC Generic HID Driver (Version: 7.80.5000)
OpenOffice.org 3.3 Language Pack (German) (Version: 3.3.9567)
OpenOffice.org 3.4.1 (Version: 3.41.9593)
Orion (Version: 2.0.1)
PC Connectivity Solution (Version: 7.7.10.0)
PC Inspector smart recovery (Version: 4.50)
Print Server Support (Version: 1.00.0000)
Realtek High Definition Audio Driver (Version: 6.0.1.5704)
Realtek USB 2.0 Card Reader (Version: 3.0.1.3)
RegAlyzer (Version: 1.6.2.16)
Secunia CSI (4.1.0.1010)
Secunia PSI (3.0.0.3001) (Version: 3.0.0.3001)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (Version: 6.2.00)
Skins (Version: 2008.1210.1623.29379)
Spybot - Search & Destroy (Version: 1.6.2)
Spybot - Search & Destroy (Version: 2.0.12)
SUPERAntiSpyware (Version: 5.5.1016)
System Explorer 3.9.9
TomTom HOME 2.7.3.1894 (Version: 2.7.3.1894)
TomTom HOME Visual Studio Merge Modules (Version: 1.0.2)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Windows Live Call (Version: 14.0.8050.1202)
Windows Live Communications Platform (Version: 14.0.8050.1202)
Windows Live Essentials (Version: 14.0.8050.1202)
Windows Live Fotogalerie (Version: 14.0.8051.1204)
Windows Live Mail (Version: 14.0.8050.1202)
Windows Live Messenger (Version: 14.0.8050.1202)
Windows Live Sync (Version: 14.0.8050.1202)
Windows Live Writer (Version: 14.0.8050.1202)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
WinPatrol (Version: 25.6.2012.1)
 

==================== Restore Points  =========================

21-06-2013 22:00:06 Geplanter Prüfpunkt
22-06-2013 12:29:10 Geplanter Prüfpunkt
23-06-2013 19:04:54 JavaFX 2.1.1 wird entfernt
23-06-2013 19:07:37 Removed Java 7 Update 21
23-06-2013 19:10:44 Installed Java 7 Update 25
24-06-2013 19:01:05 Windows Update
29-06-2013 20:32:38 Geplanter Prüfpunkt
03-07-2013 17:29:59 Geplanter Prüfpunkt
04-07-2013 21:57:59 Geplanter Prüfpunkt
06-07-2013 03:17:17 Geplanter Prüfpunkt
07-07-2013 16:43:02 Windows Update
10-07-2013 18:31:54 Windows Update
13-07-2013 14:18:22 Geplanter Prüfpunkt
13-07-2013 17:03:07 Windows Update
14-07-2013 10:25:36 Geplanter Prüfpunkt
17-07-2013 18:19:40 Windows Update
20-07-2013 08:21:57 Geplanter Prüfpunkt
21-07-2013 13:56:11 Geplanter Prüfpunkt
22-07-2013 12:09:44 Windows Update
23-07-2013 13:54:14 Geplanter Prüfpunkt
23-07-2013 14:21:45 Windows Update

==================== Hosts content: ==========================

2006-11-02 12:23 - 2012-10-07 15:12 - 00000098 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {18B30BA7-99DC-498C-8290-2471D2A81067} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDScan.exe No File
Task: {1B633EA0-B459-4C1F-81B4-6248065FF374} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E646C92-3908-4263-9631-F3F9F306812E} - System32\Tasks\User_Feed_Synchronization-{F301875A-A68A-4528-8553-CDA8BF71143E} => C:\Windows\system32\msfeedssync.exe [2011-07-17] (Microsoft Corporation)
Task: {2444ED81-626D-4E17-AB7A-756B19F7398C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {2E06B68F-27A1-4CC5-80C9-8A658DB3B8E3} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDUpdate.exe No File
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {4F834927-E617-460C-BAE8-435401407DA3} - System32\Tasks\DriverScanner => C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe No File
Task: {544E5642-7F52-4FCC-ACC7-61A451BC249E} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Standartkonto => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {5B1FDAE0-63DD-4DCE-B2C1-DC794A1FE545} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {60934507-F379-458D-8BC3-94C8EAF9537D} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-06-20] (Microsoft Corporation)
Task: {6E836A2F-FC15-4510-A13F-C7E454CE8D97} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-06] (Google Inc.)
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {B2882190-AE6E-4272-B0CE-098336B45A46} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-06] (Google Inc.)
Task: {B6680894-A4A7-4751-87BE-24EA6559718F} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - peter => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {C7A558D9-B94C-4068-9437-48ACC78341C6} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDImmunize.exe No File
Task: {D6C3D114-6D9C-403D-AA23-BB370DF6ECE2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-21] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{F301875A-A68A-4528-8553-CDA8BF71143E}.job => C:\Windows\system32\msfeedssync.exe

==================== Faulty Device Manager Devices =============

Name: Nokia 6300
Description: Nokia Windows Portable Device Driver
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Nokia
Service: WUDFRd
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/23/2013 06:53:12 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 01:24:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/22/2013 01:59:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/22/2013 11:06:22 AM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (07/22/2013 10:43:09 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/21/2013 10:23:19 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (07/21/2013 00:01:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2013 08:18:08 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/19/2013 10:08:20 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (07/19/2013 07:58:12 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/23/2013 07:02:57 PM) (Source: Microsoft Antimalware) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

        Neue Signaturversion:

        Vorherige Signaturversion: 1.155.493.0

        Aktualisierungsquelle: %NT-AUTORITÄT59

        Aktualisierungsphase: 4.3.0215.00

        Quellpfad: 4.3.0215.01

        Signaturtyp: %NT-AUTORITÄT602

        Aktualisierungstyp: %NT-AUTORITÄT604

        Benutzer: NT-AUTORITÄT\SYSTEM

        Aktuelle Modulversion: %NT-AUTORITÄT605

        Vorherige Modulversion: %NT-AUTORITÄT606

        Fehlercode: %NT-AUTORITÄT607

        Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (07/23/2013 06:55:23 PM) (Source: Service Control Manager) (User: )
Description: Google Update Service (gupdate)%%1053

Error: (07/23/2013 06:55:23 PM) (Source: Service Control Manager) (User: )
Description: 30000Google Update Service (gupdate)

Error: (07/23/2013 06:53:12 PM) (Source: Service Control Manager) (User: )
Description: MpsSvc%%2

Error: (07/23/2013 06:53:12 PM) (Source: Service Control Manager) (User: )
Description: adfs%%2

Error: (07/23/2013 06:53:12 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (07/23/2013 06:52:51 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: C:\Windows\system32\RAIHV.dll126

Error: (07/23/2013 06:52:36 PM) (Source: volmgr) (User: )
Description: Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist fehlgeschlagen. Stellen
Sie sicher, dass eine Auslagerungsdatei auf der Startpartition vorhanden ist und dass diese
groß genug ist, um den gesamten physikalischen Speicher abbilden zu können.

Error: (07/23/2013 06:52:25 PM) (Source: volmgr) (User: )
Description: Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist fehlgeschlagen. Stellen
Sie sicher, dass eine Auslagerungsdatei auf der Startpartition vorhanden ist und dass diese
groß genug ist, um den gesamten physikalischen Speicher abbilden zu können.

Error: (07/23/2013 03:23:46 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "SE551",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{8E7D015B-C8E3-4106-894D-F3F008C7580A-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-07-13 19:33:17.799
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:17.189
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:16.611
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:16.012
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:08.868
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:08.217
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:07.657
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:33:07.019
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:32:57.699
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-13 19:32:57.077
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 44%
Total physical RAM: 3065.93 MB
Available physical RAM: 1695.91 MB
Total Pagefile: 6569.1 MB
Available Pagefile: 5007.49 MB
Total Virtual: 2047.88 MB
Available Virtual: 1916.12 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:225.99 GB) (Free:152.59 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:226.03 GB) (Free:150.97 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 9DAD3428)
Partition 1: (Not Active) - (Size=11 GB) - (Type=27)
Partition 2: (Active) - (Size=226 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=226 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=12)

==================== End Of Log ============================

schrauber 23.07.2013 20:59
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

petertroj 30.07.2013 23:43
Es waren mehrere Scanläufe bis zum Durchlauf nötig.
Das Vista MS Essential deinstalliert, Spybot Search & Destroy deaktiviert, Avira ebenfalls.
Combofix öffnete 3 eigene 3ex-Dateien, konnten nicht geschlossen werden.
Daher Start im abgesicherten Modus, Scanläufe Spybot mit Neustart.
Combofix lief nun durch, s. u. .
Abschließend Immunisierung Spybot, 1.534 dateien konnten nicht immunisiert werden, Hinweis auf Avira ergab sich aus der Hilfe.

Soweit die Log-Dateien von Spybot beigefügt werden sollen (etwa 8) bitte ich um Info.

Code:
Combofix Logfile:

       
Code:

       
ComboFix 13-07-30.03 - peter 30.07.2013  23:02:27.7.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3066.1809 [GMT 2:00]
ausgeführt von:: c:\users\Standartkonto\Desktop\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-06-28 bis 2013-07-30  ))))))))))))))))))))))))))))))
.
.
2013-07-30 21:09 . 2013-07-30 21:09        --------        d-----w-        c:\users\peter\AppData\Local\temp
2013-07-30 21:09 . 2013-07-30 21:09        --------        d-----w-        c:\users\TEMP\AppData\Local\temp
2013-07-30 20:46 . 2013-07-15 01:34        7143960        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9CDFA99-7D91-4EE8-BB4D-C1D2E6AD9348}\mpengine.dll
2013-07-24 12:37 . 2013-07-24 12:37        4        ----a-w-        c:\users\Standartkonto\advanced_ip_scanner_MAC.bin
2013-07-23 14:22 . 2013-07-23 14:26        --------        d-----w-        c:\windows\system32\MRT
2013-07-15 01:14 . 2013-07-15 01:14        --------        d-----w-        C:\FRST
2013-07-13 09:41 . 2013-07-13 09:41        --------        d-----w-        c:\users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-10 18:32 . 2013-06-04 01:50        2049024        ----a-w-        c:\windows\system32\win32k.sys
2013-07-10 18:32 . 2013-04-17 10:10        1069056        ----a-w-        c:\windows\system32\DWrite.dll
2013-07-10 18:32 . 2013-04-17 10:10        798208        ----a-w-        c:\windows\system32\FntCache.dll
2013-07-10 18:32 . 2013-04-17 11:28        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll
2013-07-10 18:32 . 2013-04-17 11:28        189952        ----a-w-        c:\windows\system32\d3d10core.dll
2013-07-10 18:32 . 2013-04-17 11:28        1029120        ----a-w-        c:\windows\system32\d3d10.dll
2013-07-10 18:32 . 2013-04-17 10:34        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2013-07-10 18:32 . 2013-04-17 10:33        486400        ----a-w-        c:\windows\system32\d3d10level9.dll
2013-07-10 18:32 . 2013-04-17 11:28        160768        ----a-w-        c:\windows\system32\d3d10_1.dll
2013-07-10 18:32 . 2013-04-17 10:14        683008        ----a-w-        c:\windows\system32\d2d1.dll
2013-07-10 18:31 . 2013-06-01 04:06        505344        ----a-w-        c:\windows\system32\qedit.dll
2013-07-10 18:31 . 2013-05-08 04:04        1548288        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2013-07-10 18:31 . 2013-04-09 03:51        936960        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 18:31 . 2013-04-09 03:52        1218048        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2013-07-10 18:31 . 2013-04-09 03:51        983552        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2013-07-10 18:31 . 2013-04-09 03:51        964608        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-23 19:11 . 2013-06-23 19:11        94632        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2013-06-23 19:11 . 2012-05-27 11:29        867240        ----a-w-        c:\windows\system32\npDeployJava1.dll
2013-06-23 19:11 . 2010-10-17 16:18        789416        ----a-w-        c:\windows\system32\deployJava1.dll
2013-06-21 05:21 . 2013-05-01 20:46        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-21 05:21 . 2013-05-01 20:46        692104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2013-05-08 03:40 . 2013-06-21 05:17        914792        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2013-05-08 01:58 . 2013-06-21 05:17        31232        ----a-w-        c:\windows\system32\drivers\tcpipreg.sys
2013-05-02 22:03 . 2013-06-21 05:17        3603832        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2013-05-02 22:03 . 2013-06-21 05:17        3551096        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-05-02 04:04 . 2013-06-21 05:17        443904        ----a-w-        c:\windows\system32\win32spl.dll
2013-05-02 04:03 . 2013-06-21 05:17        37376        ----a-w-        c:\windows\system32\printcom.dll
2013-05-02 00:06 . 2009-11-22 10:57        238872        ------w-        c:\windows\system32\MpSigStub.exe
2012-10-04 13:21 . 2012-10-04 13:21        261600        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 15:52        121392        ----a-w-        c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SystemExplorerAutoStart"="c:\program files\System Explorer\SystemExplorer.exe" [2012-11-20 2757080]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Spybot-S&D Cleaning"="c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe" [2012-11-13 3713032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-09-20 363752]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-07 345144]
"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2012-11-13 3825176]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]
"*Restore"="c:\windows\System32\rstrui.exe" [2008-01-21 318464]
"Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040]
"InnoSetupRegFile.0000000001"="c:\windows\is-OP4HO.exe" [2013-04-27 712264]
.
c:\users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2012-5-27 3656]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2012-7-25 572000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ           autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2012-07-11 116608]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-01 05:21]
.
2013-07-30 c:\windows\Tasks\Check for updates (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDUpdate.exe [2012-12-01 13:08]
.
2013-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-06 17:25]
.
2013-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-06 17:25]
.
2013-07-23 c:\windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDImmunize.exe [2012-12-01 13:07]
.
2012-12-01 c:\windows\Tasks\Scan the system (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDScan.exe [2012-12-01 13:07]
.
2010-12-19 c:\windows\Tasks\User_Feed_Synchronization-{F301875A-A68A-4528-8553-CDA8BF71143E}.job
- c:\windows\system32\msfeedssync.exe [2011-07-17 09:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: Hinzufügen zu Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky PURE 2.0\ie_banner_deny.htm
IE: Kaspersky PURE - c:\progra~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\spIEBho.dll/616
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\
FF - prefs.js: browser.search.defaulturl -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
Notify-SDWinLogon - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1 - d:\z 1 d 190912 191 gb frei\B Blöde Adware usw\A Acer Recovery FP Tool\Data Lifeguard Diagnostic for Windows\unins000.exe
AddRemove-{A62F9CD0-B2E0-4F2A-88F2-79254A3C8539} - c:\progra~2\INSTAL~2\{A62F9~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-07-30 23:09
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5836)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
.
Zeit der Fertigstellung: 2013-07-30  23:12:09
ComboFix-quarantined-files.txt  2013-07-30 21:12
.
Vor Suchlauf: 24 Verzeichnis(se), 163.307.077.632 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 163.248.967.680 Bytes frei
.
- - End Of File - - 0DFC218431A004B39E33D5E011D240BE

--- --- ---
27A811553A4F7A6A891CA99FFAE128F7

schrauber 31.07.2013 09:46
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

petertroj 31.07.2013 10:55
hallo, hatte versäumt Tracking-Programme anzugeben, 8 SD-Dateien nachfolgend.

Die Anweisungen arbeite ich selbstverständlich noch ab und melde mich danach wieder.
Code:
24.07.2013 14:41:36 - ##### check started #####
24.07.2013 14:41:36 - ### Version: 1.6.2
24.07.2013 14:41:36 - ### Date: 24.07.2013 14:41:36
24.07.2013 14:41:40 - ##### checking bots #####
24.07.2013 14:55:44 - ##### check finished #####
Code:
--- Report generated: 2013-07-24 14:55 ---

Gratuliere!: Es wurden keine Spione gefunden. (Status)
 


--- Spybot - Search & Destroy version: 1.6.2  (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2012-12-09 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2012-11-20 Includes\Adware.sbi (*)
2012-12-11 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-11-14 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2012-12-11 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2012-12-11 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2012-11-14 Includes\Spyware.sbi (*)
2012-11-14 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2012-12-11 Includes\Trojans.sbi (*)
2012-12-11 Includes\TrojansC-02.sbi (*)
2012-12-11 Includes\TrojansC-03.sbi (*)
2012-12-11 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2012-12-03 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll
Code:
Search results from Spybot - Search & Destroy

24.07.2013 18:55:20
Scan took 00:17:28.
33 items found.

Log: [SBI $8E73A7FB]  Activity: ntbtlog.txt (File, nothing done)
  C:\Windows\ntbtlog.txt
  Properties.size=20260836
  Properties.md5=2D8FD68116EAB1E66112F09428706198
  Properties.filedate=1374659054
  Properties.filedatetext=2013-07-24 11:44:14

Log: [SBI $8E73A7FB]  Install: wmsetup.log (File, nothing done)
  C:\Windows\wmsetup.log
  Properties.size=411
  Properties.md5=D031AE28D7B92159C197994216146434
  Properties.filedate=1352641716
  Properties.filedatetext=2012-11-11 15:48:36

Log: [SBI $8E73A7FB]  Shutdown: System32\wbem\logs\wmiprov.log (File, nothing done)
  C:\Windows\System32\wbem\logs\wmiprov.log
  Properties.size=4800
  Properties.md5=52D966E0A2DD8424C0BA86FDF26A0DD4
  Properties.filedate=1374086882
  Properties.filedatetext=2013-07-17 20:48:01

7-Zip: [SBI $12C3A52C] Folder history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\7-ZIP\FM\FolderHistory

7-Zip: [SBI $3D5692BD] Last used folder (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\7-ZIP\FM\PanelPath0

Internet Explorer: [SBI $FF589D0C] Download directory (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Internet Explorer\Download Directory

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Regedit: [SBI $C3B62FC1] Recent open key (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (7) (Browser: Cookie, nothing done)
 

History: [SBI $49804B54] Browser: History (34) (Browser: History, nothing done)
 

Cookie: [SBI $49804B54] Browser: Cookie (19) (Browser: Cookie, nothing done)
 


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-12-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-12-18 Includes\Adware.sbi (*)
2013-04-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2013-04-09 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-04-09 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-04-09 Includes\Spyware.sbi (*)
2013-04-09 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-03-19 Includes\TrojansC-02.sbi (*)
2013-04-09 Includes\TrojansC-03.sbi (*)
2013-03-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2013-03-01 Includes\TrojansC.sbi (*)
Code:
Search results from Spybot - Search & Destroy

29.07.2013 12:54:44
Scan took 00:17:23.
44 items found.

ilivid.Toolbar: [SBI $F899F771] IE start page (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Internet Explorer\Main\Start Page

Log: [SBI $8E73A7FB]  Activity: ntbtlog.txt (File, nothing done)
  C:\Windows\ntbtlog.txt
  Properties.size=20358740
  Properties.md5=8FDA1A9119E1E06BD6849C5F71537908
  Properties.filedate=1375092322
  Properties.filedatetext=2013-07-29 12:05:22

Log: [SBI $8E73A7FB]  Install: wmsetup.log (File, nothing done)
  C:\Windows\wmsetup.log
  Properties.size=411
  Properties.md5=D031AE28D7B92159C197994216146434
  Properties.filedate=1352641716
  Properties.filedatetext=2012-11-11 15:48:36

Log: [SBI $8E73A7FB]  Shutdown: System32\wbem\logs\wmiprov.log (File, nothing done)
  C:\Windows\System32\wbem\logs\wmiprov.log
  Properties.size=4800
  Properties.md5=52D966E0A2DD8424C0BA86FDF26A0DD4
  Properties.filedate=1374086882
  Properties.filedatetext=2013-07-17 20:48:01

7-Zip: [SBI $12C3A52C] Folder history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\7-ZIP\FM\FolderHistory

7-Zip: [SBI $3D5692BD] Last used folder (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\7-ZIP\FM\PanelPath0

Internet Explorer: [SBI $FF589D0C] Download directory (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Internet Explorer\Download Directory

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Regedit: [SBI $C3B62FC1] Recent open key (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

MS Regedit: [SBI $C3B62FC1] Recent open key (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (7) (Browser: Cookie, nothing done)
 

History: [SBI $49804B54] Browser: History (55) (Browser: History, nothing done)
 

Cookie: [SBI $49804B54] Browser: Cookie (19) (Browser: Cookie, nothing done)
 


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-12-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-12-18 Includes\Adware.sbi (*)
2013-04-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2013-04-09 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-04-09 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-04-09 Includes\Spyware.sbi (*)
2013-04-09 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-03-19 Includes\TrojansC-02.sbi (*)
2013-04-09 Includes\TrojansC-03.sbi (*)
2013-03-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2013-03-01 Includes\TrojansC.sbi (*)
Code:
Search results from Spybot - Search & Destroy

29.07.2013 21:32:58
Scan took 00:16:58.
45 items found.

ilivid.Toolbar: [SBI $F899F771] IE start page (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Internet Explorer\Main\Start Page

Log: [SBI $8E73A7FB]  Activity: ntbtlog.txt (File, nothing done)
  C:\Windows\ntbtlog.txt
  Properties.size=20359188
  Properties.md5=AB6E5D60E78C57E35F657AC9C38EDC14
  Properties.filedate=1375102716
  Properties.filedatetext=2013-07-29 14:58:35

Log: [SBI $8E73A7FB]  Install: wmsetup.log (File, nothing done)
  C:\Windows\wmsetup.log
  Properties.size=411
  Properties.md5=D031AE28D7B92159C197994216146434
  Properties.filedate=1352641716
  Properties.filedatetext=2012-11-11 15:48:36

Log: [SBI $8E73A7FB]  Shutdown: System32\wbem\logs\wmiprov.log (File, nothing done)
  C:\Windows\System32\wbem\logs\wmiprov.log
  Properties.size=4800
  Properties.md5=52D966E0A2DD8424C0BA86FDF26A0DD4
  Properties.filedate=1374086882
  Properties.filedatetext=2013-07-17 20:48:01

7-Zip: [SBI $12C3A52C] Folder history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\7-ZIP\FM\FolderHistory

7-Zip: [SBI $3D5692BD] Last used folder (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\7-ZIP\FM\PanelPath0

Internet Explorer: [SBI $FF589D0C] Download directory (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Internet Explorer\Download Directory

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Regedit: [SBI $C3B62FC1] Recent open key (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

MS Regedit: [SBI $C3B62FC1] Recent open key (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (7) (Browser: Cookie, nothing done)
 

Cache: [SBI $49804B54] Browser: Cache (1) (Browser: Cache, nothing done)
 

History: [SBI $49804B54] Browser: History (55) (Browser: History, nothing done)
 

Cookie: [SBI $49804B54] Browser: Cookie (19) (Browser: Cookie, nothing done)
 


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-12-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-12-18 Includes\Adware.sbi (*)
2013-04-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2013-04-09 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-04-09 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-04-09 Includes\Spyware.sbi (*)
2013-04-09 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-03-19 Includes\TrojansC-02.sbi (*)
2013-04-09 Includes\TrojansC-03.sbi (*)
2013-03-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2013-03-01 Includes\TrojansC.sbi (*)
Code:
Search results from Spybot - Search & Destroy

30.07.2013 19:07:16
Scan took 00:15:06.
10 items found.

Log: [SBI $8E73A7FB]  Activity: ntbtlog.txt (File, nothing done)
  C:\Windows\ntbtlog.txt
  Properties.size=441370
  Properties.md5=7FF937F2871B9707E01FFC6D425A82A4
  Properties.filedate=1375186048
  Properties.filedatetext=2013-07-30 14:07:27

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Internet Explorer\TypedURLs

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

History: [SBI $49804B54] Browser: History (4) (Browser: History, nothing done)
 


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-12-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-12-18 Includes\Adware.sbi (*)
2013-04-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2013-04-09 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-04-09 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-04-09 Includes\Spyware.sbi (*)
2013-04-09 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-03-19 Includes\TrojansC-02.sbi (*)
2013-04-09 Includes\TrojansC-03.sbi (*)
2013-03-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2013-03-01 Includes\TrojansC.sbi (*)
Code:
Search results from Spybot - Search & Destroy

30.07.2013 20:45:48
Scan took 00:14:27.
31 items found.

ilivid.Toolbar: [SBI $AD51DBF4] Program directory (Directory, nothing done)
  C:\Users\peter\AppData\LocalLow\DataMngr\
  Directory.subfile=C:\Users\peter\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}
  Directory.subfile.size=82
  Directory.subfile.md5=8E706BE105ACA0BF8CA5C7D8B5A65F19
  Directory.subfile.filedate=1348392788
  Directory.subfile.filedatetext=2012-09-23 11:33:07

MediaPlex: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Inaktive Benutzer): Standartkonto) (Browser: Cookie, nothing done)
 

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Inaktive Benutzer): Standartkonto) (Browser: Cookie, nothing done)
 

FastClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Inaktive Benutzer): Standartkonto) (Browser: Cookie, nothing done)
 

MediaPlex: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Inaktive Benutzer): Standartkonto) (Browser: Cookie, nothing done)
 

WebTrends live: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Inaktive Benutzer): Standartkonto) (Browser: Cookie, nothing done)
 

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Office 12.0 (Word): [SBI $E357B233] Recent Document List (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Office\12.0\Word\File MRU

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1765665137-1713434591-3169019743-501\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Verlauf: [SBI $49804B54] Browser: History (25) (Browser: History, nothing done)
 

Cookie: [SBI $49804B54] Browser: Cookie (48) (Browser: Cookie, nothing done)
 

Verlauf: [SBI $49804B54] Browser: History (27) (Browser: History, nothing done)
 

Verlauf: [SBI $49804B54] Browser: History (6) (Browser: History, nothing done)
 

Cookie: [SBI $49804B54] Browser: Cookie (403) (Browser: Cookie, nothing done)
 


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-12-01 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-12-18 Includes\Adware.sbi (*)
2013-04-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2013-04-09 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-04-09 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-04-09 Includes\Spyware.sbi (*)
2013-04-09 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-03-19 Includes\TrojansC-02.sbi (*)
2013-04-09 Includes\TrojansC-03.sbi (*)
2013-03-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2013-03-01 Includes\TrojansC.sbi (*)
Code:
SDFSSvc.exe [2012-12-01 09:14:06] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-01 21:29:18] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-02 07:48:15] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-02 08:52:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-02 09:03:53] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-03 14:31:03] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-04 03:19:48] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-06 04:46:35] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-09 11:34:08] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-09 19:24:26] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-09 21:42:10] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-09 23:05:02] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-09 23:54:52] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-11 21:46:34] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-11 23:48:20] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-14 00:11:07] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-14 11:14:21] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-21 08:49:40] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-21 10:28:43] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-29 10:29:20] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2012-12-30 09:19:45] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-01-08 23:46:20] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-02-11 20:03:38] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-02-16 09:25:29] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-02-24 18:49:03] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-03-01 19:30:26] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-03-03 09:21:09] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-03-10 23:34:10] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-03-11 06:26:43] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-03-16 09:33:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-06 10:02:49] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-06 13:09:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-06 16:24:21] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-06 17:12:13] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-07 05:37:57] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-07 18:35:49] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-09 02:12:16] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-09 02:40:22] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-10 06:55:31] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-13 07:20:22] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-14 19:29:57] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-15 09:35:53] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-16 07:36:03] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-16 08:31:06] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-16 08:51:53] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-19 09:08:53] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-20 13:04:28] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-21 09:11:55] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-22 10:06:29] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-22 18:35:24] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-23 10:24:08] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-23 19:58:34] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-24 09:21:16] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-24 11:31:24] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-25 09:41:44] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-26 18:03:50] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-26 20:06:02] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-28 00:44:00] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-29 08:05:04] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-29 15:14:32] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-04-30 09:23:04] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-01 21:11:12] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-01 22:24:14] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-02 07:41:54] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-03 08:36:34] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-04 10:35:02] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-05 11:57:33] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-08 08:14:51] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-10 08:06:42] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-10 21:11:48] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-11 08:16:56] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-12 11:43:46] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-12 19:10:17] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-13 06:35:34] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-18 11:10:46] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-19 09:45:11] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-20 12:20:53] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-20 19:01:40] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-21 14:39:03] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-22 18:28:00] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-25 09:24:02] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-28 16:42:25] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-30 07:02:09] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-05-31 08:33:45] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-01 07:46:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-03 16:57:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-04 21:07:48] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-05 19:45:31] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-07 15:12:49] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-09 14:39:44] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-09 19:07:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-10 18:35:56] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-11 17:27:56] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-15 11:05:13] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-18 19:28:21] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-19 20:16:34] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-20 09:09:46] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-20 15:42:24] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-21 15:59:24] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-22 11:59:29] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-23 10:49:17] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-24 12:58:24] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-06-29 08:56:35] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-01 16:15:12] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-03 17:02:13] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-04 17:28:31] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-05 21:00:41] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-06 02:18:24] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-07 18:31:01] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-09 20:54:31] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-10 20:17:39] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-13 10:52:41] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-13 14:29:06] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-13 17:33:57] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-13 20:54:19] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-14 09:51:30] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-14 11:27:07] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-14 18:37:49] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-17 20:09:04] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-19 19:58:04] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-20 08:17:45] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-21 12:01:45] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-22 10:42:59] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-22 13:59:29] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-23 13:24:28] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-23 18:53:03] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-24 06:02:47] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-24 11:16:10] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-24 11:29:13] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-24 11:43:25] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-25 10:56:03] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-26 10:47:50] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-27 09:12:29] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-28 13:52:22] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-29 11:53:04] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-29 12:04:59] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-29 22:08:45] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-29 22:55:33] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-29 23:23:48] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-30 08:43:18] 0.0.0.0  Successfully started listening on port 21322.
SDFSSvc.exe [2013-07-30 23:54:53] 0.0.0.0  Successfully started listening on port 21322.

schrauber 31.07.2013 11:50
ok ich warte dann auf die Logs :)

petertroj 31.07.2013 15:27
mb ac jrt frst

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.31.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
peter :: PETER-VERA-PC [Administrator]

31.07.2013 12:14:51
mbam-log-2013-07-31 (12-14-51).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen:
Durchsuchte Objekte: 269825
Laufzeit: 7 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
# AdwCleaner v2.306 - Datei am 31/07/2013 um 13:41:03 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : peter - PETER-VERA-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Standartkonto\Desktop\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Users\Standartkonto\AppData\Roaming\Mozilla\Firefox\Profiles\kg8k40zp.default\extensions\browserprotect@browserprotect.com.xpi

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16496

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Standartkonto\AppData\Roaming\Mozilla\Firefox\Profiles\kg8k40zp.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\Standartkonto\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R12].txt - [1338 octets] - [09/12/2012 20:56:48]
AdwCleaner[R13].txt - [1399 octets] - [14/12/2012 01:14:31]
AdwCleaner[R14].txt - [1460 octets] - [16/12/2012 05:25:17]
AdwCleaner[R15].txt - [1521 octets] - [16/12/2012 08:16:40]
AdwCleaner[R16].txt - [1582 octets] - [30/12/2012 14:08:13]
AdwCleaner[R17].txt - [1643 octets] - [25/04/2013 10:37:01]
AdwCleaner[R18].txt - [2377 octets] - [31/07/2013 13:41:03]

########## EOF - \AdwCleaner[R18].txt - [2438 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.9 (07.30.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by peter on 31.07.2013 at 13:55:22,15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.07.2013 at 13:57:08,01
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-07-2013 (ATTENTION: FRST version is 17 days old)
Ran by peter (administrator) on 31-07-2013 16:11:21
Running from C:\Users\Standartkonto\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
() C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
() c:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Secunia) C:\Program Files\Secunia\PSI\PSIA.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Nokia) C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) D:\Program Files\Mozilla Firefox\firefox.exe
(Mister Group) C:\Program Files\System Explorer\SystemExplorer.exe
(Mister Group) C:\Program Files\System Explorer\service\SystemExplorerService.exe
(Mozilla Corporation) D:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PCSuiteTrayApplication] - C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [227328 2007-03-23] (Nokia)
HKLM\...\Run: [WinPatrol] - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot [363752 2012-09-20] (BillP Studios)
HKLM\...\Run: [avgnt] - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-07-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\RunOnce: [SpybotSnD] - "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [5365592 2009-01-26] (Safer Networking Limited)
HKLM\...\RunOnce: [*Restore] - C:\Windows\System32\rstrui.exe /runonce [318464 2008-01-21] (Microsoft Corporation)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\RunOnce: [InnoSetupRegFile.0000000001] - "C:\Windows\is-OP4HO.exe" /REG /REGSVRMODE [712264 2013-04-27] ()
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [SystemExplorerAutoStart] - "C:\Program Files\System Explorer\SystemExplorer.exe" /TRAY [2757080 2012-11-20] (Mister Group)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [Spybot-S&D Cleaning] - "C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean [3713032 2012-11-13] (Safer-Networking Ltd.)
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Default User\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Gast\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 ()
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Standartkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files\Internet Explorer\iexplore.exe"
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL =
BHO: SDHelper - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [113024 2011-07-19] (SuperAdBlocker.com)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: DoNotTrackMe - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\donottrackplus@abine.com
FF Extension: Ghostery - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\firefox@ghostery.com
FF Extension: Flagfox - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF Extension: Clippings - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271}
FF Extension: WOT - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: FoxLingo - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
FF Extension: copy-urls-expert - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\copy-urls-expert@kashiif-gmail.com.xpi
FF Extension: savedpasswordeditor - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\savedpasswordeditor@daniel.dawson.xpi
FF Extension: testpilot - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\testpilot@labs.mozilla.com.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{6bdc61ae-7b80-44a3-9476-e1d121ec2238}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\7k3nytxg.default\Extensions\{cd617372-6743-4ee4-bac4-fbf60f35719e}.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\pdf.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\plugin/npVKPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\plugin/npUrlAdvisor.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\plugin/npABPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Authorware Web Player) - C:\Program Files\Mozilla Firefox\plugins\np32asw.dll (Macromedia, Inc.)
CHR Plugin: (Windows Genuine Advantage) - C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
CHR Plugin: (Kaspersky Password Manager) - C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\MODULE~1\npkpmAutofill.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.10) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Kaspersky URL Advisor) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0
CHR Extension: (Virtual Keyboard) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0
CHR Extension: (Anti-Banner) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0

========================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [116608 2012-07-11] (SUPERAntiSpyware.com)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-07] (Avira Operations GmbH & Co. KG)
S4 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [69632 2008-10-04] ()
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-11-28] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S4 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] ()
R2 RichVideo; c:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-01-09] ()
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1326176 2012-07-25] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [681056 2012-07-25] (Secunia)
R3 SystemExplorerHelpService; C:\Program Files\System Explorer\service\SystemExplorerService.exe [567256 2012-08-21] (Mister Group)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-09] (Avira Operations GmbH & Co. KG)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
R2 int15; C:\Windows\system32\drivers\int15.sys [12832 2008-10-01] (Acer, Inc.)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf.sys [15544 2010-09-01] (Secunia)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [150560 2008-08-26] (Realtek Semiconductor Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S2 adfs; No ImagePath
S3 BIOSCHK; \??\C:\Users\peter\AppData\Local\Temp\TII200A.tmp\disk1\BIOSCHK.SYS [x]
S3 catchme; \??\C:\Users\peter\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-31 13:57 - 2013-07-31 13:57 - 00000804 _____ C:\Users\peter\Desktop\JRT.txt
2013-07-31 13:55 - 2013-07-31 13:55 - 00000000 ____D C:\Windows\ERUNT
2013-07-31 13:54 - 2013-07-31 13:54 - 00000273 _____ C:\Users\Standartkonto\AppData\Roaming\Safer-Networking.log
2013-07-31 13:47 - 2013-07-31 13:47 - 00000000 ____D C:\AdwCleaner aus  C-Root
2013-07-31 13:41 - 2013-07-31 13:41 - 00002506 _____ C:\AdwCleaner[R18].txt
2013-07-31 00:23 - 2012-10-07 15:12 - 00000098 _____ C:\Windows\system32\Drivers\etc\hosts.20130731-002341.backup
2013-07-30 23:12 - 2013-07-30 23:12 - 00011939 _____ C:\ComboFix.txt
2013-07-30 23:00 - 2013-07-30 23:12 - 00000000 ____D C:\ComboFix
2013-07-30 23:00 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-30 23:00 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-30 23:00 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-30 23:00 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-30 23:00 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-30 23:00 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-30 23:00 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-30 23:00 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-29 12:27 - 2013-07-29 12:27 - 00000000 ____D C:\Users\peter\Documents\ProcAlyzer Dumps
2013-07-24 14:37 - 2013-07-24 14:37 - 00000332 _____ C:\Users\Standartkonto\Documents\Eigene IP Scan Mi 24.07.13 wg Combofix xml-datei.xml
2013-07-24 14:37 - 2013-07-24 14:37 - 00000004 _____ C:\Users\Standartkonto\advanced_ip_scanner_MAC.bin
2013-07-24 05:25 - 2013-07-30 23:12 - 00000000 ____D C:\Qoobox
2013-07-23 19:13 - 2013-07-23 19:16 - 00025363 _____ C:\Users\Standartkonto\Desktop\Addition.txt
2013-07-23 19:07 - 2013-07-14 16:46 - 01218214 _____ (Farbar) C:\Users\Standartkonto\Desktop\FRST.exe
2013-07-23 16:22 - 2013-07-23 16:26 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 13:44 - 2013-07-23 13:43 - 00983543 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0_1.odg
2013-07-23 13:43 - 2013-07-23 13:41 - 00990581 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0.odg
2013-07-15 03:14 - 2013-07-15 03:14 - 00000000 ____D C:\FRST
2013-07-13 19:12 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-13 19:12 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-13 19:12 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-13 19:12 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-13 19:12 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-13 19:12 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-13 19:12 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-13 19:12 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-13 19:12 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-13 19:12 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-13 19:12 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-13 19:12 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-13 19:12 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-13 19:12 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-13 19:12 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-13 19:12 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-13 11:46 - 2013-07-13 11:46 - 01269137 _____ C:\Users\Standartkonto\Desktop\TeamSpybot-20130713-114643.cab
2013-07-13 11:41 - 2013-07-13 11:41 - 00000000 ____D C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-10 20:32 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 20:32 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 20:32 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 20:32 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 20:32 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 20:32 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 20:32 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 20:32 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 20:32 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:32 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 20:31 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 20:31 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

==================== One Month Modified Files and Folders =======

2013-07-31 16:11 - 2009-11-04 21:31 - 00000000 ___RD C:\Users\Standartkonto\Desktop
2013-07-31 16:05 - 2009-08-17 17:19 - 01996799 _____ C:\Windows\WindowsUpdate.log
2013-07-31 16:02 - 2012-12-01 10:14 - 00000620 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2013-07-31 16:02 - 2012-10-06 19:25 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-31 16:02 - 2009-11-04 21:48 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-07-31 16:02 - 2009-08-17 17:39 - 00000000 _____ C:\Windows\system32\LogConfigTemp.xml
2013-07-31 16:02 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-31 16:02 - 2006-11-02 14:47 - 00003744 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-31 16:02 - 2006-11-02 14:47 - 00003744 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-31 14:30 - 2012-10-04 12:42 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-31 14:25 - 2009-09-08 20:42 - 00078600 _____ C:\Users\peter\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-31 13:57 - 2013-07-31 13:57 - 00000804 _____ C:\Users\peter\Desktop\JRT.txt
2013-07-31 13:57 - 2009-09-08 20:41 - 00000000 ___RD C:\Users\peter\Desktop
2013-07-31 13:55 - 2013-07-31 13:55 - 00000000 ____D C:\Windows\ERUNT
2013-07-31 13:54 - 2013-07-31 13:54 - 00000273 _____ C:\Users\Standartkonto\AppData\Roaming\Safer-Networking.log
2013-07-31 13:47 - 2013-07-31 13:47 - 00000000 ____D C:\AdwCleaner aus  C-Root
2013-07-31 13:43 - 2012-10-06 19:25 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-31 13:41 - 2013-07-31 13:41 - 00002506 _____ C:\AdwCleaner[R18].txt
2013-07-31 13:31 - 2013-05-01 22:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-31 12:47 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\tracing
2013-07-31 12:11 - 2013-04-26 18:30 - 00000910 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-07-31 12:11 - 2010-09-01 20:31 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-31 12:11 - 2006-11-02 15:02 - 00000000 __RHD C:\Users\Public\Desktop
2013-07-31 12:06 - 2012-11-10 21:56 - 00000000 ____D C:\Users\Standartkonto\Desktop\Desktop
2013-07-31 00:30 - 2012-12-01 10:14 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2013-07-31 00:07 - 2012-12-01 10:13 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2
2013-07-30 23:49 - 2008-01-21 04:47 - 04045752 _____ C:\Windows\PFRO.log
2013-07-30 23:12 - 2013-07-30 23:12 - 00011939 _____ C:\ComboFix.txt
2013-07-30 23:12 - 2013-07-30 23:00 - 00000000 ____D C:\ComboFix
2013-07-30 23:12 - 2013-07-24 05:25 - 00000000 ____D C:\Qoobox
2013-07-30 23:09 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-07-30 14:16 - 2010-07-25 11:33 - 00001356 _____ C:\Users\Standartkonto\AppData\Local\d3d9caps.dat
2013-07-29 21:47 - 2010-04-05 14:16 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-29 12:27 - 2013-07-29 12:27 - 00000000 ____D C:\Users\peter\Documents\ProcAlyzer Dumps
2013-07-24 14:37 - 2013-07-24 14:37 - 00000332 _____ C:\Users\Standartkonto\Documents\Eigene IP Scan Mi 24.07.13 wg Combofix xml-datei.xml
2013-07-24 14:37 - 2013-07-24 14:37 - 00000004 _____ C:\Users\Standartkonto\advanced_ip_scanner_MAC.bin
2013-07-24 14:37 - 2009-11-04 21:31 - 00000000 ____D C:\Users\Standartkonto
2013-07-24 05:42 - 2011-03-10 21:39 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-23 19:16 - 2013-07-23 19:13 - 00025363 _____ C:\Users\Standartkonto\Desktop\Addition.txt
2013-07-23 16:26 - 2013-07-23 16:22 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 13:43 - 2013-07-23 13:44 - 00983543 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0_1.odg
2013-07-23 13:41 - 2013-07-23 13:43 - 00990581 _____ C:\Users\Standartkonto\Documents\BMW%20KFZ%20Schein%20b%20001.jpg_0.odg
2013-07-17 20:47 - 2006-11-02 12:33 - 01445310 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-15 03:14 - 2013-07-15 03:14 - 00000000 ____D C:\FRST
2013-07-14 16:46 - 2013-07-23 19:07 - 01218214 _____ (Farbar) C:\Users\Standartkonto\Desktop\FRST.exe
2013-07-14 10:51 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-13 20:54 - 2006-11-02 14:47 - 02259568 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-13 20:51 - 2010-10-06 23:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-13 20:46 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-07-13 19:13 - 2009-01-22 20:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-13 19:03 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-13 11:46 - 2013-07-13 11:46 - 01269137 _____ C:\Users\Standartkonto\Desktop\TeamSpybot-20130713-114643.cab
2013-07-13 11:41 - 2013-07-13 11:41 - 00000000 ____D C:\Users\peter\AppData\Roaming\SUPERAntiSpyware.com
2013-07-13 11:41 - 2013-04-25 10:39 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-31 16:08

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 31.07.2013 19:33
Supi :)


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131