Win 7: Fehlermeldung bei Start; Avira wird blockiert
Hallo!
Ich hatte seit Oktober 2013 keinen Internetanschluss mehr; in diesem Zeitraum war mein Rechner zwei mal mit dem Internet verbunden. Bei diesen beiden Malen habe ich mir offensichtlich irgendetwas eingefangen. Jedes mal beim Start öffnet sich zweimal die gleiche Fehlermeldung, die RegSvr32 heißt und so lautet: Code:
Fehler beim Laden des Moduls "".
Stellen Sie sicher, dass die Binärdatei am angegebenen Pfad gespeichert ist, oder debuggen Sie die Datei, um Probleme mit der binären Datei oder abhängigen DLL-Dateien auszuschließen.
Das angegebene Modul wurde nicht gefunden.
Seit heute habe ich wieder einen Internetzugang und habe festgestellt, dass sich Avira nicht aktualisieren lässt. Angeblich wird das durch die Gruppenrichtlinie blockiert. Deinstallieren lässt es sich auch nicht. Ich habe Windows 7 Home Premium, 32 bit.
Bisher habe ich Malwarebytes laufen lassen, und er hat auch ein bisschen was gefunden, was dann in die Quarantäne verschoben wurde, aber die Probleme bestehen weiterhin. Ich fürchte, ich habe keinen Log davon erstellen lassen :/ Das Anti-Rootkit habe ich auch ausgeführt, da wurde nichts gefunden. Wüsstet ihr, was sonst noch tun ist?
Hier die Logfiles:
defogger_disable: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:40 on 08/12/2014 (Perdita)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)
-=E.O.F=-
frst: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Perdita (administrator) on ADEMAS on 08-12-2014 18:52:11
Running from C:\Users\Perdita\Downloads
Loaded Profile: Perdita (Available profiles: Perdita)
Platform: Microsoft Windows 7 Home Premium (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(WeGame.com, Inc.) C:\Program Files\WeGame\wgclientservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Eastman Kodak Company) C:\Program Files\Kodak\KODAK Share Button App\Listener.exe
(JME) C:\Program Files\jmesoft\hotkey.exe
(Lenovo) C:\Program Files\Lenovo\HealthCare\HealthCare.exe
(CyberLink) C:\Program Files\Lenovo\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Valve Corporation) C:\Program Files\Steam\Steam.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\Perdita\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Valve Corporation) C:\Program Files\Steam\bin\steamwebhelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Last.fm) C:\Program Files\Last.fm\Last.fm Scrobbler.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\ATH.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] => C:\Windows\test.bat
HKLM\...\Run: [jmekey] => C:\Program Files\jmesoft\hotkey.exe [114688 2009-07-16] (JME)
HKLM\...\Run: [Healthcare] => C:\Program Files\Lenovo\HealthCare\HealthCare.exe [827392 2009-09-28] (Lenovo)
HKLM\...\Run: [CLMLServer] => C:\Program Files\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-31] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-23] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [2039192 2014-11-21] (APN)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Run: [KGShareApp] => C:\Program Files\Kodak\KODAK Share Button App\KGShare_App.exe [394752 2012-02-03] (Eastman Kodak Company)
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Run: [BitTorrent] => "C:\Program Files\BitTorrent\BitTorrent.exe" /MINIMIZED
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Run: [Steam] => C:\Program Files\Steam\Steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Run: [EfetOciwg] => regsvr32.exe "
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Run: [IlibUtdi] => regsvr32.exe "
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30872160 2014-12-03] (Skype Technologies S.A.)
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\MountPoints2: J - J:\autorun.exe
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\MountPoints2: {4c90729e-bc33-11e0-86a2-4487fcaa80c9} - I:\LaunchU3.exe -a
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\MountPoints2: {cc08b4c0-57b3-11e0-a229-806e6f6e6963} - I:\StartSetup.exe
HKU\S-1-5-18\...\RunOnce: [WLStart] => C:\Program Files\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2014-07-24] (Microsoft Corporation)
Startup: C:\Users\Perdita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [1TortoiseNormal] -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [2TortoiseModified] -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [3TortoiseConflict] -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [4TortoiseLocked] -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [5TortoiseReadOnly] -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [6TortoiseDeleted] -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [7TortoiseAdded] -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [8TortoiseIgnored] -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [9TortoiseUnversioned] -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
AutoConfigURL: [S-1-5-21-2829335788-446563168-3763627994-1004] => hxxp://proxy.kodak.com:81/proxy.pac
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://start.facemoods.com/?a=ddr
hxxp://www.lenovo.com/
HKU\S-1-5-21-2829335788-446563168-3763627994-1004\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 - (No Name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No File
SearchScopes: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> DefaultScope {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKU\S-1-5-21-2829335788-446563168-3763627994-1004 -> No Name - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} hxxp://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
Handler: msell2 - {9367D24B-8506-471A-915A-CFBB4BCEB631} - C:\Program Files\Common Files\Microsoft Shared\Reference Titles\MSELL2.dll ()
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 40 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=1.6.0_37 -> C:\windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @virtools.com/3DviaPlayer -> C:\Program Files\Virtools\3D Life Player\npvirtools.dll No File
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Flashblock - C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013-04-17]
FF Extension: DownloadHelper - C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-08]
FF Extension: ProxTube - C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947\Extensions\ich@maltegoetz.de.xpi [2014-12-08]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: Unseen - C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947\Extensions\unseen@tangrs.xpi [2013-05-23]
FF Extension: Greasemonkey - C:\Users\Perdita\AppData\Roaming\Mozilla\Firefox\Profiles\ln9pv4cr.default-1357577942947\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-07-28]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-06-25]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-06-25]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-06-25]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-05-18]
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-05-18]
Chrome:
=======
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Perdita\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Perdita\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Perdita\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (3DVIA player) - C:\Program Files\Virtools\3D Life Player\npvirtools.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Perdita\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Perdita\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Perdita\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-28]
CHR Extension: (Google-Suche) - C:\Users\Perdita\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-28]
CHR Extension: (DivX HiQ) - C:\Users\Perdita\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae [2011-12-28]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\Perdita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2011-12-28]
CHR Extension: (Google Mail) - C:\Users\Perdita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-28]
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-11-27]
CHR HKLM\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-08]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-23] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-11-21] (APN LLC.)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 WeGameClientService; C:\Program Files\WeGame\WGClientService.exe [18472 2011-07-28] (WeGame.com, Inc.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-06-25] (Avira Operations GmbH & Co. KG)
S3 EverestDriver; C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [7168 2005-08-17] () [File not signed]
S3 SCREAMINGBDRIVER; C:\windows\System32\drivers\ScreamingBAudio.sys [34384 2009-12-01] (Screaming Bee LLC)
S4 sptd; C:\windows\System32\Drivers\sptd.sys [431672 2011-03-26] (Duplex Secure Ltd.)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-07] (Avira GmbH)
R2 WinI2C-DDC; C:\windows\system32\drivers\DDCDrv.sys [16200 2009-03-02] (Nicomsoft Ltd.)
S3 wsvd; C:\windows\System32\DRIVERS\wsvd.sys [81704 2009-07-21] (CyberLink)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-08 18:52 - 2014-12-08 18:53 - 00024066 _____ () C:\Users\Perdita\Downloads\FRST.txt
2014-12-08 18:50 - 2014-12-08 18:52 - 00000000 ____D () C:\FRST
2014-12-08 18:50 - 2014-12-08 18:50 - 01111040 _____ (Farbar) C:\Users\Perdita\Downloads\FRST.exe
2014-12-08 18:40 - 2014-12-08 18:41 - 00000636 _____ () C:\Users\Perdita\Downloads\defogger_disable.log
2014-12-08 18:40 - 2014-12-08 18:41 - 00000020 _____ () C:\Users\Perdita\defogger_reenable
2014-12-08 18:40 - 2014-12-08 18:40 - 00050477 _____ () C:\Users\Perdita\Downloads\Defogger.exe
2014-12-08 15:19 - 2014-12-08 18:41 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-12-08 15:15 - 2014-12-08 18:41 - 00000000 ____D () C:\Users\Perdita\Desktop\mbar
2014-12-08 15:15 - 2014-12-08 15:15 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Perdita\Downloads\mbar-1.08.2.1001.exe
2014-12-08 15:13 - 2014-12-08 15:13 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-12-08 15:13 - 2014-12-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-12-08 15:13 - 2014-12-08 15:13 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-12-08 14:36 - 2014-12-08 15:19 - 00119000 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-08 14:36 - 2014-12-08 15:15 - 00079576 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-12-08 14:36 - 2014-12-08 14:36 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-08 14:36 - 2014-12-08 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-08 14:36 - 2014-12-08 14:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-08 14:36 - 2014-12-08 14:36 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-12-08 14:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-12-08 14:36 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-12-08 14:35 - 2014-12-08 14:35 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Perdita\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-08 14:34 - 2014-12-08 14:35 - 154051656 _____ () C:\Users\Perdita\Downloads\avira_free_antivirus468_de.exe
2014-11-29 23:45 - 2014-12-08 18:50 - 00054156 ____H () C:\windows\QTFont.qfn
2014-11-29 23:45 - 2014-11-29 23:45 - 00001409 _____ () C:\windows\QTFont.for
2014-11-25 00:45 - 2014-11-25 03:35 - 00000413 _____ () C:\Users\Perdita\Essen Dezember.txt
2014-11-19 22:09 - 2014-11-19 22:09 - 00026119 _____ () C:\Users\Perdita\Documents\wwwiki.odt
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-08 18:50 - 2010-06-21 22:21 - 01104284 _____ () C:\windows\WindowsUpdate.log
2014-12-08 18:49 - 2010-10-07 18:15 - 00000000 ____D () C:\Users\Perdita\AppData\Local\Last.fm
2014-12-08 18:46 - 2012-11-23 19:53 - 00000000 ___RD () C:\Users\Perdita\Dropbox
2014-12-08 18:46 - 2012-11-23 19:49 - 00000000 ____D () C:\Users\Perdita\AppData\Roaming\Dropbox
2014-12-08 18:45 - 2010-10-10 17:50 - 00000000 ____D () C:\Users\Perdita\AppData\Roaming\Skype
2014-12-08 18:44 - 2013-01-02 22:42 - 00000000 ____D () C:\Program Files\Steam
2014-12-08 18:43 - 2012-04-02 11:48 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-12-08 18:43 - 2011-09-18 22:40 - 00151562 _____ () C:\windows\setupact.log
2014-12-08 18:43 - 2010-06-21 22:53 - 00566136 _____ () C:\windows\PFRO.log
2014-12-08 18:43 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-12-08 18:41 - 2011-11-10 20:08 - 00000000 ____D () C:\Users\Perdita\AppData\Local\TSVNCache
2014-12-08 18:40 - 2010-10-07 16:44 - 00000000 ____D () C:\Users\Perdita
2014-12-08 15:20 - 2009-07-14 05:34 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-08 15:20 - 2009-07-14 05:34 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-08 15:13 - 2012-01-15 16:26 - 00000000 ___RD () C:\Program Files\Skype
2014-12-08 15:13 - 2010-10-10 17:50 - 00000000 ____D () C:\ProgramData\Skype
2014-12-08 15:08 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\IME
2014-12-08 14:21 - 2012-11-23 19:53 - 00000985 _____ () C:\Users\Perdita\Desktop\Dropbox.lnk
2014-12-08 14:21 - 2012-11-23 19:51 - 00000000 ____D () C:\Users\Perdita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-08 14:16 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\NDF
2014-12-07 22:32 - 2010-11-06 16:58 - 00000000 ____D () C:\Users\Perdita\AppData\Roaming\vlc
2014-12-05 23:45 - 2014-09-04 13:40 - 00000000 ____D () C:\Users\Perdita\AppData\Local\The Witcher
2014-11-28 15:12 - 2014-09-28 13:20 - 00000330 _____ () C:\Users\Perdita\Einkaufsliste N.txt
2014-11-28 15:10 - 2014-10-09 21:17 - 00000034 _____ () C:\Users\Perdita\Einkaufsliste Schlafzimmer.txt
2014-11-26 00:22 - 2012-10-31 06:36 - 00000000 ____D () C:\Users\Perdita\Documents\Petrifikation
2014-11-25 02:34 - 2013-03-12 19:35 - 00047392 _____ () C:\Users\Perdita\Documents\The key.odt
2014-11-20 18:25 - 2014-01-27 20:19 - 00000601 _____ () C:\windows\tlknw16.ini
2014-11-20 18:22 - 2014-01-27 20:19 - 00000614 _____ () C:\windows\tlknw18.ini
2014-11-15 21:40 - 2010-06-21 22:24 - 01654782 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-12 14:08 - 2011-04-26 01:22 - 00000000 ____D () C:\Users\Perdita\AppData\Roaming\dvdcss
Files to move or delete:
====================
C:\ProgramData\flashax10.exe
C:\Users\Perdita\SkypeLogView.exe
C:\Users\Perdita\VampirePatch_1_1.exe
C:\Users\Perdita\VtMB_Clan_Quest_Mod_Installer_3.0.exe
C:\Users\Perdita\[4ls]_katawa_shoujo_[windows][C3798628].exe
Some content of TEMP:
====================
C:\Users\Perdita\AppData\Local\Temp\AskSLib.dll
C:\Users\Perdita\AppData\Local\Temp\avgnt.exe
C:\Users\Perdita\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Perdita\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyfmx4x.dll
C:\Users\Perdita\AppData\Local\Temp\htmlayout.dll
C:\Users\Perdita\AppData\Local\Temp\iTunesPluginWinSetup_3.0.4.0.exe
C:\Users\Perdita\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Perdita\AppData\Local\Temp\Last.fm-2.1.30.exe
C:\Users\Perdita\AppData\Local\Temp\mirc722.exe
C:\Users\Perdita\AppData\Local\Temp\setup.exe
C:\Users\Perdita\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Perdita\AppData\Local\Temp\vlc-2.0.2-win32.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 17:35
==================== End Of Log ============================
additions: Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Perdita at 2014-12-08 18:53:55
Running from C:\Users\Perdita\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Leawo Video Converter Pro Version 5.4.0.0 (HKLM\...\{2A533488-2D72-4367-AC73-9FCE91C2910E}_is1) (Version: 5.4.0.0 - Leawo Software Co.,Ltd.)
2007 Microsoft Office system (HKLM\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
3DVIA player 5.0 (HKLM\...\{4E868D3D-6EEB-4273-926C-2287236B5B79}) (Version: 5.0.0.12 - 3DVIA)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.3.9120 - Adobe Systems Inc.)
Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Reader X (10.1.3) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.)
Apple Application Support (HKLM\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E14ADE0E-75F3-4A46-87E5-26692DD626EC}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0 (HKLM\...\Audacity_is1) (Version: - Audacity Team)
Avidemux 2.6 (32-bit) (HKLM\...\Avidemux 2.6) (Version: 2.6.6.8941 - )
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3977 - APN, LLC)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Business Contact Manager für Outlook 2007 SP2 (HKLM\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)
Business Contact Manager für Outlook 2007 SP2 (Version: 3.0.8619.1 - Microsoft Corporation) Hidden
Combined Community Codec Pack 2011-06-26 (HKLM\...\Combined Community Codec Pack_is1) (Version: 2011.06.26.0 - CCCP Project)
Convert AVI to MP4 1.3 (HKLM\...\{9ECE13D2-C028-44CB-8A96-A65196E7BBE7}_is1) (Version: - convertavitomp3.com)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Deus Ex: Game of the Year Edition (HKLM\...\Steam App 6910) (Version: - Eidos)
Direct Show Ogg Vorbis Filter (remove only) (HKLM\...\OggDS) (Version: - )
DivX-Setup (HKLM\...\DivX Setup.divx.com) (Version: 2.5.0.8 - DivX, LLC)
Dota 2 (HKLM\...\Steam App 570) (Version: - )
Dota 2 Test (HKLM\...\Steam App 205790) (Version: - )
Dropbox (HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
DVDx 4.0 Open Edition (HKLM\...\DVDx 4.0 Open Edition) (Version: 4.0 (Open Edition) - labDV)
Encarta Language Learning Spanish (HKLM\...\ELLE00A) (Version: 2.0 - Microsoft Corporation)
EPSON TWAIN 5 (HKLM\...\{254BEB3E-1085-4D66-9CDC-0152C0DC2E93}) (Version: 5.71.0000 - SEIKO EPSON Corp.)
EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
FLAC 1.2.1b (remove only) (HKLM\...\FLAC) (Version: 1.2.1b - Xiph.org)
Free AVI Video Converter version 5.0.28.827 (HKLM\...\Free AVI Video Converter_is1) (Version: 5.0.28.827 - DVDVideoSoft Ltd.)
Free Video to iPhone Converter version 5.0.20.1031 (HKLM\...\Free Video to iPhone Converter_is1) (Version: 5.0.20.1031 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.41.623 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.41.623 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.13.925 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.13.925 - DVDVideoSoft Ltd.)
Genesys USB Mass Storage Device (HKLM\...\{9E8CC1E9-BEFE-4873-B387-C9337408902C}) (Version: 1.0.0.0 - Genesys Logic)
Grand Theft Auto Vice City (HKU\S-1-5-21-2829335788-446563168-3763627994-1004\...\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}) (Version: 1.00.000 - )
ICQ7.7 (HKLM\...\{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}) (Version: 7.7 - ICQ)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
iTunes (HKLM\...\{9B486871-27EB-49A5-8832-77176E63333C}) (Version: 11.0.5.5 - Apple Inc.)
Java(TM) 6 Update 37 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216037FF}) (Version: 6.0.370 - Oracle)
JDownloader 0.9 (HKLM\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Katawa Shoujo (HKLM\...\Katawa Shoujo) (Version: - )
KODAK Share-Tastenanwendung (HKLM\...\{16B2498C-C6C1-4AE7-95EF-D2A09F50071C}) (Version: 4.01.0000.0000 - Eastman Kodak Company)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
Last.fm Scrobbler 2.1.35 (HKLM\...\LastFM_is1) (Version: - Last.fm)
Lenovo Healthcare Software (HKLM\...\{9610EC3A-C7A0-4C31-9F3B-F9020C582B47}) (Version: 3.0.0.090928 - Lenovo)
Lenovo Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3321a3 - CyberLink Corp.)
Lenovo Power2Go (Version: 6.0.3321a3 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 3.0.1029 - CyberLink Corp.)
Lenovo Rescue System (Version: 3.0.1029 - CyberLink Corp.) Hidden
Lenovo Software Instruction (HKLM\...\{A79C1D34-2831-4A5D-91C7-279EF892B5CF}) (Version: 1.0.0.090907 - Lenovo)
Lenovo Treiber- und Anwendungsinstallation (HKLM\...\{45970CD1-D599-47D4-938F-3E9800D54ED1}) (Version: 5.1.0.1126 - Lenovo)
LMMS 0.4.12 (HKLM\...\lmms) (Version: 0.4.12 - LMMS Developers)
LVT (HKLM\...\{D3063097-EC84-4D21-84A4-9D852E974355}) (Version: 4.1.1.0930 - Lenovo)
LXH-JME2207FN Hotkey Driver (HKLM\...\{42B21298-C850-4272-AFD9-636CBC005421}) (Version: 5.1.0804 - Lenovo)
MailStore Home 8.0.2.8361 (HKLM\...\MailStore Home_universal1) (Version: 8.0.2.8361 - MailStore Software GmbH)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Player Codec Pack 3.9.6 (HKLM\...\Media Player - Codec Pack) (Version: - Media Player Codec Pack)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.7 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visio Viewer 2010 (HKLM\...\{95140000-0052-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mIRC (HKLM\...\mIRC) (Version: 7.22 - mIRC Co. Ltd.)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MP3 Player Utilities 4.07 (HKLM\...\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}) (Version: 4.07 - )
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NSIS FreePOPs (remove only) (HKLM\...\FreePOPs) (Version: - )
One-click FLAC to MP3 Converter (HKLM\...\{C438FF68-F2F2-4322-A8C4-A66721795B73}) (Version: 4.3.0 - Streamware Development)
OpenOffice.org 3.3 (HKLM\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Opera 12.16 (HKLM\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
Oracle VM VirtualBox 4.1.16 (HKLM\...\{46991620-ECC1-462B-88BF-5B91BF133E77}) (Version: 4.1.16 - Oracle Corporation)
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41417}) (Version: 3.61.0 - dotPDN LLC)
Passport to 35 Languages (HKLM\...\Passport to 35 Languages) (Version: - )
Python 2.5.2 (HKLM\...\{6B976ADF-8AE8-434E-B282-A06C7F624D2F}) (Version: 2.5.2150 - Python Software Foundation)
QuickTime (HKLM\...\QuickTime) (Version: - )
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0006 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6383 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.100 - Skype Technologies S.A.)
SRWare Iron Version SRWare Iron 22.0.1250.0 (HKLM\...\{C59CF2CE-B302-4833-AA35-E0E07D8EBC52}_is1) (Version: SRWare Iron 22.0.1250.0 - SRWare)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
The Witcher: Enhanced Edition (HKLM\...\Steam App 20900) (Version: - CD Projekt RED)
TortoiseSVN 1.7.4.22459 (32 bit) (HKLM\...\{7F93D3CD-AC73-42D9-A0B5-D543DB7E0FA2}) (Version: 1.7.22459 - TortoiseSVN)
Tunatic (HKLM\...\Tunatic) (Version: - )
Uninstall Neocodex Program Manager (HKLM\...\Neocodex Program Manager_is1) (Version: - )
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Vampire - The Masquerade Bloodlines (HKLM\...\InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}) (Version: 1.00.0000 - Activision)
Vampire - The Masquerade Bloodlines (Version: 1.00.0000 - Activision) Hidden
Vampire - The Masquerade Bloodlines (Version: 1.2 - Activision) Hidden
Vampire Editor (HKLM\...\Vampire Editor) (Version: - )
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN)
WeGame Client 2.4.3.0 (HKLM\...\12345_is1) (Version: 2.4.3.0 - WeGame.com, Inc.)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows-Treiberpaket - Eastman Kodak KODAK Digital Camera (01/29/2010 1.4.1.0) (HKLM\...\3D970B9F930E7AAE23C06D39A1AC98548C90B442) (Version: 01/29/2010 1.4.1.0 - Eastman Kodak)
WinRAR 4.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
WinX Free WMV to AVI Converter 2.0.5 (HKLM\...\WinX Free WMV to AVI Converter_is1) (Version: - Digiarty Software,Inc.)
Xilisoft MKV Converter (HKLM\...\Xilisoft MKV Converter) (Version: 7.5.0.20120822 - Xilisoft)
XMedia Recode Version 3.1.3.0 (HKLM\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.3.0 - XMedia Recode)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{cb4c77f0-ab2a-407c-93ac-963769824b18}\localserver32 -> C:\Users\Perdita\AppData\Local\Temp\{b3ede298-ae75-4a1c-ab7e-1b9229b77bbe}\IDriver.NonElevated.exe N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2829335788-446563168-3763627994-1004_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Perdita\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
19-11-2014 13:56:46 Geplanter Prüfpunkt
28-11-2014 16:14:46 Geplanter Prüfpunkt
05-12-2014 16:42:45 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2010-04-30 13:56 - 00001798 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 125.252.224.90
127.0.0.1 125.252.224.91
127.0.0.1 hl2rcv.adobe.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {05EA369B-6A01-4270-881C-4C87758DE180} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-23] (Adobe Systems Incorporated)
Task: {1B4DCD1C-8BEC-439E-B7D7-1121FF653AF3} - System32\Tasks\{44ED86AE-4517-4C10-AD60-2BD16A40B93F} => C:\Users\Perdita\SM\smds-ss10.exe
Task: {4DABE1E9-21DD-42AF-AAFF-812373D24460} - System32\Tasks\{F382F5D8-0963-42AF-9494-789DA1F32C38} => C:\Users\Perdita\SM\smds-ss10.exe
Task: {51ECA420-3498-46B5-863A-93E80E2DDF79} - System32\Tasks\{51AEED3C-013F-4306-8754-7EAB3858B89D} => D:\InstMsiA.exe
Task: {5431EB89-CFBA-4490-89B2-70CCEEBDFDB5} - System32\Tasks\{C7CCCEE5-8A5A-439E-94BE-623749CF29BD} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.112/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered
Task: {6C017007-8963-4154-9383-67673AFF0EF5} - System32\Tasks\AdobeAAMUpdater-1.0-Ademas-Perdita => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {77676842-E112-456C-A7F6-A42A75A5593A} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {A3A6583B-3F6A-4202-BC51-9D860E3CFFEE} - System32\Tasks\{D664A3F4-6D6D-4A85-9804-D5E27162F44D} => C:\Users\Perdita\SM\smds-ss10.exe
Task: {B5134163-3355-4A22-9EFD-8BF401429019} - System32\Tasks\{8D737D27-DF47-4F26-A552-F57A958F58A8} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-03] (Skype Technologies S.A.)
Task: {BA3B19BB-06FF-478A-AEE2-13601D6D1378} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {BF45E256-CE0A-4474-AF53-C0D6589671A7} - System32\Tasks\{A9FCDF30-A5CC-4C54-A396-E72DA82A082D} => C:\Users\Perdita\rese\SETUP.EXE
Task: {E8AFDDFC-816F-46F6-BB2B-0299C92A4201} - System32\Tasks\{4591C429-6196-482C-8BC1-2826264ACE71} => C:\Users\Perdita\rese\SETUP.EXE
Task: {EBE25965-CB9A-451F-A045-F0F15B6963B2} - System32\Tasks\{10EF5062-FADE-4238-95E4-4EA61663B88F}-Kodak Share Button App Camera detect => C:\Program Files\Kodak\KODAK Share Button App\Listener.exe [2012-02-03] (Eastman Kodak Company)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-01-13 14:33 - 2012-01-13 14:33 - 00070424 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll
2010-06-21 22:22 - 2009-07-16 08:20 - 00032768 _____ () C:\Program Files\jmesoft\Keyhook.dll
2010-06-21 22:22 - 2007-12-31 09:27 - 00007168 _____ () C:\Program Files\jmesoft\VistaVolume.dll
2010-06-21 22:31 - 2008-09-27 07:39 - 00045056 _____ () C:\Program Files\Lenovo\HealthCare\HOOK.dll
2010-06-21 22:31 - 2009-09-09 08:24 - 00057344 _____ () C:\Program Files\Lenovo\HealthCare\de-de\de-de.dll
2009-06-03 19:59 - 2009-06-03 19:59 - 00619816 ____N () C:\Program Files\Lenovo\Power2Go\CLMediaLibrary.dll
2009-06-03 19:59 - 2009-06-03 19:59 - 00013096 ____N () C:\Program Files\Lenovo\Power2Go\CLMLSvcPS.dll
2014-12-08 15:11 - 2014-11-11 19:48 - 01171456 _____ () C:\Program Files\Steam\libavcodec-56.dll
2014-12-08 15:11 - 2014-11-11 19:48 - 00442368 _____ () C:\Program Files\Steam\libavutil-54.dll
2014-12-08 15:11 - 2014-11-11 19:48 - 00332800 _____ () C:\Program Files\Steam\libavresample-2.dll
2013-03-12 17:10 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files\Steam\SDL2.dll
2014-06-25 10:25 - 2014-11-18 21:23 - 02227904 _____ () C:\Program Files\Steam\video.dll
2014-12-08 15:11 - 2014-11-11 19:48 - 00403968 _____ () C:\Program Files\Steam\libavformat-56.dll
2014-12-08 15:11 - 2014-11-11 19:48 - 00485888 _____ () C:\Program Files\Steam\libswscale-3.dll
2013-01-02 22:44 - 2014-11-18 21:23 - 00690880 _____ () C:\Program Files\Steam\bin\chromehtml.DLL
2014-12-08 18:45 - 2014-12-08 18:45 - 00043008 _____ () c:\users\perdita\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyfmx4x.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Perdita\AppData\Roaming\Dropbox\bin\libcef.dll
2014-06-25 13:50 - 2014-06-25 13:50 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-01-02 22:44 - 2014-11-11 19:48 - 34589888 _____ () C:\Program Files\Steam\bin\libcef.dll
2013-01-16 15:18 - 2013-03-06 13:11 - 00757248 _____ () C:\Program Files\Last.fm\unicorn.dll
2013-01-16 15:18 - 2013-03-06 13:11 - 00032768 _____ () C:\Program Files\Last.fm\logger.dll
2013-01-16 15:18 - 2013-03-05 13:25 - 00350720 _____ () C:\Program Files\Last.fm\lastfm.dll
2013-01-16 15:18 - 2013-03-06 13:11 - 00126976 _____ () C:\Program Files\Last.fm\listener.dll
2013-01-16 15:18 - 2013-01-18 11:39 - 00302592 _____ () C:\Program Files\Last.fm\phonon.dll
2013-03-10 22:02 - 2013-01-18 11:49 - 00182784 _____ () C:\Program Files\Last.fm\plugins\phonon_backend\phonon_vlc.dll
2013-01-16 15:18 - 2012-12-13 00:12 - 00111104 _____ () C:\Program Files\Last.fm\libvlc.dll
2013-01-16 15:18 - 2012-12-13 00:13 - 02286592 _____ () C:\Program Files\Last.fm\libvlccore.dll
2013-03-10 22:02 - 2012-12-13 00:13 - 00049664 _____ () C:\Program Files\Last.fm\plugins\audio_output\libaout_directx_plugin.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: FirebirdServerMAGIXInstance => 3
MSCONFIG\Services: FLEXnet Licensing Service => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WeGame.lnk => C:\windows\pss\WeGame.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Perdita^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: facemoods => "C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodssrv.exe" /md I
MSCONFIG\startupreg: ICQ => "C:\Program Files\ICQ7.7\ICQ.exe" silent loginmode=4
MSCONFIG\startupreg: PowerSuite => "C:\Program Files\Uniblue\PowerSuite\launcher.exe" delay 20000 -m
MSCONFIG\startupreg: PWRISOVM.EXE => C:\Program Files\PowerISO\PWRISOVM.EXE
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SpeedUpMyPC => "C:\Program Files\Uniblue\SpeedUpMyPC\launcher.exe" delay 20000
========================= Accounts: ==========================
Administrator (S-1-5-21-2829335788-446563168-3763627994-500 - Administrator - Disabled)
Gast (S-1-5-21-2829335788-446563168-3763627994-501 - Limited - Disabled)
Perdita (S-1-5-21-2829335788-446563168-3763627994-1004 - Administrator - Enabled) => C:\Users\Perdita
==================== Faulty Device Manager Devices =============
Name: Microsoft-6zu4-Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Microsoft-ISATAP-Adapter
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Microsoft-ISATAP-Adapter #2
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/08/2014 04:38:10 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (12/08/2014 04:38:10 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (12/08/2014 04:36:11 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (12/07/2014 08:56:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (12/07/2014 08:56:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (12/07/2014 08:55:17 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (12/06/2014 10:55:21 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (12/06/2014 10:55:21 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (12/06/2014 10:53:58 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (12/04/2014 04:19:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (12/08/2014 06:47:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
Error: (12/08/2014 03:12:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
Error: (12/08/2014 02:10:10 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 08.12.2014 um 14:07:02 unerwartet heruntergefahren.
Error: (12/06/2014 09:26:32 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (12/06/2014 08:22:23 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (12/05/2014 02:35:16 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (12/04/2014 03:35:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (12/03/2014 09:20:23 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (12/02/2014 05:32:50 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 02.12.2014 um 17:29:31 unerwartet heruntergefahren.
Error: (12/01/2014 11:44:23 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU E5500 @ 2.80GHz
Percentage of memory in use: 89%
Total physical RAM: 1917.24 MB
Available physical RAM: 202.2 MB
Total Pagefile: 4792.24 MB
Available Pagefile: 2663.93 MB
Total Virtual: 2047.88 MB
Available Virtual: 1874.45 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:906.34 GB) (Free:316.8 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: B56C387F)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=906.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25.1 GB) - (Type=12)
==================== End Of Log ============================
gmer: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-08 19:22:11
Windows 6.1.7600 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 ST31000528AS rev.CC66 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Perdita\AppData\Local\Temp\uwldrpoc.sys
---- System - GMER 2.1 ----
SSDT 93A53D7E ZwCreateSection
SSDT 93A53D88 ZwRequestWaitReplyPort
SSDT 93A53D83 ZwSetContextThread
SSDT 93A53D8D ZwSetSecurityObject
SSDT 93A53D92 ZwSystemDebugControl
SSDT 93A53D1F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackTransaction + 13F9 82E53829 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E78132 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 350 82E7FA30 4 Bytes [7E, 3D, A5, 93] {JLE 0x3f; MOVSD ; XCHG EBX, EAX}
.text ntkrnlpa.exe!RtlSidHashLookup + 6AC 82E7FD8C 4 Bytes [88, 3D, A5, 93]
.text ntkrnlpa.exe!RtlSidHashLookup + 6F0 82E7FDD0 4 Bytes [83, 3D, A5, 93]
.text ntkrnlpa.exe!RtlSidHashLookup + 76C 82E7FE4C 4 Bytes [8D, 3D, A5, 93]
.text ntkrnlpa.exe!RtlSidHashLookup + 7C0 82E7FEA0 4 Bytes [92, 3D, A5, 93]
.text ...
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0011672ab757
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x2C 0xD3 0x04 0xF0 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7E 0xAB 0x65 0x17 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0011672ab757 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x2C 0xD3 0x04 0xF0 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7E 0xAB 0x65 0x17 ...
---- EOF - GMER 2.1 ----
Danke schon mal! |
Hinweis: 
aswMBR.exe und speichere die Datei auf deinem Desktop.